@proletariat/cli 0.3.33 → 0.3.35

package/dist/commands/work/start.d.ts

@@ -6,7 +6,6 @@ export default class WorkStart extends PMOCommand {
         ticketId: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
     };
     static flags: {
-        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         all: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         executor: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         action: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
@@ -29,6 +28,9 @@ export default class WorkStart extends PMOCommand {
         focus: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         clone: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'use-api-key': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        machine: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         project: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     execute(): Promise<void>;

package/dist/commands/work/start.js

@@ -1,3 +1,4 @@
+/* eslint-disable max-lines -- large command with many execution paths */
 import { Args, Flags } from '@oclif/core';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
@@ -85,12 +86,6 @@ export default class WorkStart extends PMOCommand {
     };
     static flags = {
         ...pmoBaseFlags,
-        json: Flags.boolean({
-            char: 'm',
-            aliases: ['machine'],
-            description: 'Output prompt configuration as JSON (for AI agents/scripts)',
-            default: false,
-        }),
         all: Flags.boolean({
             char: 'a',
             description: 'Start work on all unassigned backlog tickets (batch mode)',
@@ -185,6 +180,11 @@ export default class WorkStart extends PMOCommand {
             description: 'Skip confirmation prompt (for non-TTY/scripted execution)',
             default: false,
         }),
+        'use-api-key': Flags.boolean({
+            description: 'Use ANTHROPIC_API_KEY for Docker containers instead of OAuth credentials',
+            default: false,
+            hidden: true,
+        }),
     };
     async execute() {
         const { args, flags } = await this.parse(WorkStart);
@@ -1006,8 +1006,10 @@ export default class WorkStart extends PMOCommand {
             // Default to interactive output mode (streaming UI)
             // Can be overridden via --output flag if needed
             const outputMode = flags.output || DEFAULT_EXECUTION_CONFIG.outputMode;
+            // Track whether user explicitly chose to use API key instead of OAuth
+            let useApiKey = flags['use-api-key'] || false;
             // Check Docker credentials for devcontainer environment
-            if (environment === 'devcontainer') {
+            if (environment === 'devcontainer' && !useApiKey) {
                 const hasCredentials = dockerCredentialsExist();
                 if (!hasCredentials) {
                     // In JSON mode with --yes, continue anyway (agent can run /login)
@@ -1015,10 +1017,19 @@ export default class WorkStart extends PMOCommand {
                         // Continue without prompting - agent will need to handle auth
                     }
                     else {
+                        const hasApiKey = !!process.env.ANTHROPIC_API_KEY;
                         this.log('');
-                        this.log(styles.warning('⚠️  No Claude Code credentials found for Docker containers'));
-                        this.log(styles.muted('   Agents will fail with 401 authentication errors without credentials.'));
+                        this.log(styles.warning('⚠️  No Claude Code OAuth credentials found for Docker containers'));
+                        this.log(styles.muted('   Agents need credentials to authenticate with Claude.'));
                         this.log('');
+                        // Build choices based on available options
+                        const authChoices = [
+                            { name: `🔐 Run ${this.config.bin} agent auth now (recommended — uses Max subscription)`, value: 'auth' },
+                        ];
+                        if (hasApiKey) {
+                            authChoices.push({ name: '🔑 Use ANTHROPIC_API_KEY (⚠️  uses API credits, not Max subscription)', value: 'apikey' });
+                        }
+                        authChoices.push({ name: '💻 Switch to host environment instead', value: 'host' }, { name: '✗  Cancel', value: 'cancel' });
                         // Use FlagResolver for auth action
                         const authResolver = new FlagResolver({
                             commandName: 'work start',
@@ -1030,12 +1041,7 @@ export default class WorkStart extends PMOCommand {
                             flagName: 'authAction',
                             type: 'list',
                             message: 'What would you like to do?',
-                            choices: () => [
-                                { name: `🔐 Run ${this.config.bin} agent auth now (one-time setup)`, value: 'auth' },
-                                { name: '💻 Switch to host environment instead', value: 'host' },
-                                { name: '⏩ Continue anyway (must run /login in first agent)', value: 'continue' },
-                                { name: '✗  Cancel', value: 'cancel' },
-                            ],
+                            choices: () => authChoices,
                         });
                         const authResult = await authResolver.resolve();
                         const authAction = authResult.authAction;
@@ -1048,6 +1054,12 @@ export default class WorkStart extends PMOCommand {
                             environment = 'host';
                             this.log(styles.muted('Switched to host environment.'));
                         }
+                        else if (authAction === 'apikey') {
+                            useApiKey = true;
+                            this.log(styles.warning('Using ANTHROPIC_API_KEY — this will consume API credits.'));
+                            this.log(styles.muted(`Run "${this.config.bin} agent auth" to set up OAuth and use your Max subscription instead.`));
+                            this.log('');
+                        }
                         else if (authAction === 'auth') {
                             this.log('');
                             this.log(styles.primary(`Opening ${this.config.bin} agent auth in new tab...`));
@@ -1100,10 +1112,13 @@ export default class WorkStart extends PMOCommand {
                             }
                             this.log('');
                         }
-                        // authAction === 'continue' falls through
                     }
                 }
             }
+            // Pass API key preference to execution context
+            if (useApiKey) {
+                context.useApiKey = true;
+            }
             // Prompt for permissions mode (all environments)
             // Use FlagResolver to handle both JSON mode and interactive prompts consistently
             if (flags['permission-mode']) {
@@ -1617,23 +1632,30 @@ export default class WorkStart extends PMOCommand {
             const agentDir = path.join(workspaceInfo.agentsPath, agent.name);
             return hasDevcontainerConfig(agentDir) && !flags['run-on-host'];
         });
+        // Track whether user explicitly chose to use API key instead of OAuth
+        let batchUseApiKey = false;
         if (anyUseDevcontainer) {
             const hasCredentials = dockerCredentialsExist();
             if (!hasCredentials) {
+                const hasApiKey = !!process.env.ANTHROPIC_API_KEY;
                 this.log('');
-                this.log(styles.warning('⚠️  No Claude Code credentials found for Docker containers'));
-                this.log(styles.muted('   Agents will fail with 401 authentication errors without credentials.'));
+                this.log(styles.warning('⚠️  No Claude Code OAuth credentials found for Docker containers'));
+                this.log(styles.muted('   Agents need credentials to authenticate with Claude.'));
                 this.log('');
+                // Build choices based on available options
+                const batchAuthChoices = [
+                    { name: `🔐 Run ${this.config.bin} agent auth now (recommended — uses Max subscription)`, value: 'auth', command: `${this.config.bin} agent auth` },
+                ];
+                if (hasApiKey) {
+                    batchAuthChoices.push({ name: '🔑 Use ANTHROPIC_API_KEY (⚠️  uses API credits, not Max subscription)', value: 'apikey', command: '' });
+                }
+                batchAuthChoices.push({ name: '💻 Run all agents on host instead (--run-on-host)', value: 'host', command: 'prlt work start --all --run-on-host --json' }, { name: '✗  Cancel', value: 'cancel', command: '' });
                 const { authAction } = await this.prompt([
                     {
                         type: 'list',
                         name: 'authAction',
                         message: 'What would you like to do?',
-                        choices: [
-                            { name: `🔐 Run ${this.config.bin} agent auth now (one-time setup)`, value: 'auth', command: `${this.config.bin} agent auth` },
-                            { name: '💻 Run all agents on host instead (--run-on-host)', value: 'host', command: 'prlt work start --all --run-on-host --json' },
-                            { name: '✗  Cancel', value: 'cancel', command: '' },
-                        ],
+                        choices: batchAuthChoices,
                     },
                 ], batchJsonModeConfig);
                 if (authAction === 'cancel') {
@@ -1645,6 +1667,12 @@ export default class WorkStart extends PMOCommand {
                     flags['run-on-host'] = true;
                     this.log(styles.muted('All agents will run on host.'));
                 }
+                else if (authAction === 'apikey') {
+                    batchUseApiKey = true;
+                    this.log(styles.warning('Using ANTHROPIC_API_KEY — this will consume API credits.'));
+                    this.log(styles.muted(`Run "${this.config.bin} agent auth" to set up OAuth and use your Max subscription instead.`));
+                    this.log('');
+                }
                 else if (authAction === 'auth') {
                     this.log('');
                     this.log(styles.primary(`Opening ${this.config.bin} agent auth in new tab...`));
@@ -1721,6 +1749,7 @@ export default class WorkStart extends PMOCommand {
                     '--display', flags.display || 'background',
                     ...(flags.executor ? ['--executor', flags.executor] : []),
                     ...(flags['run-on-host'] ? ['--run-on-host'] : []),
+                    ...(batchUseApiKey ? ['--use-api-key'] : []),
                     ...(flags.force ? ['--force'] : []),
                     '--permission-mode', batchPermissionMode,
                     ...(flags.clone ? ['--clone'] : []),

package/dist/commands/work/watch.d.ts

@@ -3,7 +3,6 @@ export default class WorkWatch extends PMOCommand {
     static description: string;
     static examples: string[];
     static flags: {
-        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         column: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         strategy: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         agent: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
@@ -13,6 +12,8 @@ export default class WorkWatch extends PMOCommand {
         mode: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'skip-permissions': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         'create-pr': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        machine: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         project: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     private isRunning;

package/dist/commands/work/watch.js

@@ -21,12 +21,6 @@ export default class WorkWatch extends PMOCommand {
     ];
     static flags = {
         ...pmoBaseFlags,
-        json: Flags.boolean({
-            char: 'm',
-            aliases: ['machine'],
-            description: 'Output prompt configuration as JSON (for AI agents/scripts)',
-            default: false,
-        }),
         column: Flags.string({
             char: 'c',
             description: 'Column to watch for new tickets (prompts if not provided)',

package/dist/commands/workflow/create.d.ts

@@ -9,6 +9,7 @@ export default class WorkflowCreate extends PMOCommand {
         description: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         statuses: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        machine: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         project: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     protected getPMOOptions(): {

package/dist/commands/workflow/delete.d.ts

@@ -8,6 +8,7 @@ export default class WorkflowDelete extends PMOCommand {
     static flags: {
         force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        machine: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         project: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     protected getPMOOptions(): {

package/dist/commands/workflow/index.d.ts

@@ -6,6 +6,7 @@ export default class Workflow extends PMOCommand {
         builtin: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         custom: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        machine: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         project: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     protected getPMOOptions(): {

package/dist/commands/workflow/index.js

@@ -18,12 +18,6 @@ export default class Workflow extends PMOCommand {
             description: 'Show only custom workflows',
             default: false,
         }),
-        json: Flags.boolean({
-            char: 'm',
-            aliases: ['machine'],
-            description: 'Output as JSON',
-            default: false,
-        }),
     };
     getPMOOptions() {
         return { promptIfMultiple: false };
@@ -37,7 +31,7 @@ export default class Workflow extends PMOCommand {
         if (flags.custom)
             filter.isBuiltin = false;
         const workflows = await this.storage.listWorkflows(Object.keys(filter).length > 0 ? filter : undefined);
-        if (flags.json) {
+        if (flags.json || flags.machine) {
             this.log(JSON.stringify(workflows, null, 2));
             return;
         }

package/dist/commands/workflow/list.d.ts

@@ -6,6 +6,7 @@ export default class WorkflowList extends PMOCommand {
         builtin: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         custom: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        machine: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         project: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     protected getPMOOptions(): {

package/dist/commands/workflow/switch.d.ts

@@ -8,6 +8,7 @@ export default class WorkflowSwitch extends PMOCommand {
     static flags: {
         force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        machine: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         project: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     execute(): Promise<void>;

package/dist/commands/workflow/view.d.ts

@@ -7,6 +7,7 @@ export default class WorkflowView extends PMOCommand {
     };
     static flags: {
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        machine: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         project: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     protected getPMOOptions(): {

package/dist/commands/workspace/add.d.ts

@@ -7,6 +7,8 @@ export default class WorkspaceAdd extends Command {
     };
     static flags: {
         name: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        machine: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }

package/dist/commands/workspace/add.js

@@ -3,6 +3,7 @@ import chalk from 'chalk';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { registerWorkspace, normalizePath, isWorkspaceRegistered, getWorkspaceNameFromPath, } from '../../lib/machine-config.js';
+import { machineOutputFlags } from '../../lib/pmo/index.js';
 export default class WorkspaceAdd extends Command {
     static description = 'Register an existing workspace in the machine config';
     static examples = [
@@ -17,6 +18,7 @@ export default class WorkspaceAdd extends Command {
         }),
     };
     static flags = {
+        ...machineOutputFlags,
         name: Flags.string({
             char: 'n',
             description: 'Custom name for the workspace (defaults to directory basename or workspace config name)',

package/dist/commands/workspace/list.d.ts

@@ -4,6 +4,7 @@ export default class WorkspaceList extends Command {
     static examples: string[];
     static flags: {
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        machine: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }

package/dist/commands/workspace/list.js

@@ -1,6 +1,7 @@
-import { Command, Flags } from '@oclif/core';
+import { Command } from '@oclif/core';
 import chalk from 'chalk';
 import { findAllHQs, findHQRootWithSource, isValidHQ } from '../../lib/workspace.js';
+import { machineOutputFlags } from '../../lib/pmo/index.js';
 import { getRegisteredWorkspaces, getActiveWorkspace, } from '../../lib/machine-config.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
@@ -11,12 +12,7 @@ export default class WorkspaceList extends Command {
         '<%= config.bin %> <%= command.id %> --json',
     ];
     static flags = {
-        json: Flags.boolean({
-            char: 'm',
-            aliases: ['machine'],
-            description: 'Output as JSON for machine-readable format',
-            default: false,
-        }),
+        ...machineOutputFlags,
     };
     async run() {
         const { flags } = await this.parse(WorkspaceList);
@@ -82,7 +78,7 @@ export default class WorkspaceList extends Command {
             });
         }
         // JSON output
-        if (flags.json) {
+        if (flags.json || flags.machine) {
             const output = {
                 workspaces: workspaces.map((w) => ({
                     name: w.name,

package/dist/commands/workspace/prune.d.ts

@@ -6,6 +6,7 @@ export default class WorkspacePrune extends PromptCommand {
         'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        machine: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
     private findStaleWorkspaces;

package/dist/commands/workspace/prune.js

@@ -6,6 +6,7 @@ import { styles } from '../../lib/styles.js';
 import { getRegisteredHeadquarters, unregisterHeadquarters, } from '../../lib/machine-config.js';
 import { getWorkspaceAgents, removeAgentsFromDatabase, getDatabasePath, } from '../../lib/database/index.js';
 import { outputConfirmationNeededAsJson, createMetadata, } from '../../lib/prompt-json.js';
+import { machineOutputFlags } from '../../lib/pmo/index.js';
 export default class WorkspacePrune extends PromptCommand {
     static description = 'Remove stale workspace entries and agents with deleted worktrees';
     static examples = [
@@ -14,6 +15,7 @@ export default class WorkspacePrune extends PromptCommand {
         '<%= config.bin %> <%= command.id %> --force',
     ];
     static flags = {
+        ...machineOutputFlags,
         'dry-run': Flags.boolean({
             char: 'd',
             description: 'Show what would be removed without removing',
@@ -24,23 +26,19 @@ export default class WorkspacePrune extends PromptCommand {
             description: 'Skip confirmation prompt and prune immediately',
             default: false,
         }),
-        json: Flags.boolean({
-            description: 'Output as JSON',
-            default: false,
-        }),
     };
     async run() {
         const { flags } = await this.parse(WorkspacePrune);
         // In non-TTY mode without --json (CI, scripts, piped), default to dry-run unless --force is set.
         // In --json mode, we use confirmation_needed output instead of auto-dry-run so agents can review and confirm.
         const isNonTTY = !process.stdout.isTTY;
-        const effectiveDryRun = flags['dry-run'] || (!flags.json && isNonTTY && !flags.force);
+        const effectiveDryRun = flags['dry-run'] || (!(flags.json || flags.machine) && isNonTTY && !flags.force);
         // Find stale entries
         const staleWorkspaces = this.findStaleWorkspaces();
         const staleAgents = this.findStaleAgents();
         const totalStale = staleWorkspaces.length + staleAgents.length;
         // JSON output
-        if (flags.json) {
+        if (flags.json || flags.machine) {
             const output = {
                 dryRun: effectiveDryRun,
                 staleWorkspaces: staleWorkspaces.map(w => ({

package/dist/commands/workspace/remove.d.ts

@@ -7,6 +7,7 @@ export default class WorkspaceRemove extends PromptCommand {
     };
     static flags: {
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        machine: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
     private resolveWorkspacePath;

package/dist/commands/workspace/remove.js

@@ -1,6 +1,7 @@
-import { Args, Flags } from '@oclif/core';
+import { Args } from '@oclif/core';
 import chalk from 'chalk';
 import { PromptCommand } from '../../lib/prompt-command.js';
+import { machineOutputFlags } from '../../lib/pmo/index.js';
 import { findWorkspacesByName, findWorkspaceByPath, unregisterWorkspace, normalizePath, getActiveWorkspace, } from '../../lib/machine-config.js';
 import { shouldOutputJson, outputErrorAsJson, createMetadata, } from '../../lib/prompt-json.js';
 export default class WorkspaceRemove extends PromptCommand {
@@ -16,12 +17,7 @@ export default class WorkspaceRemove extends PromptCommand {
         }),
     };
     static flags = {
-        json: Flags.boolean({
-            char: 'm',
-            aliases: ['machine'],
-            description: 'Output prompt configuration as JSON (for AI agents/scripts)',
-            default: false,
-        }),
+        ...machineOutputFlags,
     };
     async run() {
         const { args, flags } = await this.parse(WorkspaceRemove);

package/dist/commands/workspace/use.d.ts

@@ -7,6 +7,7 @@ export default class WorkspaceUse extends PromptCommand {
     };
     static flags: {
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        machine: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }

package/dist/commands/workspace/use.js

@@ -1,7 +1,8 @@
-import { Args, Flags } from '@oclif/core';
+import { Args } from '@oclif/core';
 import chalk from 'chalk';
 import * as fs from 'node:fs';
 import { PromptCommand } from '../../lib/prompt-command.js';
+import { machineOutputFlags } from '../../lib/pmo/index.js';
 import { isValidHQ } from '../../lib/workspace.js';
 import { findWorkspacesByName, findWorkspaceByPath, setActiveWorkspace, normalizePath, getRegisteredWorkspaces, } from '../../lib/machine-config.js';
 export default class WorkspaceUse extends PromptCommand {
@@ -17,12 +18,7 @@ export default class WorkspaceUse extends PromptCommand {
         }),
     };
     static flags = {
-        json: Flags.boolean({
-            char: 'm',
-            aliases: ['machine'],
-            description: 'Output prompt configuration as JSON (for AI agents/scripts)',
-            default: false,
-        }),
+        ...machineOutputFlags,
     };
     async run() {
         const { args, flags } = await this.parse(WorkspaceUse);

package/dist/lib/database/drizzle-schema.d.ts

@@ -33,7 +33,7 @@ export declare const workspace: import("drizzle-orm/sqlite-core").SQLiteTableWit
             tableName: "workspace";
             dataType: "string";
             columnType: "SQLiteText";
-            data: "hq" | "workspace";
+            data: "workspace" | "hq";
             driverParam: string;
             notNull: true;
             hasDefault: false;

package/dist/lib/database/index.d.ts

@@ -52,7 +52,7 @@ export interface AgentWorktree {
     is_clean: boolean;
     last_checked?: string;
 }
-export declare const CREATE_TABLES_SQL = "\n-- Core workspace metadata\nCREATE TABLE IF NOT EXISTS workspace (\n  id INTEGER PRIMARY KEY CHECK (id = 1),\n  type TEXT NOT NULL CHECK (type IN ('hq', 'workspace')),\n  workspace_name TEXT NOT NULL,\n  has_pmo BOOLEAN DEFAULT FALSE,\n  active_theme_id TEXT,\n  created_at TEXT NOT NULL,\n  FOREIGN KEY (active_theme_id) REFERENCES agent_themes(id) ON DELETE SET NULL\n);\n\n-- Repository management\nCREATE TABLE IF NOT EXISTS repositories (\n  name TEXT PRIMARY KEY,\n  path TEXT NOT NULL,\n  type TEXT DEFAULT 'main' CHECK (type IN ('main', 'dependency')),\n  source_url TEXT,\n  action TEXT CHECK (action IN ('clone', 'move', 'link')),\n  added_at TEXT NOT NULL\n);\n\n-- Agent naming themes (optional)\nCREATE TABLE IF NOT EXISTS agent_themes (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL UNIQUE,\n  display_name TEXT NOT NULL,\n  description TEXT,\n  builtin BOOLEAN DEFAULT FALSE,\n  created_at TEXT NOT NULL\n);\n\n-- Names available within each theme\nCREATE TABLE IF NOT EXISTS agent_theme_names (\n  theme_id TEXT NOT NULL,\n  name TEXT NOT NULL,\n  PRIMARY KEY (theme_id, name),\n  FOREIGN KEY (theme_id) REFERENCES agent_themes(id) ON DELETE CASCADE\n);\n\n-- Agent instances in workspace\nCREATE TABLE IF NOT EXISTS agents (\n  name TEXT PRIMARY KEY,\n  type TEXT NOT NULL DEFAULT 'persistent' CHECK (type IN ('persistent', 'ephemeral')),\n  status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'cleaned')),\n  base_name TEXT,\n  theme_id TEXT,\n  worktree_path TEXT,\n  mount_mode TEXT NOT NULL DEFAULT 'worktree' CHECK (mount_mode IN ('worktree', 'clone')),\n  created_at TEXT NOT NULL,\n  cleaned_at TEXT,\n  FOREIGN KEY (theme_id) REFERENCES agent_themes(id) ON DELETE SET NULL\n);\n\n-- Agent-owned worktrees\nCREATE TABLE IF NOT EXISTS agent_worktrees (\n  agent_name TEXT NOT NULL,\n  repo_name TEXT NOT NULL,\n  worktree_path TEXT NOT NULL,\n  branch TEXT NOT NULL,\n  created_at TEXT NOT NULL,\n  PRIMARY KEY (agent_name, repo_name),\n  FOREIGN KEY (agent_name) REFERENCES agents(name) ON DELETE CASCADE,\n  FOREIGN KEY (repo_name) REFERENCES repositories(name) ON DELETE CASCADE\n);\n\n-- Workspace-level settings (key-value store)\nCREATE TABLE IF NOT EXISTS workspace_settings (\n  key TEXT PRIMARY KEY,\n  value TEXT NOT NULL\n);\n\n-- =============================================================================\n-- Indexes\n-- =============================================================================\n\nCREATE INDEX IF NOT EXISTS idx_worktrees_agent ON agent_worktrees(agent_name);\nCREATE INDEX IF NOT EXISTS idx_worktrees_repo ON agent_worktrees(repo_name);\nCREATE INDEX IF NOT EXISTS idx_theme_names_theme ON agent_theme_names(theme_id);\nCREATE INDEX IF NOT EXISTS idx_agents_theme ON agents(theme_id);\n";
+export declare const CREATE_TABLES_SQL = "\n-- Core workspace metadata\nCREATE TABLE IF NOT EXISTS workspace (\n  id INTEGER PRIMARY KEY CHECK (id = 1),\n  type TEXT NOT NULL CHECK (type IN ('hq', 'workspace')),\n  workspace_name TEXT NOT NULL,\n  has_pmo BOOLEAN DEFAULT FALSE,\n  active_theme_id TEXT,\n  created_at TEXT NOT NULL,\n  FOREIGN KEY (active_theme_id) REFERENCES agent_themes(id) ON DELETE SET NULL\n);\n\n-- Repository management\nCREATE TABLE IF NOT EXISTS repositories (\n  name TEXT PRIMARY KEY,\n  path TEXT NOT NULL,\n  type TEXT DEFAULT 'main' CHECK (type IN ('main', 'dependency')),\n  source_url TEXT,\n  action TEXT CHECK (action IN ('clone', 'move', 'link')),\n  added_at TEXT NOT NULL\n);\n\n-- Agent naming themes (optional)\nCREATE TABLE IF NOT EXISTS agent_themes (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL UNIQUE,\n  display_name TEXT NOT NULL,\n  description TEXT,\n  builtin BOOLEAN DEFAULT FALSE,\n  created_at TEXT NOT NULL\n);\n\n-- Names available within each theme\nCREATE TABLE IF NOT EXISTS agent_theme_names (\n  theme_id TEXT NOT NULL,\n  name TEXT NOT NULL,\n  PRIMARY KEY (theme_id, name),\n  FOREIGN KEY (theme_id) REFERENCES agent_themes(id) ON DELETE CASCADE\n);\n\n-- Agent instances in workspace\nCREATE TABLE IF NOT EXISTS agents (\n  name TEXT PRIMARY KEY,\n  type TEXT NOT NULL DEFAULT 'persistent' CHECK (type IN ('persistent', 'ephemeral')),\n  status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'cleaned')),\n  base_name TEXT,\n  theme_id TEXT,\n  worktree_path TEXT,\n  mount_mode TEXT NOT NULL DEFAULT 'worktree' CHECK (mount_mode IN ('worktree', 'clone')),\n  created_at TEXT NOT NULL,\n  cleaned_at TEXT,\n  FOREIGN KEY (theme_id) REFERENCES agent_themes(id) ON DELETE SET NULL\n);\n\n-- Agent-owned worktrees\nCREATE TABLE IF NOT EXISTS agent_worktrees (\n  agent_name TEXT NOT NULL,\n  repo_name TEXT NOT NULL,\n  worktree_path TEXT NOT NULL,\n  branch TEXT NOT NULL,\n  created_at TEXT NOT NULL,\n  last_commit_hash TEXT,\n  commits_ahead INTEGER NOT NULL DEFAULT 0,\n  is_clean INTEGER NOT NULL DEFAULT 1,\n  last_checked TEXT,\n  PRIMARY KEY (agent_name, repo_name),\n  FOREIGN KEY (agent_name) REFERENCES agents(name) ON DELETE CASCADE,\n  FOREIGN KEY (repo_name) REFERENCES repositories(name) ON DELETE CASCADE\n);\n\n-- Workspace-level settings (key-value store)\nCREATE TABLE IF NOT EXISTS workspace_settings (\n  key TEXT PRIMARY KEY,\n  value TEXT NOT NULL\n);\n\n-- =============================================================================\n-- Indexes\n-- =============================================================================\n\nCREATE INDEX IF NOT EXISTS idx_worktrees_agent ON agent_worktrees(agent_name);\nCREATE INDEX IF NOT EXISTS idx_worktrees_repo ON agent_worktrees(repo_name);\nCREATE INDEX IF NOT EXISTS idx_theme_names_theme ON agent_theme_names(theme_id);\nCREATE INDEX IF NOT EXISTS idx_agents_theme ON agents(theme_id);\n";
 /**
  * Get the database path for a workspace
  */

package/dist/lib/database/index.js

@@ -64,6 +64,10 @@ CREATE TABLE IF NOT EXISTS agent_worktrees (
   worktree_path TEXT NOT NULL,
   branch TEXT NOT NULL,
   created_at TEXT NOT NULL,
+  last_commit_hash TEXT,
+  commits_ahead INTEGER NOT NULL DEFAULT 0,
+  is_clean INTEGER NOT NULL DEFAULT 1,
+  last_checked TEXT,
   PRIMARY KEY (agent_name, repo_name),
   FOREIGN KEY (agent_name) REFERENCES agents(name) ON DELETE CASCADE,
   FOREIGN KEY (repo_name) REFERENCES repositories(name) ON DELETE CASCADE
@@ -184,6 +188,22 @@ export function openWorkspaceDatabase(workspacePath) {
     catch {
         // Ignore migration errors - table might not exist yet
     }
+    // Migration: add missing columns to agent_worktrees table (TKT-1014)
+    try {
+        const worktreesTableExists = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='agent_worktrees'").get();
+        if (worktreesTableExists) {
+            const worktreeTableInfo = db.prepare("PRAGMA table_info(agent_worktrees)").all();
+            if (!worktreeTableInfo.some(col => col.name === 'commits_ahead')) {
+                db.exec("ALTER TABLE agent_worktrees ADD COLUMN last_commit_hash TEXT");
+                db.exec("ALTER TABLE agent_worktrees ADD COLUMN commits_ahead INTEGER NOT NULL DEFAULT 0");
+                db.exec("ALTER TABLE agent_worktrees ADD COLUMN is_clean INTEGER NOT NULL DEFAULT 1");
+                db.exec("ALTER TABLE agent_worktrees ADD COLUMN last_checked TEXT");
+            }
+        }
+    }
+    catch {
+        // Ignore migration errors - table might not exist yet or columns already exist
+    }
     // Migration: add mount_mode column to agents table (TKT-686)
     try {
         const agentsTableInfo = db.prepare("PRAGMA table_info(agents)").all();

package/dist/lib/execution/devcontainer.js

@@ -96,7 +96,9 @@ export function generateDevcontainerJson(options, config) {
         mounts,
         containerEnv: {
             DEVCONTAINER: 'true',
-            ANTHROPIC_API_KEY: '${localEnv:ANTHROPIC_API_KEY}',
+            // NOTE: ANTHROPIC_API_KEY is intentionally NOT passed by default.
+            // Claude Code prefers API key over OAuth, so passing it would cause agents
+            // to burn API credits instead of using Max subscription via OAuth.
             // GH_TOKEN enables gh CLI in container (for PR creation, etc.)
             GH_TOKEN: '${localEnv:GH_TOKEN}',
             GITHUB_TOKEN: '${localEnv:GITHUB_TOKEN}',

package/dist/lib/execution/runners.d.ts

@@ -46,8 +46,13 @@ export declare function configureITermTmuxWindowMode(mode: 'tab' | 'window'): vo
  */
 export declare function credentialsVolumeExists(): boolean;
 /**
- * Check if valid Claude credentials exist in the Docker volume.
- * Returns true if credentials exist and are not expired.
+ * Check if valid Claude OAuth credentials exist in the Docker volume.
+ * Returns true if OAuth credentials are stored (even if access token is expired,
+ * since Claude Code handles refresh internally using stored refresh tokens).
+ *
+ * NOTE: This intentionally does NOT check for ANTHROPIC_API_KEY. If the user
+ * has an API key but no OAuth credentials, we want to prompt them to set up
+ * OAuth (which uses their Max subscription) rather than silently burning API credits.
  */
 export declare function dockerCredentialsExist(): boolean;
 /**

package/dist/lib/execution/runners.js

@@ -1,3 +1,4 @@
+/* eslint-disable max-lines -- runner implementations require cohesive logic */
 /**
  * Execution Runners
  *
@@ -102,19 +103,23 @@ export function credentialsVolumeExists() {
     }
 }
 /**
- * Check if valid Claude credentials exist in the Docker volume.
- * Returns true if credentials exist and are not expired.
+ * Check if valid Claude OAuth credentials exist in the Docker volume.
+ * Returns true if OAuth credentials are stored (even if access token is expired,
+ * since Claude Code handles refresh internally using stored refresh tokens).
+ *
+ * NOTE: This intentionally does NOT check for ANTHROPIC_API_KEY. If the user
+ * has an API key but no OAuth credentials, we want to prompt them to set up
+ * OAuth (which uses their Max subscription) rather than silently burning API credits.
  */
 export function dockerCredentialsExist() {
     try {
         const result = execSync(`docker run --rm -v ${CLAUDE_CREDENTIALS_VOLUME}:/data alpine cat /data/.credentials.json 2>/dev/null`, { stdio: 'pipe', encoding: 'utf-8' });
         const creds = JSON.parse(result);
-        if (creds.claudeAiOauth?.accessToken && creds.claudeAiOauth?.expiresAt) {
-            // Check if expired
-            const expiresAt = creds.claudeAiOauth.expiresAt;
-            if (expiresAt > Date.now()) {
-                return true;
-            }
+        // Check if OAuth credentials exist. Don't check expiration because
+        // access tokens are short-lived but Claude Code handles token refresh
+        // internally using stored refresh tokens.
+        if (creds.claudeAiOauth?.accessToken) {
+            return true;
         }
         return false;
     }
@@ -767,7 +772,10 @@ function createDockerContainer(context, containerName, imageName, config) {
         `-e PRLT_HQ_PATH=/hq`,
         `-e PRLT_AGENT_NAME="${context.agentName}"`,
         `-e PRLT_HOST_PATH="${context.agentDir}"`,
-        ...(process.env.ANTHROPIC_API_KEY ? [`-e ANTHROPIC_API_KEY="${process.env.ANTHROPIC_API_KEY}"`] : []),
+        // Only pass ANTHROPIC_API_KEY if the user explicitly chose to use it (no OAuth creds).
+        // Claude Code prefers API key over OAuth, so passing it would cause agents to burn
+        // API credits instead of using Max subscription.
+        ...(context.useApiKey && process.env.ANTHROPIC_API_KEY ? [`-e ANTHROPIC_API_KEY="${process.env.ANTHROPIC_API_KEY}"`] : []),
         ...(process.env.GITHUB_TOKEN ? [`-e GITHUB_TOKEN="${process.env.GITHUB_TOKEN}"`] : []),
         ...(process.env.GH_TOKEN ? [`-e GH_TOKEN="${process.env.GH_TOKEN}"`] : []),
         // NOTE: Do NOT pass CLAUDE_CODE_OAUTH_TOKEN - it overrides credentials file
@@ -1509,7 +1517,7 @@ exec bash
             try {
                 execSync(`docker exec ${actualContainerId} tmux has-session -t "${sessionName}" 2>&1`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
             }
-            catch (err) {
+            catch {
                 return {
                     success: false,
                     error: `Failed to verify tmux session "${sessionName}" inside container. The session may not have started correctly.`,