@proletariat/cli 0.3.9 → 0.3.11

package/dist/commands/work/start.d.ts

@@ -8,7 +8,6 @@ export default class WorkStart extends PMOCommand {
     static flags: {
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         all: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        mode: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         executor: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         action: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         prompt: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
@@ -17,6 +16,7 @@ export default class WorkStart extends PMOCommand {
         'vm-host': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'run-on-host': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         reconfigure: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'permission-mode': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'skip-permissions': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         'create-pr': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         'no-pr': import("@oclif/core/interfaces").BooleanFlag<boolean>;
@@ -25,6 +25,7 @@ export default class WorkStart extends PMOCommand {
         session: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         agent: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         ephemeral: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        focus: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         project: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     execute(): Promise<void>;

package/dist/commands/work/start.js

@@ -5,12 +5,12 @@ import { execSync } from 'node:child_process';
 import inquirer from 'inquirer';
 import Database from 'better-sqlite3';
 import { PMOCommand, pmoBaseFlags, autoExportToBoard } from '../../lib/pmo/index.js';
-import { shouldOutputJson, outputErrorAsJson, createMetadata, } from '../../lib/prompt-json.js';
+import { shouldOutputJson, outputPromptAsJson, outputErrorAsJson, createMetadata, buildPromptConfig, } from '../../lib/prompt-json.js';
 import { getWorkColumnSetting, findColumnByName } from '../../lib/pmo/utils.js';
 import { styles } from '../../lib/styles.js';
 import { getWorkspaceInfo, createEphemeralAgent, getTicketTmuxSession, killTmuxSession, } from '../../lib/agents/commands.js';
 import { generateBranchName, DEFAULT_EXECUTION_CONFIG, } from '../../lib/execution/types.js';
-import { runExecution, isDockerRunning } from '../../lib/execution/runners.js';
+import { runExecution, isDockerRunning, isGitHubTokenAvailable, isDevcontainerCliInstalled, dockerCredentialsExist, getDockerCredentialInfo } from '../../lib/execution/runners.js';
 import { ExecutionStorage, ContainerStorage } from '../../lib/execution/storage.js';
 import { loadExecutionConfig, getTerminalApp, promptTerminalPreference, getShell, promptShellPreference, hasTerminalPreference, hasShellPreference, getOrPromptCoderName } from '../../lib/execution/config.js';
 import { hasDevcontainerConfig } from '../../lib/execution/devcontainer.js';
@@ -92,11 +92,6 @@ export default class WorkStart extends PMOCommand {
             description: 'Start work on all unassigned backlog tickets (batch mode)',
             default: false,
         }),
-        mode: Flags.string({
-            char: 'm',
-            description: 'Runtime mode',
-            options: ['foreground', 'background', 'tmux', 'terminal', 'devcontainer', 'docker', 'vm'],
-        }),
         executor: Flags.string({
             char: 'e',
             description: 'Override executor',
@@ -131,8 +126,12 @@ export default class WorkStart extends PMOCommand {
             description: 'Re-prompt for terminal app preference',
             default: false,
         }),
+        'permission-mode': Flags.string({
+            description: 'Permission mode for Claude Code (danger=skip checks, safe=require approval)',
+            options: ['danger', 'safe'],
+        }),
         'skip-permissions': Flags.boolean({
-            description: 'Skip permission prompts (danger mode)',
+            description: 'Skip permission checks (shorthand for --permission-mode danger)',
             default: false,
         }),
         'create-pr': Flags.boolean({
@@ -150,8 +149,8 @@ export default class WorkStart extends PMOCommand {
         }),
         display: Flags.string({
             char: 'd',
-            description: 'Display mode for devcontainer (where to show output)',
-            options: ['terminal', 'background'],
+            description: 'Display mode (foreground=current terminal, terminal=new tab, background=detached)',
+            options: ['foreground', 'terminal', 'background'],
         }),
         session: Flags.string({
             char: 's',
@@ -166,10 +165,24 @@ export default class WorkStart extends PMOCommand {
             description: 'Create an ephemeral agent on-demand (auto-generates name)',
             default: false,
         }),
+        focus: Flags.boolean({
+            description: 'Bring terminal to foreground when opening new tabs (default: opens in background)',
+            default: false,
+        }),
     };
     async execute() {
         const { args, flags } = await this.parse(WorkStart);
         const projectId = flags.project;
+        // Handle --skip-permissions flag (alias for --permission-mode danger)
+        // Check for conflicting flags first
+        if (flags['skip-permissions'] && flags['permission-mode']) {
+            this.error('Cannot use both --skip-permissions and --permission-mode flags.\n' +
+                'Use only one: --skip-permissions OR --permission-mode danger/safe');
+        }
+        // Apply --skip-permissions as --permission-mode danger
+        if (flags['skip-permissions']) {
+            flags['permission-mode'] = 'danger';
+        }
         // Check if JSON output mode is active
         const jsonMode = shouldOutputJson(flags);
         // Helper to handle errors in JSON mode
@@ -394,7 +407,7 @@ export default class WorkStart extends PMOCommand {
             // At this point agentName is guaranteed to be set
             const assignedAgent = agentName;
             // Validate agent - for non-ephemeral agents, check if it exists in workspace
-            let agentInfo = workspaceInfo.agents.find((a) => a.name === assignedAgent);
+            const agentInfo = workspaceInfo.agents.find((a) => a.name === assignedAgent);
             if (!isEphemeralAgent && !agentInfo) {
                 db.close();
                 this.error(`Agent "${assignedAgent}" not found in workspace.\n` +
@@ -576,6 +589,7 @@ export default class WorkStart extends PMOCommand {
                 }
                 actionChoices.push(new inquirer.Separator('── Custom ──'));
                 actionChoices.push({ name: 'Custom prompt...', value: '__custom__' });
+                actionChoices.push({ name: 'Ad-hoc session - unstructured exploration/debugging', value: '__adhoc__' });
                 const { selectedActionId } = await inquirer.prompt([
                     {
                         type: 'list',
@@ -595,6 +609,19 @@ export default class WorkStart extends PMOCommand {
                     ]);
                     customPrompt = customInput.trim();
                 }
+                else if (selectedActionId === '__adhoc__') {
+                    // Ad-hoc session - no specific action, just launch Claude for exploration
+                    selectedAction = {
+                        id: 'adhoc',
+                        name: 'Ad-hoc',
+                        description: 'Unstructured exploration and debugging',
+                        prompt: 'You are working on an ad-hoc session for exploration and debugging. Help the user with whatever they need.',
+                        modifiesCode: false,
+                        defaultMoveToCategory: 'started',
+                        isBuiltin: false,
+                        createdAt: new Date(),
+                    };
+                }
                 else {
                     selectedAction = await this.storage.getAction(selectedActionId);
                 }
@@ -635,22 +662,37 @@ export default class WorkStart extends PMOCommand {
             let environment = 'host';
             let displayMode = 'terminal';
             let sandboxed = false; // Whether --dangerously-skip-permissions is NOT used
-            if (hasDevcontainer && !flags.mode && !flags['run-on-host']) {
+            if (hasDevcontainer && !flags.display && !flags['run-on-host']) {
                 // Agent has devcontainer - prompt for environment choice
+                // Check devcontainer prerequisites upfront
+                const dockerRunning = isDockerRunning();
+                const devcontainerCliInstalled = isDevcontainerCliInstalled();
+                const devcontainerReady = dockerRunning && devcontainerCliInstalled;
+                // Build missing requirements message for devcontainer option
+                let devcontainerLabel = '🐳 devcontainer (sandboxed, recommended)';
+                if (!devcontainerReady) {
+                    const missing = [];
+                    if (!dockerRunning)
+                        missing.push('Docker');
+                    if (!devcontainerCliInstalled)
+                        missing.push('devcontainer CLI');
+                    devcontainerLabel = `🐳 devcontainer (requires: ${missing.join(', ')})`;
+                }
                 // Loop to allow re-selection if Docker isn't running
                 let environmentSelected = false;
                 while (!environmentSelected) {
+                    // eslint-disable-next-line no-await-in-loop -- Interactive loop with retry on Docker check
                     const { selectedEnvironment } = await inquirer.prompt([
                         {
                             type: 'list',
                             name: 'selectedEnvironment',
                             message: 'Where should the agent run?',
                             choices: [
-                                { name: '🐳 devcontainer (sandboxed, recommended)', value: 'devcontainer' },
+                                { name: devcontainerLabel, value: 'devcontainer', disabled: !devcontainerReady },
                                 { name: '💻 host (runs directly on your machine)', value: 'host' },
                                 { name: '✗  cancel', value: 'cancel' },
                             ],
-                            default: 'devcontainer',
+                            default: devcontainerReady ? 'devcontainer' : 'host',
                         },
                     ]);
                     if (selectedEnvironment === 'cancel') {
@@ -659,7 +701,7 @@ export default class WorkStart extends PMOCommand {
                         return;
                     }
                     if (selectedEnvironment === 'devcontainer') {
-                        // Check Docker is running before proceeding with devcontainer
+                        // Double-check prerequisites (in case user retried after starting Docker)
                         if (!isDockerRunning()) {
                             this.log('');
                             this.warn('Docker is not running.\n' +
@@ -668,8 +710,74 @@ export default class WorkStart extends PMOCommand {
                             this.log('');
                             continue; // Re-prompt for environment selection
                         }
+                        // Check devcontainer CLI is installed
+                        if (!isDevcontainerCliInstalled()) {
+                            this.log('');
+                            this.warn('devcontainer CLI is not installed.\n' +
+                                'Install with: npm install -g @devcontainers/cli\n' +
+                                'Or select "host" to run directly on your machine.');
+                            this.log('');
+                            continue; // Re-prompt for environment selection
+                        }
+                        // Check GitHub token is available for git push operations
+                        if (!isGitHubTokenAvailable()) {
+                            const tokenChoices = [
+                                { name: 'Yes, continue anyway (git push may fail)', value: 'continue' },
+                                { name: 'No, let me run gh auth login first', value: 'cancel' },
+                                { name: 'Switch to host mode instead', value: 'host' },
+                            ];
+                            const tokenMessage = 'GitHub token not found. Git push may fail. Continue without token?';
+                            if (jsonMode) {
+                                outputPromptAsJson(buildPromptConfig('list', 'tokenAction', tokenMessage, tokenChoices), createMetadata('work start', flags));
+                                db.close();
+                                return;
+                            }
+                            this.log('');
+                            this.warn('GitHub token not found.\n' +
+                                'Git push operations may fail inside the container.\n' +
+                                'Run `gh auth login` to authenticate, or continue without token.');
+                            this.log('');
+                            // eslint-disable-next-line no-await-in-loop -- Interactive user prompt in loop
+                            const { tokenAction } = await inquirer.prompt([
+                                {
+                                    type: 'list',
+                                    name: 'tokenAction',
+                                    message: tokenMessage,
+                                    choices: tokenChoices,
+                                    default: 'continue',
+                                },
+                            ]);
+                            if (tokenAction === 'cancel') {
+                                db.close();
+                                this.log(styles.muted('Run `gh auth login` and try again.'));
+                                return;
+                            }
+                            if (tokenAction === 'host') {
+                                environment = 'host';
+                                // Skip to host mode prompts
+                                // eslint-disable-next-line no-await-in-loop -- Follow-up prompt after user selection
+                                const { selectedDisplay } = await inquirer.prompt([
+                                    {
+                                        type: 'list',
+                                        name: 'selectedDisplay',
+                                        message: 'How should the agent output be displayed?',
+                                        choices: [
+                                            { name: '🖥️  New tab      - Opens in new terminal tab (recommended)', value: 'terminal' },
+                                            { name: '▶️  Foreground  - Run in current terminal (blocking)', value: 'foreground' },
+                                            { name: '📦 Background  - Runs detached, reattach with: prlt session attach', value: 'background' },
+                                        ],
+                                        default: 'terminal',
+                                    },
+                                ]);
+                                displayMode = selectedDisplay;
+                                environmentSelected = true;
+                                continue;
+                            }
+                            // tokenAction === 'continue' - fall through to devcontainer setup
+                        }
                         environment = 'devcontainer';
                         // Pick display mode for devcontainer
+                        // eslint-disable-next-line no-await-in-loop -- Follow-up prompt after selection
                         const { selectedDisplay } = await inquirer.prompt([
                             {
                                 type: 'list',
@@ -677,6 +785,7 @@ export default class WorkStart extends PMOCommand {
                                 message: 'How should the agent output be displayed?',
                                 choices: [
                                     { name: '🖥️  New tab      - Opens in new terminal tab (recommended)', value: 'terminal' },
+                                    { name: '▶️  Foreground  - Run in current terminal (blocking)', value: 'foreground' },
                                     { name: '📦 Background  - Runs detached, reattach with: prlt session attach', value: 'background' },
                                 ],
                                 default: 'terminal',
@@ -689,6 +798,7 @@ export default class WorkStart extends PMOCommand {
                     else {
                         // User chose host
                         environment = 'host';
+                        // eslint-disable-next-line no-await-in-loop -- Follow-up prompt after selection
                         const { selectedDisplay } = await inquirer.prompt([
                             {
                                 type: 'list',
@@ -696,6 +806,7 @@ export default class WorkStart extends PMOCommand {
                                 message: 'How should the agent output be displayed?',
                                 choices: [
                                     { name: '🖥️  New tab      - Opens in new terminal tab (recommended)', value: 'terminal' },
+                                    { name: '▶️  Foreground  - Run in current terminal (blocking)', value: 'foreground' },
                                     { name: '📦 Background  - Runs detached, reattach with: prlt session attach', value: 'background' },
                                 ],
                                 default: 'terminal',
@@ -707,15 +818,11 @@ export default class WorkStart extends PMOCommand {
                 }
             }
             else if (useDevcontainer) {
-                // Devcontainer with explicit mode flag
+                // Devcontainer with explicit display flag
                 environment = 'devcontainer';
-                // Use --display flag if provided, otherwise fall back to --mode or default to 'terminal'
                 if (flags.display) {
                     displayMode = flags.display;
                 }
-                else if (flags.mode && ['terminal', 'background'].includes(flags.mode)) {
-                    displayMode = flags.mode;
-                }
                 else {
                     // Default to terminal for devcontainer (opens new tab instead of blocking current terminal)
                     displayMode = 'terminal';
@@ -723,27 +830,14 @@ export default class WorkStart extends PMOCommand {
             }
             else {
                 // No devcontainer or --run-on-host - host mode selection
-                if (flags.mode) {
-                    const flagMode = flags.mode;
-                    // Set environment based on mode flag
-                    if (flagMode === 'docker') {
-                        environment = 'docker';
-                        displayMode = 'terminal';
-                    }
-                    else if (flagMode === 'vm') {
-                        environment = 'vm';
-                        displayMode = 'terminal';
-                    }
-                    else {
-                        // Host environment: terminal/background are display modes
-                        environment = 'host';
-                        displayMode = flagMode;
-                    }
+                environment = 'host';
+                if (flags.display) {
+                    displayMode = flags.display;
                 }
                 else {
                     const warningMsg = flags['run-on-host']
-                        ? 'Select execution mode (--run-on-host: bypassing devcontainer):'
-                        : 'Select execution mode (no devcontainer - running on host):';
+                        ? 'Select display mode (--run-on-host: bypassing devcontainer):'
+                        : 'Select display mode (no devcontainer - running on host):';
                     const { selectedMode } = await inquirer.prompt([
                         {
                             type: 'list',
@@ -751,53 +845,127 @@ export default class WorkStart extends PMOCommand {
                             message: warningMsg,
                             choices: [
                                 { name: '🖥️  New tab      - Opens in new terminal tab (recommended)', value: 'terminal' },
+                                { name: '▶️  Foreground  - Run in current terminal (blocking)', value: 'foreground' },
                                 { name: '📦 Background  - Runs detached, reattach with: prlt session attach', value: 'background' },
-                                new inquirer.Separator('── Sandboxed (requires setup) ──'),
-                                { name: '🐳 Docker      - Container with worktree mounted', value: 'docker' },
-                                new inquirer.Separator('── Remote ──'),
-                                { name: '☁️  VM          - Remote VM via SSH', value: 'vm' },
                             ],
                             default: 'terminal',
                         },
                     ]);
-                    // Set environment based on selection
-                    if (selectedMode === 'docker') {
-                        environment = 'docker';
-                        displayMode = 'terminal';
-                    }
-                    else if (selectedMode === 'vm') {
-                        environment = 'vm';
-                        displayMode = 'terminal';
-                    }
-                    else {
-                        // Host environment: terminal/background are display modes
-                        environment = 'host';
-                        displayMode = selectedMode;
-                    }
+                    displayMode = selectedMode;
                 }
             }
             const executor = flags.executor || DEFAULT_EXECUTION_CONFIG.defaultExecutor;
             // Default to interactive output mode (streaming UI)
             // Can be overridden via --output flag if needed
-            let outputMode = flags.output || DEFAULT_EXECUTION_CONFIG.outputMode;
+            const outputMode = flags.output || DEFAULT_EXECUTION_CONFIG.outputMode;
+            // Check Docker credentials for devcontainer environment
+            if (environment === 'devcontainer') {
+                const hasCredentials = dockerCredentialsExist();
+                if (!hasCredentials) {
+                    this.log('');
+                    this.log(styles.warning('⚠️  No Claude Code credentials found for Docker containers'));
+                    this.log(styles.muted('   Agents will fail with 401 authentication errors without credentials.'));
+                    this.log('');
+                    const { authAction } = await inquirer.prompt([
+                        {
+                            type: 'list',
+                            name: 'authAction',
+                            message: 'What would you like to do?',
+                            choices: [
+                                { name: `🔐 Run ${this.config.bin} agent auth now (one-time setup)`, value: 'auth' },
+                                { name: '💻 Switch to host environment instead', value: 'host' },
+                                { name: '⏩ Continue anyway (must run /login in first agent)', value: 'continue' },
+                                { name: '✗  Cancel', value: 'cancel' },
+                            ],
+                        },
+                    ]);
+                    if (authAction === 'cancel') {
+                        db.close();
+                        this.log(styles.muted('Cancelled.'));
+                        return;
+                    }
+                    if (authAction === 'host') {
+                        environment = 'host';
+                        this.log(styles.muted('Switched to host environment.'));
+                    }
+                    else if (authAction === 'auth') {
+                        this.log('');
+                        this.log(styles.primary(`Opening ${this.config.bin} agent auth in new tab...`));
+                        this.log('');
+                        // Open auth in a new terminal tab
+                        const authCmd = `${process.argv[1]} agent auth`;
+                        try {
+                            execSync(`osascript -e '
+                tell application "iTerm"
+                  tell current window
+                    create tab with default profile
+                    tell current session
+                      write text "${authCmd}"
+                    end tell
+                  end tell
+                end tell
+              '`);
+                        }
+                        catch {
+                            // Fallback: try Terminal.app
+                            try {
+                                execSync(`osascript -e 'tell application "Terminal" to do script "${authCmd}"'`);
+                            }
+                            catch {
+                                this.log(styles.warning('Could not open new terminal tab.'));
+                                this.log(styles.muted(`Please run manually: ${authCmd}`));
+                            }
+                        }
+                        this.log(styles.muted('Complete the /login flow in the new tab, then press Enter here...'));
+                        this.log('');
+                        // Wait for user to complete auth
+                        await inquirer.prompt([{
+                                type: 'input',
+                                name: 'done',
+                                message: 'Press Enter when authentication is complete:',
+                            }]);
+                        // Check if credentials now exist
+                        if (!dockerCredentialsExist()) {
+                            this.log('');
+                            this.log(styles.warning('Authentication did not complete. No credentials found.'));
+                            db.close();
+                            return;
+                        }
+                        const info = getDockerCredentialInfo();
+                        this.log('');
+                        this.log(styles.success('✓ Credentials configured'));
+                        if (info) {
+                            this.log(styles.muted(`   Subscription: ${info.subscriptionType || 'unknown'}`));
+                            this.log(styles.muted(`   Expires: ${info.expiresAt.toLocaleDateString()}`));
+                        }
+                        this.log('');
+                    }
+                    // authAction === 'continue' falls through
+                }
+            }
             // Prompt for permissions mode (all environments)
-            // Skip prompt if --skip-permissions flag is set
-            if (flags['skip-permissions']) {
-                sandboxed = false;
+            // Skip prompt if --permission-mode flag is set
+            if (flags['permission-mode']) {
+                sandboxed = flags['permission-mode'] === 'safe';
             }
             else {
-                const containerNote = (environment === 'devcontainer' || environment === 'docker')
+                const containerNote = environment === 'devcontainer'
                     ? ' (container provides additional isolation)'
                     : '';
+                const permissionChoices = [
+                    { name: '⚠️  danger - Skip permission checks (faster, container provides isolation)', value: 'danger', command: `prlt work start ${ticketId} --skip-permissions` },
+                    { name: '🔒 safe   - Requires approval for dangerous operations', value: 'safe' },
+                ];
+                // Handle JSON mode
+                if (jsonMode) {
+                    outputPromptAsJson(buildPromptConfig('list', 'permissionMode', `Permission mode for Claude Code${containerNote}:`, permissionChoices, 'danger'), createMetadata('work start', flags));
+                }
                 const { permissionMode } = await inquirer.prompt([
                     {
                         type: 'list',
                         name: 'permissionMode',
                         message: `Permission mode for Claude Code${containerNote}:`,
-                        choices: [
-                            { name: '⚠️  danger - Skip permission checks (faster, container provides isolation)', value: 'danger' },
-                            { name: '🔒 safe   - Requires approval for dangerous operations', value: 'safe' },
-                        ],
+                        choices: permissionChoices,
                         default: 'danger',
                     },
                 ]);
@@ -836,7 +1004,7 @@ export default class WorkStart extends PMOCommand {
             this.log(styles.muted(`   Action: ${context.actionName || 'None'}`));
             this.log(styles.muted(`   Executor: ${executor}`));
             // Environment info
-            const envIcon = environment === 'devcontainer' ? '🐳' : (environment === 'docker' ? '📦' : '💻');
+            const envIcon = environment === 'devcontainer' ? '🐳' : '💻';
             this.log(styles.muted(`   Environment: ${envIcon} ${environment}`));
             this.log(styles.muted(`   Display: ${displayMode}`));
             // Permissions info
@@ -1069,6 +1237,10 @@ export default class WorkStart extends PMOCommand {
             executionConfig.outputMode = outputMode;
             // Set sandboxed mode (determines whether --dangerously-skip-permissions is used)
             executionConfig.sandboxed = sandboxed;
+            // Handle --focus flag: when set, bring terminal to foreground instead of opening in background
+            if (flags.focus) {
+                executionConfig.terminal.openInBackground = false;
+            }
             // Run execution
             this.log(styles.muted('Starting agent...'));
             const sessionManager = (flags.session || 'tmux');
@@ -1149,7 +1321,8 @@ export default class WorkStart extends PMOCommand {
      */
     async runBatchMode(workspaceInfo, db, executionStorage, flags) {
         // Get all tickets and filter to backlog/unstarted (not in progress)
-        // Note: In batch mode, we use undefined to get all tickets across all projects
+        // Note: In batch mode, we get all tickets across all projects (pass undefined for projectId)
+        // eslint-disable-next-line unicorn/no-useless-undefined
         const allTickets = await this.storage.listTickets(undefined);
         const backlogTickets = allTickets.filter(t => t.statusCategory === 'backlog' || t.statusCategory === 'unstarted' || !t.statusCategory);
         if (backlogTickets.length === 0) {
@@ -1199,6 +1372,110 @@ export default class WorkStart extends PMOCommand {
             this.log(styles.muted('Cancelled.'));
             return;
         }
+        // Prompt for permissions mode once for all tickets (TKT-513)
+        let batchPermissionMode = flags['permission-mode'];
+        if (!batchPermissionMode) {
+            const { permissionMode } = await inquirer.prompt([
+                {
+                    type: 'list',
+                    name: 'permissionMode',
+                    message: 'Permission mode for Claude Code:',
+                    choices: [
+                        { name: '⚠️  danger - Skip permission checks (faster, container provides isolation)', value: 'danger' },
+                        { name: '🔒 safe   - Requires approval for dangerous operations', value: 'safe' },
+                    ],
+                    default: 'danger',
+                },
+            ]);
+            batchPermissionMode = permissionMode;
+        }
+        // Check Docker credentials if any agents use devcontainers
+        const anyUseDevcontainer = availableAgents.some(agent => {
+            const agentDir = path.join(workspaceInfo.agentsPath, agent.name);
+            return hasDevcontainerConfig(agentDir) && !flags['run-on-host'];
+        });
+        if (anyUseDevcontainer) {
+            const hasCredentials = dockerCredentialsExist();
+            if (!hasCredentials) {
+                this.log('');
+                this.log(styles.warning('⚠️  No Claude Code credentials found for Docker containers'));
+                this.log(styles.muted('   Agents will fail with 401 authentication errors without credentials.'));
+                this.log('');
+                const { authAction } = await inquirer.prompt([
+                    {
+                        type: 'list',
+                        name: 'authAction',
+                        message: 'What would you like to do?',
+                        choices: [
+                            { name: `🔐 Run ${this.config.bin} agent auth now (one-time setup)`, value: 'auth' },
+                            { name: '💻 Run all agents on host instead (--run-on-host)', value: 'host' },
+                            { name: '✗  Cancel', value: 'cancel' },
+                        ],
+                    },
+                ]);
+                if (authAction === 'cancel') {
+                    db.close();
+                    this.log(styles.muted('Cancelled.'));
+                    return;
+                }
+                if (authAction === 'host') {
+                    flags['run-on-host'] = true;
+                    this.log(styles.muted('All agents will run on host.'));
+                }
+                else if (authAction === 'auth') {
+                    this.log('');
+                    this.log(styles.primary(`Opening ${this.config.bin} agent auth in new tab...`));
+                    this.log('');
+                    // Open auth in a new terminal tab
+                    const authCmd = `${process.argv[1]} agent auth`;
+                    try {
+                        execSync(`osascript -e '
+              tell application "iTerm"
+                tell current window
+                  create tab with default profile
+                  tell current session
+                    write text "${authCmd}"
+                  end tell
+                end tell
+              end tell
+            '`);
+                    }
+                    catch {
+                        // Fallback: try Terminal.app
+                        try {
+                            execSync(`osascript -e 'tell application "Terminal" to do script "${authCmd}"'`);
+                        }
+                        catch {
+                            this.log(styles.warning('Could not open new terminal tab.'));
+                            this.log(styles.muted(`Please run manually: ${authCmd}`));
+                        }
+                    }
+                    this.log(styles.muted('Complete the /login flow in the new tab, then press Enter here...'));
+                    this.log('');
+                    // Wait for user to complete auth
+                    await inquirer.prompt([{
+                            type: 'input',
+                            name: 'done',
+                            message: 'Press Enter when authentication is complete:',
+                        }]);
+                    // Check if credentials now exist
+                    if (!dockerCredentialsExist()) {
+                        this.log('');
+                        this.log(styles.warning('Authentication did not complete. No credentials found.'));
+                        db.close();
+                        return;
+                    }
+                    const info = getDockerCredentialInfo();
+                    this.log('');
+                    this.log(styles.success('✓ Credentials configured'));
+                    if (info) {
+                        this.log(styles.muted(`   Subscription: ${info.subscriptionType || 'unknown'}`));
+                        this.log(styles.muted(`   Expires: ${info.expiresAt.toLocaleDateString()}`));
+                    }
+                    this.log('');
+                }
+            }
+        }
         // Assign tickets to agents (round-robin)
         const assignments = [];
         for (let i = 0; i < backlogTickets.length; i++) {
@@ -1213,13 +1490,16 @@ export default class WorkStart extends PMOCommand {
                 this.log(styles.muted(`Starting ${ticket.id} with ${agent.name}...`));
                 // Use the work:start command for each ticket
                 // Pass --project from ticket to avoid re-prompting for project selection
+                // Pass --permission-mode to skip prompts in recursive calls (TKT-513)
+                // eslint-disable-next-line no-await-in-loop -- Sequential spawning with user feedback
                 await this.config.runCommand('work:start', [
                     ticket.id,
                     ...(ticket.projectId ? ['--project', ticket.projectId] : []),
-                    '--mode', flags.mode || 'background',
+                    '--display', flags.display || 'background',
                     ...(flags.executor ? ['--executor', flags.executor] : []),
                     ...(flags['run-on-host'] ? ['--run-on-host'] : []),
                     ...(flags.force ? ['--force'] : []),
+                    '--permission-mode', batchPermissionMode,
                 ]);
                 successCount++;
             }
@@ -1317,7 +1597,7 @@ export default class WorkStart extends PMOCommand {
         // Non-interactive defaults
         const environment = useDevcontainer ? 'devcontainer' : 'host';
         const displayMode = 'terminal';
-        const sandboxed = !flags['skip-permissions'];
+        const sandboxed = flags['permission-mode'] === 'safe';
         const executor = flags.executor || DEFAULT_EXECUTION_CONFIG.defaultExecutor;
         const outputMode = 'interactive';
         // Handle git branch - only if action modifies code