squad-kit 0.11.0 → 0.12.1

package/dist/cli.js

@@ -259,9 +259,9 @@ function isSquadExit(err2) {
 }
 
 // src/commands/init.ts
-import fs14 from "fs";
-import path6 from "path";
-import { input as input2, select as select3, checkbox, confirm as confirm5, password as password3 } from "@inquirer/prompts";
+import fs17 from "fs";
+import path7 from "path";
+import { input as input2, select as select3, checkbox, confirm as confirm6, password as password4 } from "@inquirer/prompts";
 
 // src/core/paths.ts
 import path from "path";
@@ -352,8 +352,158 @@ function ensureGitignore(repoRoot) {
 }
 
 // src/core/config.ts
-import fs3 from "fs";
+import fs4 from "fs";
 import yaml from "js-yaml";
+
+// src/core/planner-auth.ts
+import { execFileSync } from "child_process";
+import fs3 from "fs";
+import os from "os";
+import path3 from "path";
+var PLANNER_AUTH_MODES = ["subscription", "api-key", "auto"];
+var PROVIDER_ENV_VAR = {
+  anthropic: "ANTHROPIC_API_KEY",
+  openai: "OPENAI_API_KEY",
+  google: "GOOGLE_API_KEY"
+};
+function buildUnavailableMessage(provider, configuredMode) {
+  if (provider === "anthropic") {
+    const lead = configuredMode === "api-key" ? "planner.auth.anthropic is `api-key`, but no Anthropic API key resolved." : "No Anthropic credential available.";
+    return `${lead} Either log in with your Claude subscription (\`squad auth login\`) or save an API key (\`squad config set planner\`, or export ANTHROPIC_API_KEY).`;
+  }
+  return `No ${provider} API key available. Run \`squad config set planner\` to save one, or export ${PROVIDER_ENV_VAR[provider]}.`;
+}
+var PlannerAuthUnavailableError = class extends Error {
+  constructor(provider, configuredMode) {
+    super(buildUnavailableMessage(provider, configuredMode));
+    this.provider = provider;
+    this.configuredMode = configuredMode;
+    this.name = "PlannerAuthUnavailableError";
+  }
+  provider;
+  configuredMode;
+};
+var KEYCHAIN_SERVICE = "Claude Code-credentials";
+var NOT_LOGGED_IN = { present: false, hint: "none", detail: "no Claude login detected" };
+function claudeConfigDir() {
+  const override = process.env.CLAUDE_CONFIG_DIR;
+  if (override && override.trim().length > 0) return path3.resolve(process.cwd(), override.trim());
+  try {
+    return path3.join(os.homedir(), ".claude");
+  } catch {
+    return void 0;
+  }
+}
+function keychainItemExists() {
+  try {
+    execFileSync("security", ["find-generic-password", "-s", KEYCHAIN_SERVICE], {
+      stdio: "ignore",
+      timeout: 2e3
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function detectClaudeLogin(secrets) {
+  const envToken = process.env.CLAUDE_CODE_OAUTH_TOKEN;
+  if (envToken && envToken.trim().length > 0) {
+    return {
+      present: true,
+      hint: "oauth-token-env",
+      detail: "CLAUDE_CODE_OAUTH_TOKEN",
+      token: envToken.trim()
+    };
+  }
+  const savedToken = secrets?.planner?.anthropicOauthToken;
+  if (savedToken && savedToken.trim().length > 0) {
+    return {
+      present: true,
+      hint: "oauth-token-secrets",
+      detail: ".squad/secrets.yaml",
+      token: savedToken.trim()
+    };
+  }
+  if (process.platform === "darwin") {
+    return keychainItemExists() ? { present: true, hint: "credential-store", detail: "macOS Keychain" } : NOT_LOGGED_IN;
+  }
+  const configDir = claudeConfigDir();
+  if (!configDir) return NOT_LOGGED_IN;
+  const credentialsFile = path3.join(configDir, ".credentials.json");
+  try {
+    if (fs3.existsSync(credentialsFile)) {
+      return { present: true, hint: "credential-store", detail: credentialsFile };
+    }
+  } catch {
+    return NOT_LOGGED_IN;
+  }
+  return NOT_LOGGED_IN;
+}
+function apiKeyAuth(apiKey, reason) {
+  return {
+    mode: "api-key",
+    reason,
+    key: apiKey.value,
+    source: apiKey.source,
+    detail: apiKey.detail
+  };
+}
+function subscriptionAuth(login, reason) {
+  if (login.hint === "oauth-token-env" || login.hint === "oauth-token-secrets") {
+    return {
+      mode: "subscription",
+      reason,
+      oauthToken: login.token,
+      oauthTokenSource: login.hint === "oauth-token-env" ? "env" : "secrets",
+      loginHint: login.hint
+    };
+  }
+  return {
+    mode: "subscription",
+    reason,
+    loginHint: login.hint === "credential-store" ? "credential-store" : "assumed"
+  };
+}
+function resolvePlannerAuth(input5) {
+  const { provider, apiKey, login } = input5;
+  const configuredMode = input5.configuredMode ?? "auto";
+  if (provider !== "anthropic") {
+    if (apiKey) return apiKeyAuth(apiKey, "provider-is-api-key-only");
+    throw new PlannerAuthUnavailableError(provider, configuredMode);
+  }
+  if (configuredMode === "api-key") {
+    if (apiKey) return apiKeyAuth(apiKey, "explicit-config");
+    throw new PlannerAuthUnavailableError(provider, configuredMode);
+  }
+  if (configuredMode === "subscription") {
+    return subscriptionAuth(login, "explicit-config");
+  }
+  if (login.present) {
+    return subscriptionAuth(login, login.hint === "credential-store" ? "auto-login-detected" : "auto-oauth-token");
+  }
+  if (apiKey) return apiKeyAuth(apiKey, "auto-fallback-api-key");
+  throw new PlannerAuthUnavailableError(provider, configuredMode);
+}
+function describeAuth(auth2) {
+  if (auth2.mode === "api-key") {
+    return { mode: "api-key", reason: auth2.reason, credentialHint: auth2.detail };
+  }
+  return { mode: "subscription", reason: auth2.reason, credentialHint: loginCredentialHint(auth2.loginHint) };
+}
+function loginCredentialHint(loginHint) {
+  switch (loginHint) {
+    case "oauth-token-env":
+      return "Claude login (CLAUDE_CODE_OAUTH_TOKEN)";
+    case "oauth-token-secrets":
+      return "Claude login (.squad/secrets.yaml)";
+    case "credential-store":
+      return process.platform === "darwin" ? "Claude login (macOS Keychain)" : "Claude login (~/.claude/.credentials.json)";
+    case "assumed":
+      return "Claude login (assumed \u2014 not verified locally)";
+  }
+}
+
+// src/core/config.ts
 var DEFAULT_CONFIG = {
   version: 1,
   project: {
@@ -366,7 +516,16 @@ var DEFAULT_CONFIG = {
   agents: [],
   planner: void 0
 };
-var FORBIDDEN_KEYS = ["apikey", "api_key", "token", "secret", "credential", "credentials"];
+var FORBIDDEN_KEYS = [
+  "apikey",
+  "api_key",
+  "token",
+  "oauthtoken",
+  "anthropicoauthtoken",
+  "secret",
+  "credential",
+  "credentials"
+];
 var DEFAULT_PLANNER_MAX_OUTPUT_TOKENS = 16384;
 var MIN_PLANNER_MAX_OUTPUT_TOKENS = 1024;
 var MAX_PLANNER_MAX_OUTPUT_TOKENS = 128e3;
@@ -379,23 +538,34 @@ function clampPlannerMaxOut(raw) {
     Math.max(MIN_PLANNER_MAX_OUTPUT_TOKENS, Math.round(n))
   );
 }
-function rejectSecretsInYaml(node, configFile, path39 = []) {
+function rejectSecretsInYaml(node, configFile, path40 = []) {
   if (node === null || typeof node !== "object") return;
   for (const [key, value] of Object.entries(node)) {
     if (FORBIDDEN_KEYS.includes(key.toLowerCase())) {
       throw new Error(
-        `Refusing to load ${configFile}: key "${[...path39, key].join(".")}" looks like a secret. Run \`squad config set planner\` or \`squad config set tracker\` to save it to .squad/secrets.yaml, then remove the key from config.yaml. Provider keys also work via ANTHROPIC_API_KEY / OPENAI_API_KEY / GOOGLE_API_KEY.`
+        `Refusing to load ${configFile}: key "${[...path40, key].join(".")}" looks like a secret. Run \`squad config set planner\` or \`squad config set tracker\` to save it to .squad/secrets.yaml, then remove the key from config.yaml. Provider keys also work via ANTHROPIC_API_KEY / OPENAI_API_KEY / GOOGLE_API_KEY.`
       );
     }
-    if (typeof value === "object") rejectSecretsInYaml(value, configFile, [...path39, key]);
+    if (typeof value === "object") rejectSecretsInYaml(value, configFile, [...path40, key]);
   }
 }
-function mergePlanner(base, override) {
+function normalizeAuthMode(raw, configFile) {
+  if (raw === void 0 || raw === null) return void 0;
+  const value = typeof raw === "string" ? raw.trim().toLowerCase() : "";
+  if (PLANNER_AUTH_MODES.includes(value)) return value;
+  throw new Error(
+    `Invalid planner.auth.anthropic ${JSON.stringify(raw)} in ${configFile}: must be ${PLANNER_AUTH_MODES.join(", ")}. Run \`squad config set planner\` to fix it.`
+  );
+}
+function mergePlanner(base, override, configFile) {
   if (!override) return base;
   const merged = {
     enabled: override.enabled ?? base?.enabled ?? false,
     provider: override.provider ?? base?.provider ?? "anthropic",
     mode: override.mode ?? base?.mode ?? "auto",
+    auth: {
+      anthropic: normalizeAuthMode(override.auth?.anthropic ?? base?.auth?.anthropic, configFile) ?? "auto"
+    },
     budget: {
       maxFileReads: override.budget?.maxFileReads ?? base?.budget?.maxFileReads ?? 25,
       maxContextBytes: override.budget?.maxContextBytes ?? base?.budget?.maxContextBytes ?? 5e4,
@@ -480,7 +650,7 @@ function parseConfig(raw, configFile) {
     );
   }
   rejectSecretsInYaml(parsed, configFile);
-  const merged = mergeConfig(DEFAULT_CONFIG, parsed);
+  const merged = mergeConfig(DEFAULT_CONFIG, parsed, configFile);
   validateModelOverride(merged.planner?.modelOverride, configFile);
   if (merged.planner?.cache !== void 0) {
     const c = merged.planner.cache;
@@ -527,7 +697,7 @@ function parseConfig(raw, configFile) {
   return merged;
 }
 function loadConfig(configFile) {
-  const raw = fs3.readFileSync(configFile, "utf8");
+  const raw = fs4.readFileSync(configFile, "utf8");
   return parseConfig(raw, configFile);
 }
 function serializeConfig(config2) {
@@ -536,32 +706,32 @@ function serializeConfig(config2) {
 function saveConfig(configFile, config2) {
   const body = serializeConfig(config2);
   parseConfig(body, configFile);
-  fs3.writeFileSync(configFile, body, "utf8");
+  fs4.writeFileSync(configFile, body, "utf8");
 }
-function mergeConfig(base, override) {
+function mergeConfig(base, override, configFile) {
   return {
     version: override.version ?? base.version,
     project: { ...base.project, ...override.project ?? {} },
     tracker: { ...base.tracker, ...override.tracker ?? {} },
     naming: { ...base.naming, ...override.naming ?? {} },
     agents: override.agents ?? base.agents,
-    planner: mergePlanner(base.planner, override.planner)
+    planner: mergePlanner(base.planner, override.planner, configFile)
   };
 }
 
 // src/core/planner-models.ts
-import fs5 from "fs";
+import fs6 from "fs";
 
 // src/core/secrets.ts
-import fs4 from "fs";
-import path3 from "path";
+import fs5 from "fs";
+import path4 from "path";
 import yaml2 from "js-yaml";
 var EMPTY = {};
 function loadSecrets(secretsFile) {
-  if (!fs4.existsSync(secretsFile)) return EMPTY;
+  if (!fs5.existsSync(secretsFile)) return EMPTY;
   let raw;
   try {
-    raw = fs4.readFileSync(secretsFile, "utf8");
+    raw = fs5.readFileSync(secretsFile, "utf8");
   } catch (err2) {
     throw new Error(
       `Failed to read ${secretsFile}: ${err2.message}. Run \`squad doctor\` to diagnose, or delete the file and run \`squad config set planner\` or \`squad config set tracker\` to re-enter credentials.`
@@ -584,15 +754,15 @@ function loadSecrets(secretsFile) {
   return parsed;
 }
 function saveSecrets(secretsFile, secrets) {
-  fs4.mkdirSync(path3.dirname(secretsFile), { recursive: true });
+  fs5.mkdirSync(path4.dirname(secretsFile), { recursive: true });
   const body = yaml2.dump(secrets, { lineWidth: 100, noRefs: true, sortKeys: false });
-  fs4.writeFileSync(secretsFile, body, "utf8");
+  fs5.writeFileSync(secretsFile, body, "utf8");
   tightenPermissions(secretsFile);
 }
 function tightenPermissions(file) {
   if (process.platform === "win32") return;
   try {
-    fs4.chmodSync(file, 384);
+    fs5.chmodSync(file, 384);
   } catch {
   }
 }
@@ -667,7 +837,7 @@ function resolveProviderKey(provider) {
   const root = findSquadRoot();
   if (root) {
     const paths = buildPaths(root);
-    if (fs5.existsSync(paths.secretsFile)) {
+    if (fs6.existsSync(paths.secretsFile)) {
       const secrets = loadSecrets(paths.secretsFile);
       const fromFile = secrets.planner?.[provider];
       if (fromFile) return { value: fromFile, source: "secrets", detail: ".squad/secrets.yaml" };
@@ -678,68 +848,89 @@ function resolveProviderKey(provider) {
 function readProviderKey(provider) {
   return resolveProviderKey(provider)?.value;
 }
-function readProviderKeyForPaths(paths, provider) {
+function resolveProviderKeyForPaths(paths, provider) {
   const envVar = providerEnvVar(provider);
   const envValue = process.env[envVar];
-  if (envValue) return envValue;
+  if (envValue) return { value: envValue, source: "env", detail: envVar };
   const fallback = process.env.SQUAD_PLANNER_API_KEY;
-  if (fallback) return fallback;
-  if (fs5.existsSync(paths.secretsFile)) {
+  if (fallback) return { value: fallback, source: "fallback-env", detail: "SQUAD_PLANNER_API_KEY" };
+  if (fs6.existsSync(paths.secretsFile)) {
     const secrets = loadSecrets(paths.secretsFile);
     const fromFile = secrets.planner?.[provider];
-    if (fromFile) return fromFile;
+    if (fromFile) return { value: fromFile, source: "secrets", detail: ".squad/secrets.yaml" };
   }
   return void 0;
 }
+function configuredAuthMode(provider, config2) {
+  return provider === "anthropic" ? config2?.auth?.anthropic : void 0;
+}
+function resolvePlannerAuthForCwd(provider, config2) {
+  const root = findSquadRoot();
+  const secrets = root ? loadSecrets(buildPaths(root).secretsFile) : void 0;
+  return resolvePlannerAuth({
+    provider,
+    configuredMode: configuredAuthMode(provider, config2),
+    apiKey: resolveProviderKey(provider),
+    login: detectClaudeLogin(secrets)
+  });
+}
+function resolvePlannerAuthForPaths(paths, provider, config2) {
+  return resolvePlannerAuth({
+    provider,
+    configuredMode: configuredAuthMode(provider, config2),
+    apiKey: resolveProviderKeyForPaths(paths, provider),
+    login: detectClaudeLogin(loadSecrets(paths.secretsFile))
+  });
+}
 
 // src/utils/fs.ts
-import fs6 from "fs";
-import path4 from "path";
+import fs7 from "fs";
+import path5 from "path";
 import { fileURLToPath } from "url";
 function readFile(file) {
-  return fs6.readFileSync(file, "utf8");
+  return fs7.readFileSync(file, "utf8");
 }
 function writeFileSafe(file, content, overwrite = false) {
-  if (!overwrite && fs6.existsSync(file)) return false;
-  fs6.mkdirSync(path4.dirname(file), { recursive: true });
-  fs6.writeFileSync(file, content, "utf8");
+  if (!overwrite && fs7.existsSync(file)) return false;
+  fs7.mkdirSync(path5.dirname(file), { recursive: true });
+  fs7.writeFileSync(file, content, "utf8");
   return true;
 }
 function copyTree(srcDir, destDir, overwrite = false) {
-  fs6.mkdirSync(destDir, { recursive: true });
-  for (const entry of fs6.readdirSync(srcDir, { withFileTypes: true })) {
-    const src = path4.join(srcDir, entry.name);
-    const dest = path4.join(destDir, entry.name);
+  fs7.mkdirSync(destDir, { recursive: true });
+  for (const entry of fs7.readdirSync(srcDir, { withFileTypes: true })) {
+    const src = path5.join(srcDir, entry.name);
+    const dest = path5.join(destDir, entry.name);
     if (entry.isDirectory()) {
       copyTree(src, dest, overwrite);
     } else if (entry.isFile()) {
-      if (!overwrite && fs6.existsSync(dest)) continue;
-      fs6.copyFileSync(src, dest);
+      if (!overwrite && fs7.existsSync(dest)) continue;
+      fs7.copyFileSync(src, dest);
     }
   }
 }
 function packageRoot() {
-  const here = path4.dirname(fileURLToPath(import.meta.url));
+  const here = path5.dirname(fileURLToPath(import.meta.url));
   let dir = here;
   for (let i = 0; i < 6; i++) {
-    if (fs6.existsSync(path4.join(dir, "package.json")) && fs6.existsSync(path4.join(dir, "templates"))) {
+    if (fs7.existsSync(path5.join(dir, "package.json")) && fs7.existsSync(path5.join(dir, "templates"))) {
       return dir;
     }
-    dir = path4.dirname(dir);
+    dir = path5.dirname(dir);
   }
   throw new Error(`Could not locate squad-kit package root from ${here}`);
 }
 function templatesDir() {
-  return path4.join(packageRoot(), "templates");
+  return path5.join(packageRoot(), "templates");
 }
 function readBundledPrompt(name) {
-  const file = path4.join(templatesDir(), "prompts", name);
-  if (!fs6.existsSync(file)) {
+  const file = path5.join(templatesDir(), "prompts", name);
+  if (!fs7.existsSync(file)) {
     throw new Error(
       `Bundled prompt "${name}" not found at ${file}. This indicates a broken squad-kit install \u2014 reinstall with: pnpm add -g squad-kit`
     );
   }
-  return fs6.readFileSync(file, "utf8");
+  return fs7.readFileSync(file, "utf8");
 }
 
 // src/core/template.ts
@@ -755,7 +946,7 @@ function escapeTemplateValue(s) {
 }
 
 // src/commands/config/show.ts
-import fs7 from "fs";
+import fs8 from "fs";
 
 // src/commands/config/masks.ts
 function maskStringKey(value) {
@@ -866,7 +1057,7 @@ async function runConfigShow(opts) {
   const root = requireSquadRoot();
   const paths = buildPaths(root);
   const config2 = loadConfig(paths.configFile);
-  const secrets = fs7.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
+  const secrets = fs8.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
   const payload = buildPayload(config2, secrets);
   if (opts.json) {
     process.stdout.write(`${JSON.stringify(payload, null, 2)}
@@ -877,8 +1068,8 @@ async function runConfigShow(opts) {
 }
 
 // src/commands/config/set-planner.ts
-import fs9 from "fs";
-import { confirm as confirm2, password as password2, select } from "@inquirer/prompts";
+import fs12 from "fs";
+import { confirm as confirm3, password as password3, select } from "@inquirer/prompts";
 
 // src/tracker/env-overlay.ts
 function overlayTrackerEnv(base) {
@@ -978,11 +1169,11 @@ async function probeJiraConnectivity(secrets, config2) {
   const host = jira.host ?? config2.tracker.workspace ?? "";
   const email = jira.email ?? "";
   const token = jira.token ?? "";
-  const auth = Buffer.from(`${email}:${token}`).toString("base64");
+  const auth2 = Buffer.from(`${email}:${token}`).toString("base64");
   const url = jiraMyselfUrl(host);
   try {
     const res = await fetch(url, {
-      headers: { Authorization: `Basic ${auth}`, Accept: "application/json" }
+      headers: { Authorization: `Basic ${auth2}`, Accept: "application/json" }
     });
     if (res.ok) return { ok: true };
     return { ok: false, status: res.status, detail: (await res.text()).slice(0, 200) };
@@ -994,10 +1185,10 @@ async function probeAzureConnectivity(secrets, config2) {
   const az = overlayTrackerEnv(secrets).tracker?.azure ?? {};
   const org = az.organization ?? config2.tracker.workspace ?? "";
   const pat = az.pat ?? "";
-  const auth = Buffer.from(`:${pat}`).toString("base64");
+  const auth2 = Buffer.from(`:${pat}`).toString("base64");
   const url = `https://dev.azure.com/${encodeURIComponent(org)}/_apis/projects?api-version=7.1`;
   try {
-    const res = await fetch(url, { headers: { Authorization: `Basic ${auth}` } });
+    const res = await fetch(url, { headers: { Authorization: `Basic ${auth2}` } });
     if (res.ok) return { ok: true };
     return { ok: false, status: res.status, detail: (await res.text()).slice(0, 200) };
   } catch (err2) {
@@ -1026,6 +1217,357 @@ async function probeGitHubConnectivity(secrets, _config) {
   }
 }
 
+// src/core/claude-binary.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import fs9 from "fs";
+import { createRequire } from "module";
+function claudeBinaryPackageSpecs(platform = process.platform, arch = process.arch) {
+  const packages = platform === "linux" ? [
+    `@anthropic-ai/claude-agent-sdk-linux-${arch}-musl`,
+    `@anthropic-ai/claude-agent-sdk-linux-${arch}`
+  ] : [`@anthropic-ai/claude-agent-sdk-${platform}-${arch}`];
+  const fileNames = platform === "win32" ? ["claude.exe", "claude"] : ["claude"];
+  return packages.flatMap((pkg) => fileNames.map((file) => `${pkg}/${file}`));
+}
+function requireAnchors() {
+  const own = createRequire(import.meta.url);
+  const anchors = [own];
+  try {
+    const sdkEntry = own.resolve("@anthropic-ai/claude-agent-sdk");
+    anchors.push(createRequire(sdkEntry));
+    const realEntry = fs9.realpathSync(sdkEntry);
+    if (realEntry !== sdkEntry) anchors.push(createRequire(realEntry));
+  } catch {
+  }
+  return anchors;
+}
+function resolveBundled() {
+  const specs = claudeBinaryPackageSpecs();
+  for (const req of requireAnchors()) {
+    for (const spec of specs) {
+      try {
+        const resolved = req.resolve(spec);
+        if (fs9.existsSync(resolved)) return resolved;
+      } catch {
+      }
+    }
+  }
+  return void 0;
+}
+function resolveOnPath() {
+  const finder = process.platform === "win32" ? "where" : "which";
+  try {
+    const out = execFileSync2(finder, ["claude"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 3e3
+    });
+    const first = out.split(/\r?\n/).map((l) => l.trim()).find((l) => l.length > 0);
+    if (first && fs9.existsSync(first)) return first;
+  } catch {
+  }
+  return void 0;
+}
+var cached;
+function resolveClaudeBinary() {
+  if (cached) return cached.value;
+  const bundled = resolveBundled();
+  if (bundled) {
+    cached = { value: { path: bundled, source: "bundled" } };
+    return cached.value;
+  }
+  const onPath = resolveOnPath();
+  cached = { value: onPath ? { path: onPath, source: "path" } : void 0 };
+  return cached.value;
+}
+var MISSING_CLAUDE_BINARY_MESSAGE = "Could not find a `claude` executable. Reinstall squad-kit so the Agent SDK's platform binary is present, or install Claude Code and ensure `claude` is on your PATH.";
+
+// src/planner/provider-errors.ts
+function detectModelNotFound(provider, model, status, rawBody) {
+  if (status !== 404) return void 0;
+  const body = rawBody.toLowerCase();
+  const hints = ["not_found_error", "model_not_found", "not_found", "model:"];
+  if (!hints.some((h) => body.includes(h))) return void 0;
+  return { provider, model, status, rawBody };
+}
+function modelNotFoundMessage(err2) {
+  return [
+    `The ${err2.provider} planner model "${err2.model}" is no longer available.`,
+    "",
+    "Recovery options:",
+    `  1. Run \`squad upgrade\` to install a newer squad-kit (or install manually from npm).`,
+    `  2. Run \`squad config set planner --provider openai\` (or another \`--provider\`) to switch models via a different provider, then save a key when prompted.`,
+    `  3. Run \`squad config set planner\` to set \`planner.modelOverride.${err2.provider}\` to a still-valid id (no raw YAML), then \`squad doctor\` to confirm.`,
+    "",
+    `Raw provider response: ${err2.rawBody.slice(0, 200)}`
+  ].join("\n");
+}
+function detectRateLimit(provider, status, headers, rawBody) {
+  if (status !== 429) return void 0;
+  return {
+    provider,
+    status: 429,
+    retryAfterSec: parseRetryAfter(headers, rawBody),
+    rawBody
+  };
+}
+function parseRetryAfterSec(headers) {
+  const raw = headerGet(headers, "retry-after");
+  if (!raw) return void 0;
+  const sec = Number(raw);
+  if (Number.isFinite(sec) && sec >= 0) return Math.ceil(sec);
+  const asDate = Date.parse(raw);
+  if (Number.isFinite(asDate)) {
+    return Math.max(0, Math.ceil((asDate - Date.now()) / 1e3));
+  }
+  return void 0;
+}
+function parseRetryAfter(headers, body) {
+  const fromHeader = parseRetryAfterSec(headers);
+  if (fromHeader !== void 0) return fromHeader;
+  const bodyMatch = /"retryDelay"\s*:\s*"(\d+)(?:\.\d+)?s"/i.exec(body);
+  if (bodyMatch) {
+    const sec = Number(bodyMatch[1]);
+    if (Number.isFinite(sec) && sec >= 0) return sec;
+  }
+  return void 0;
+}
+function headerGet(h, name) {
+  if (typeof h.get === "function") {
+    return h.get(name);
+  }
+  const key = name.toLowerCase();
+  const rec = h;
+  for (const k of Object.keys(rec)) {
+    if (k.toLowerCase() === key) return rec[k] ?? null;
+  }
+  return null;
+}
+function rateLimitMessage(err2) {
+  const waitHint = err2.retryAfterSec ?? 60;
+  const limitsUrl = {
+    anthropic: "https://console.anthropic.com/settings/limits",
+    openai: "https://platform.openai.com/settings/organization/limits",
+    google: "https://aistudio.google.com/app/plan_information"
+  };
+  const headline = err2.retryAfterSec ? `${err2.provider} rate limit hit \u2014 provider asked us to wait ${err2.retryAfterSec}s before retrying.` : `${err2.provider} rate limit hit.`;
+  const cap = err2.maxRetrySec ?? 90;
+  const retried = err2.retrySkippedReason === "retry_after_too_long" ? `squad-kit did not auto-retry: the provider's ${err2.retryAfterSec}s wait is longer than our ${cap}s cap, so retrying would just burn another request inside the same throttle window.` : err2.retryAlreadyAttempted ? "squad-kit already retried once automatically and was throttled again \u2014 your org is firmly over its per-minute quota." : "squad-kit aborted before retrying.";
+  return [
+    headline,
+    retried,
+    "",
+    "Recovery options:",
+    `  1. Wait ${waitHint}s and rerun \`squad new-plan --api\`. Per-minute limits reset quickly.`,
+    `  2. Switch to a smaller planner model: \`squad config set planner\` (pick a cheaper model id).`,
+    `  3. Tighten \`planner.budget\` in \`.squad/config.yaml\` (smaller \`maxContextBytes\` / \`maxFileReads\`) so each request carries fewer tokens.`,
+    `  4. Upgrade your ${err2.provider} tier: ${limitsUrl[err2.provider]}.`,
+    "",
+    "Full runbook: docs/migrating-from-0.1.md (see \xA78. If something goes wrong).",
+    "",
+    `Raw provider response: ${err2.rawBody.slice(0, 200)}`
+  ].join("\n");
+}
+
+// src/planner/auth-errors.ts
+var AUTH_SHAPED_SDK_ERRORS = [
+  "authentication_failed",
+  "oauth_org_not_allowed",
+  "billing_error",
+  "rate_limit"
+];
+function authErrorContextFrom(auth2) {
+  if (auth2.mode === "api-key") return { mode: "api-key" };
+  return auth2.oauthTokenSource ? { mode: "subscription", oauthTokenSource: auth2.oauthTokenSource } : { mode: "subscription" };
+}
+function detectAuthShapedSdkError(raw) {
+  if (typeof raw === "string") {
+    const direct = AUTH_SHAPED_SDK_ERRORS.find((s) => s === raw);
+    if (direct) return direct;
+    return AUTH_SHAPED_SDK_ERRORS.find((s) => raw.includes(s));
+  }
+  if (Array.isArray(raw)) {
+    for (const entry of raw) {
+      const hit = detectAuthShapedSdkError(entry);
+      if (hit) return hit;
+    }
+  }
+  return void 0;
+}
+function authenticationFailedMessage(ctx) {
+  if (ctx.mode === "api-key") {
+    return "Anthropic rejected the planner API key. Save a valid key with `squad config set planner`, or fix the exported ANTHROPIC_API_KEY, then re-run.";
+  }
+  if (ctx.oauthTokenSource === "env") {
+    return "Claude login failed or expired. This run used the token in CLAUDE_CODE_OAUTH_TOKEN \u2014 unset it (or replace it with a fresh `claude setup-token` value), then run `squad auth login` to sign in again and re-run.";
+  }
+  if (ctx.oauthTokenSource === "secrets") {
+    return "Claude login failed or expired. This run used the token saved in `.squad/secrets.yaml` \u2014 run `squad auth logout` to clear it, then `squad auth login` to sign in again, then re-run.";
+  }
+  return "Claude login failed or expired. Run `squad auth login` to sign in again, then re-run.";
+}
+function billingErrorMessage(ctx) {
+  if (ctx.mode === "api-key") {
+    return "Anthropic refused the request for billing reasons. Check your credit balance at https://console.anthropic.com/settings/billing, then re-run.";
+  }
+  return "Your Claude plan cannot run this request. Check your plan at claude.ai/settings, or switch to an API key with `squad config set planner`.";
+}
+function rateLimitCopy(ctx, rawBody) {
+  if (ctx.mode === "api-key") {
+    return rateLimitMessage({ provider: "anthropic", rawBody });
+  }
+  return "Claude subscription usage limit reached. Planning draws on the same limits as Claude and Claude Code \u2014 wait for your usage window to reset, or switch to an API key for this run with `squad config set planner`.";
+}
+function authErrorMessage(signal, ctx, rawBody = "") {
+  switch (signal) {
+    case "authentication_failed":
+      return authenticationFailedMessage(ctx);
+    case "oauth_org_not_allowed":
+      return "Your Claude account's organization is not allowed to use this login. Ask your admin, or switch to an API key with `squad config set planner`.";
+    case "billing_error":
+      return billingErrorMessage(ctx);
+    case "rate_limit":
+      return rateLimitCopy(ctx, rawBody);
+  }
+}
+
+// src/planner/runtimes/sdk-env.ts
+var SUBSCRIPTION_WITHHELD_ENV_KEYS = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"];
+function buildSdkEnv(auth2) {
+  const env = { ...process.env };
+  if (auth2.mode === "api-key") {
+    env.ANTHROPIC_API_KEY = auth2.key;
+    return env;
+  }
+  for (const key of Object.keys(env)) {
+    if (SUBSCRIPTION_WITHHELD_ENV_KEYS.includes(key.toUpperCase())) delete env[key];
+  }
+  if (auth2.oauthToken) env.CLAUDE_CODE_OAUTH_TOKEN = auth2.oauthToken;
+  return env;
+}
+
+// src/planner/runtimes/auth-probe.ts
+var DEFAULT_AUTH_PROBE_TIMEOUT_MS = 1e4;
+function readAccount(raw) {
+  if (!raw || typeof raw !== "object") return {};
+  const o = raw;
+  const account = {};
+  if (typeof o.email === "string") account.email = o.email;
+  if (typeof o.organization === "string") account.organization = o.organization;
+  if (typeof o.subscriptionType === "string") account.subscriptionType = o.subscriptionType;
+  const apiKeySource = typeof o.apiKeySource === "string" ? o.apiKeySource : void 0;
+  const tokenSource = typeof o.tokenSource === "string" ? o.tokenSource : void 0;
+  const apiProvider = typeof o.apiProvider === "string" ? o.apiProvider : void 0;
+  return {
+    account: Object.keys(account).length > 0 ? account : void 0,
+    apiKeySource,
+    tokenSource,
+    apiProvider
+  };
+}
+var EXPIRED_HINT = /expire|refresh|revoked|no longer valid/i;
+var NO_BINARY_HINT = /native cli binary|executable not found|claude code executable/i;
+function mapProbeFailure(err2, auth2) {
+  const message = err2 instanceof Error ? err2.message : String(err2);
+  const signal = detectAuthShapedSdkError(message);
+  if (signal === "authentication_failed") {
+    return {
+      ok: false,
+      kind: EXPIRED_HINT.test(message) ? "expired" : "not-logged-in",
+      // Reuse story 15's mapper rather than writing a second one: the copy a failed probe prints
+      // must match the copy a failed run prints, or the two disagree about the same credential.
+      detail: authErrorMessage("authentication_failed", authErrorContextFrom(auth2))
+    };
+  }
+  if (signal === "oauth_org_not_allowed") {
+    return {
+      ok: false,
+      kind: "org-not-allowed",
+      detail: authErrorMessage("oauth_org_not_allowed", authErrorContextFrom(auth2))
+    };
+  }
+  if (signal) {
+    return { ok: false, kind: "unknown", detail: authErrorMessage(signal, authErrorContextFrom(auth2)) };
+  }
+  if (NO_BINARY_HINT.test(message)) {
+    return { ok: false, kind: "no-binary", detail: message.slice(0, 300) };
+  }
+  return { ok: false, kind: "unknown", detail: message.slice(0, 300) };
+}
+async function probeClaudeAuth(auth2, opts = {}) {
+  if (!resolveClaudeBinary()) {
+    return {
+      ok: false,
+      kind: "no-binary",
+      detail: "No `claude` executable found. Reinstall squad-kit so the Agent SDK platform binary is present, or install Claude Code and put `claude` on your PATH."
+    };
+  }
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_AUTH_PROBE_TIMEOUT_MS;
+  let releaseInput = () => {
+  };
+  const inputClosed = new Promise((resolve2) => {
+    releaseInput = resolve2;
+  });
+  async function* neverSends() {
+    await inputClosed;
+  }
+  let q;
+  let timer;
+  try {
+    const { query } = await import("@anthropic-ai/claude-agent-sdk");
+    q = query({
+      prompt: neverSends(),
+      options: {
+        tools: [],
+        settingSources: [],
+        persistSession: false,
+        maxTurns: 1,
+        env: buildSdkEnv(auth2)
+      }
+    });
+    const timedOut = /* @__PURE__ */ Symbol("timeout");
+    const info2 = await Promise.race([
+      typeof q.accountInfo === "function" ? q.accountInfo() : Promise.resolve(void 0),
+      new Promise((resolve2) => {
+        timer = setTimeout(() => resolve2(timedOut), timeoutMs);
+      })
+    ]);
+    if (info2 === timedOut) {
+      return {
+        ok: false,
+        kind: "timeout",
+        detail: `The Claude auth check did not answer within ${timeoutMs}ms.`
+      };
+    }
+    const { account, apiKeySource, tokenSource, apiProvider } = readAccount(info2);
+    const base = { ...apiKeySource ? { apiKeySource } : {}, ...account ? { account } : {} };
+    if (auth2.mode !== "subscription") return { ok: true, ...base };
+    if (account) return { ok: true, ...base };
+    if (tokenSource || apiProvider) {
+      return {
+        ok: true,
+        ...base,
+        ...tokenSource ? { credentialSource: tokenSource } : {},
+        unverifiable: `The Agent SDK resolved ${tokenSource ?? "a credential"}, but token auth reports no account, so its validity can only be confirmed by an actual planning run.`
+      };
+    }
+    return {
+      ok: false,
+      kind: "unknown",
+      detail: "The Claude login reported neither an account nor a credential source, so it could not be verified. Run `squad auth login` to sign in again."
+    };
+  } catch (err2) {
+    return mapProbeFailure(err2, auth2);
+  } finally {
+    if (timer) clearTimeout(timer);
+    releaseInput();
+    try {
+      await q?.return?.();
+    } catch {
+    }
+  }
+}
+
 // src/commands/config/shared.ts
 import { input, password } from "@inquirer/prompts";
 var notEmpty = (v) => v.trim().length > 0 || "required";
@@ -1106,9 +1648,12 @@ function mergePlannerKeyIntoSecrets(base, provider, key) {
   }
   return mergeSecrets(base, { planner: { google: key } });
 }
+function mergePlannerOauthTokenIntoSecrets(base, token) {
+  return mergeSecrets(base, { planner: { anthropicOauthToken: token } });
+}
 
 // src/commands/config/unset-planner.ts
-import fs8 from "fs";
+import fs10 from "fs";
 import { confirm } from "@inquirer/prompts";
 async function runConfigUnsetPlanner(opts = {}) {
   const root = requireSquadRoot();
@@ -1129,24 +1674,248 @@ async function runConfigUnsetPlanner(opts = {}) {
   delete next.planner;
   saveConfig(paths.configFile, next);
   if (opts.removeCredentials) {
-    const s = fs8.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
+    const s = fs10.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
     if (s.planner) {
       delete s.planner;
       saveSecrets(paths.secretsFile, s);
     }
-    success("Planner disabled; planner credentials were removed from .squad/secrets.yaml.");
-  } else {
-    success("Planner disabled; existing planner keys in .squad/secrets.yaml (if any) were preserved.");
+    success("Planner disabled; planner credentials were removed from .squad/secrets.yaml.");
+  } else {
+    success("Planner disabled; existing planner keys in .squad/secrets.yaml (if any) were preserved.");
+  }
+  info("Re-enable any time with `squad config set planner`.");
+}
+
+// src/commands/auth/login.ts
+import fs11 from "fs";
+import { confirm as confirm2, password as password2 } from "@inquirer/prompts";
+
+// src/core/ci-env.ts
+function skipExternalProbesInAutomation() {
+  const c = process.env.CI;
+  if (c === "true" || c === "1") return true;
+  if (process.env.GITHUB_ACTIONS) return true;
+  return false;
+}
+
+// src/commands/auth/setup-token.ts
+import { spawn } from "child_process";
+function spawnSetupToken(binaryPath, opts = {}) {
+  const tee = opts.tee !== false;
+  return new Promise((resolve2, reject) => {
+    const child = spawn(binaryPath, ["setup-token"], {
+      stdio: tee ? ["inherit", "pipe", "inherit"] : "inherit",
+      windowsHide: true
+    });
+    let output = "";
+    if (tee && child.stdout) {
+      child.stdout.setEncoding("utf8");
+      child.stdout.on("data", (chunk) => {
+        output += chunk;
+        process.stderr.write(chunk);
+      });
+    }
+    child.once("error", reject);
+    child.once("close", (code, signal) => {
+      resolve2({ code, signal, output });
+    });
+  });
+}
+
+// src/commands/auth/shared.ts
+var OAUTH_TOKEN_PREFIX = "sk-ant-oat";
+var OAUTH_TOKEN_PATTERN = /sk-ant-oat[0-9]{2}-[A-Za-z0-9_-]{16,}/;
+var MIN_TOKEN_LENGTH = 20;
+var MAX_TOKEN_LENGTH = 2048;
+var InvalidOauthTokenError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InvalidOauthTokenError";
+  }
+};
+function validateOauthToken(raw) {
+  const value = raw ?? "";
+  if (value.trim().length === 0) {
+    throw new InvalidOauthTokenError(
+      "The token is empty. Run `squad auth login` without --token to sign in through the browser, or pass the value printed by `claude setup-token`."
+    );
+  }
+  if (/\s/.test(value.trim())) {
+    throw new InvalidOauthTokenError(
+      "That token contains whitespace. Paste only the single-line value printed by `claude setup-token` (quote it in your shell if needed)."
+    );
+  }
+  const token = value.trim();
+  if (token.startsWith("sk-ant-") && !token.startsWith(OAUTH_TOKEN_PREFIX)) {
+    throw new InvalidOauthTokenError(
+      "That looks like an Anthropic API key; use `squad config set planner` for keys. `squad auth login --token` takes the OAuth token printed by `claude setup-token`."
+    );
+  }
+  if (token.length < MIN_TOKEN_LENGTH) {
+    throw new InvalidOauthTokenError(
+      `That token is only ${token.length} characters \u2014 too short to be a \`claude setup-token\` value. Re-run \`claude setup-token\` and paste the whole line.`
+    );
+  }
+  if (token.length > MAX_TOKEN_LENGTH) {
+    throw new InvalidOauthTokenError(
+      "That token is implausibly long. Paste only the single line `claude setup-token` printed."
+    );
+  }
+  return token;
+}
+function extractOauthToken(output) {
+  const hit = OAUTH_TOKEN_PATTERN.exec(output);
+  return hit ? hit[0] : void 0;
+}
+function authReasonText(reason, provider) {
+  switch (reason) {
+    case "explicit-config":
+      return "explicit in .squad/config.yaml";
+    case "auto-login-detected":
+      return "auto \u2014 Claude login detected";
+    case "auto-oauth-token":
+      return "auto \u2014 stored OAuth token";
+    case "auto-fallback-api-key":
+      return "auto \u2014 no Claude login, fell back to an API key";
+    case "provider-is-api-key-only":
+      return `${provider} is API-key only`;
+  }
+}
+function runtimeNameFor(provider, planner) {
+  if (provider !== "anthropic") return "vercel";
+  return planner?.runtime?.anthropic ?? "agent-sdk";
+}
+function credentialPresent(auth2) {
+  return auth2.mode === "api-key" || auth2.loginHint !== "assumed";
+}
+var SUBSCRIPTION_ALTERNATIVE_HINT = "Prefer not to store a token? Run `claude` and use `/login` instead \u2014 squad-kit picks the OS credential store up automatically under `auth: subscription`.";
+
+// src/commands/auth/login.ts
+var NON_TTY_LOGIN_MESSAGE = "A browser login needs a terminal. Generate a token elsewhere with `claude setup-token` and pass it with `squad auth login --token <value>`, or set CLAUDE_CODE_OAUTH_TOKEN.";
+async function runAuthLogin(opts = {}) {
+  if (opts.token && opts.printOnly) {
+    throw new Error(
+      "Pass either --token or --print-only, not both. --print-only runs the browser flow and prints the token it produces; --token consumes one you already have."
+    );
+  }
+  const providedToken = opts.token !== void 0 ? validateOauthToken(opts.token) : void 0;
+  const storing = !opts.printOnly;
+  const workspace = storing ? openWorkspace() : void 0;
+  if (workspace && !await confirmOverwrite(workspace.secrets, Boolean(opts.yes))) return;
+  if (process.env.CLAUDE_CODE_OAUTH_TOKEN) {
+    warning(
+      "CLAUDE_CODE_OAUTH_TOKEN is exported in this shell. It outranks the token squad-kit stores, so the stored one is ignored until you unset it."
+    );
+  }
+  const token = providedToken ?? await runBrowserFlow();
+  if (!storing) {
+    blank();
+    success("Login complete. Nothing was stored.");
+    info("Token (copy it somewhere safe \u2014 squad-kit did not save it):");
+    process.stdout.write(`${token}
+`);
+    blank();
+    info(SUBSCRIPTION_ALTERNATIVE_HINT);
+    info("To store it in this workspace later: `squad auth login --token <value>`.");
+    return;
+  }
+  const ws = workspace;
+  saveSecrets(ws.paths.secretsFile, mergePlannerOauthTokenIntoSecrets(ws.secrets, token));
+  success("OAuth token saved to .squad/secrets.yaml (chmod 0600 on POSIX).");
+  const planner = ws.config.planner;
+  if (planner) {
+    saveConfig(ws.paths.configFile, {
+      ...ws.config,
+      planner: { ...planner, auth: { ...planner.auth, anthropic: "subscription" } }
+    });
+    info("Set `planner.auth.anthropic: subscription` in .squad/config.yaml.");
+  } else {
+    warning(
+      "The direct planner is not configured in this workspace, so no auth mode was written. Run `squad config set planner` and choose Anthropic to finish setup."
+    );
+  }
+  await verifyAndSummarise(planner ? { ...planner, auth: { anthropic: "subscription" } } : void 0);
+  blank();
+  info(SUBSCRIPTION_ALTERNATIVE_HINT);
+  info("Next: `squad auth status` to confirm, then `squad new-plan --api`.");
+}
+function openWorkspace() {
+  const paths = buildPaths(requireSquadRoot());
+  return {
+    paths,
+    config: loadConfig(paths.configFile),
+    secrets: fs11.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {}
+  };
+}
+async function confirmOverwrite(secrets, yes) {
+  if (!secrets.planner?.anthropicOauthToken) return true;
+  if (yes) return true;
+  if (!isInteractive()) {
+    throw new Error(
+      "A Claude OAuth token is already stored in .squad/secrets.yaml. Pass -y to overwrite it non-interactively."
+    );
+  }
+  const ok = await confirm2({
+    message: "A Claude OAuth token is already stored. Replace it with a new one?",
+    default: false
+  });
+  if (!ok) info("Keeping the existing token; nothing changed.");
+  return ok;
+}
+async function runBrowserFlow() {
+  if (!isInteractive()) throw new Error(NON_TTY_LOGIN_MESSAGE);
+  const binary = resolveClaudeBinary();
+  if (!binary) throw new Error(MISSING_CLAUDE_BINARY_MESSAGE);
+  step("Starting the Anthropic browser authorization flow\u2026");
+  info(`Using ${binary.source === "bundled" ? "the bundled Agent SDK binary" : "the `claude` on your PATH"}.`);
+  blank();
+  const result = await spawnSetupToken(binary.path);
+  if (result.signal) {
+    throw new SquadExit(130, "Login cancelled \u2014 nothing was stored.");
+  }
+  if (result.code !== 0) {
+    throw new SquadExit(
+      result.code ?? 1,
+      `\`claude setup-token\` exited with code ${result.code}. Nothing was stored. Re-run \`squad auth login\` to try again.`
+    );
+  }
+  const extracted = extractOauthToken(result.output);
+  if (extracted) return validateOauthToken(extracted);
+  blank();
+  warning("Could not read the token from the login output. Paste it here:");
+  const pasted = await password2({
+    message: "Token (input hidden):",
+    validate: (v) => {
+      try {
+        validateOauthToken(v);
+        return true;
+      } catch (e) {
+        return e instanceof Error ? e.message : "invalid token";
+      }
+    }
+  });
+  return validateOauthToken(pasted);
+}
+async function verifyAndSummarise(planner) {
+  if (!planner || skipExternalProbesInAutomation()) return;
+  const auth2 = resolvePlannerAuthForCwd("anthropic", planner);
+  const spin = spinner("verifying the Claude login\u2026");
+  const probe = await probeClaudeAuth(auth2);
+  if (!probe.ok) {
+    spin.fail(`could not verify the login (${probe.kind})`);
+    warning(probe.detail);
+    return;
   }
-  info("Re-enable any time with `squad config set planner`.");
-}
-
-// src/core/ci-env.ts
-function skipExternalProbesInAutomation() {
-  const c = process.env.CI;
-  if (c === "true" || c === "1") return true;
-  if (process.env.GITHUB_ACTIONS) return true;
-  return false;
+  if (probe.unverifiable) {
+    spin.succeed("login stored");
+    if (probe.credentialSource) kv("credential", probe.credentialSource, 15);
+    info(probe.unverifiable);
+    return;
+  }
+  spin.succeed("login verified");
+  const account = [probe.account?.email, probe.account?.organization, probe.account?.subscriptionType].filter(Boolean).join(" \xB7 ");
+  if (account) kv("account", account, 15);
+  if (probe.apiKeySource) kv("api key source", probe.apiKeySource, 15);
 }
 
 // src/commands/config/set-planner.ts
@@ -1168,7 +1937,7 @@ async function runConfigSetPlanner(opts = {}) {
   const root = requireSquadRoot();
   const paths = buildPaths(root);
   const config2 = loadConfig(paths.configFile);
-  const baseSecrets = fs9.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
+  const baseSecrets = fs12.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
   const useYes = Boolean(opts.yes);
   const interactive = !useYes && isInteractive();
   if (interactive && config2.planner?.enabled === true) {
@@ -1205,7 +1974,7 @@ async function runConfigSetPlanner(opts = {}) {
   }
   if (interactive) {
     if (!config2.planner || config2.planner.enabled !== true) {
-      const enable = await confirm2({ message: "Enable the direct planner?", default: true });
+      const enable = await confirm3({ message: "Enable the direct planner?", default: true });
       if (!enable) {
         return;
       }
@@ -1218,42 +1987,45 @@ async function runConfigSetPlanner(opts = {}) {
   } else {
     nextPlanner = { ...prev, provider, enabled: true };
   }
+  let authChoice;
+  if (interactive && provider === "anthropic") {
+    authChoice = await select({
+      message: "How should squad-kit authenticate with Anthropic?",
+      choices: [
+        {
+          name: "Use my Claude subscription (browser login) \u2014 recommended, no API key needed",
+          value: "subscription"
+        },
+        { name: "Use an Anthropic API key", value: "api-key" },
+        {
+          name: "Decide automatically (subscription if signed in, otherwise API key)",
+          value: "auto"
+        }
+      ],
+      default: "subscription"
+    });
+    nextPlanner = { ...nextPlanner, auth: { ...nextPlanner.auth, anthropic: authChoice } };
+  }
   if (useYes) {
     if (!resolveProviderKey(provider)) {
       throw credentialError(provider);
     }
   } else {
-    const existing = resolveProviderKey(provider);
-    if (existing) {
-      const shouldUpdate = await confirm2({
-        message: "A planner credential is already available. Enter a new key and save it to .squad/secrets.yaml?",
-        default: false
-      });
-      if (shouldUpdate) {
-        const envVar = providerEnvVar(provider);
-        const key = await password2({
-          message: `${envVar} value (input hidden):`,
-          validate: (v) => v.length >= 20 ? true : "key looks too short"
-        });
-        const merged = mergePlannerKeyIntoSecrets(baseSecrets, provider, key);
-        saveSecrets(paths.secretsFile, merged);
-        success("Planner key saved to .squad/secrets.yaml");
-        info(".squad/secrets.yaml updated (chmod 0600 on POSIX)");
-      } else {
-        info("Keeping the existing planner credential; no change to .squad/secrets.yaml for the key.");
+    if (authChoice === "subscription") {
+      await offerBrowserLogin(baseSecrets);
+    } else if (authChoice === "auto") {
+      info(
+        "`auto` resolves in this order: a detected Claude login first, then a resolvable API key (ANTHROPIC_API_KEY, SQUAD_PLANNER_API_KEY, or .squad/secrets.yaml)."
+      );
+      if (!detectClaudeLogin(baseSecrets).present && !resolveProviderKey(provider)) {
+        warning(
+          "Neither a Claude login nor an API key resolves right now. Run `squad auth login`, or re-run `squad config set planner` and choose the API-key option."
+        );
       }
     } else {
-      const envVar = providerEnvVar(provider);
-      const key = await password2({
-        message: `${envVar} value (input hidden) \u2014 required:`,
-        validate: (v) => v.length >= 20 ? true : "key looks too short"
-      });
-      const merged = mergePlannerKeyIntoSecrets(baseSecrets, provider, key);
-      saveSecrets(paths.secretsFile, merged);
-      success("Planner key saved to .squad/secrets.yaml");
-      info(".squad/secrets.yaml updated (chmod 0600 on POSIX)");
+      await promptForApiKey(provider, paths.secretsFile, baseSecrets);
     }
-    const cacheEnabled = await confirm2({
+    const cacheEnabled = await confirm3({
       message: "Enable prompt caching? (Recommended \u2014 reduces billed tokens by ~70% on most providers.)",
       default: nextPlanner.cache?.enabled ?? true
     });
@@ -1261,6 +2033,12 @@ async function runConfigSetPlanner(opts = {}) {
   }
   const next = { ...config2, planner: nextPlanner };
   saveConfig(paths.configFile, next);
+  const auth2 = interactive && provider === "anthropic" ? tryResolveAuth(provider, nextPlanner) : void 0;
+  const configuredMode = nextPlanner.auth?.anthropic;
+  if (auth2?.mode === "subscription" && (configuredMode === "subscription" || configuredMode === "auto")) {
+    await reportSubscriptionSetup(provider, nextPlanner, auth2);
+    return;
+  }
   const cred = resolveProviderKey(provider);
   if (!cred) {
     warning(
@@ -1278,7 +2056,7 @@ async function runConfigSetPlanner(opts = {}) {
     kv("credential", `${cred.source} (${sourceText})`, 10);
   }
   if (skipExternalProbesInAutomation() || !cred) {
-    printPlannerNextSteps(Boolean(cred));
+    printPlannerNextSteps(Boolean(cred), "api-key");
     return;
   }
   try {
@@ -1299,11 +2077,90 @@ async function runConfigSetPlanner(opts = {}) {
       `Could not reach provider model list (${msg.slice(0, 160)}). Key was saved; run \`squad doctor\` to verify.`
     );
   }
-  printPlannerNextSteps(true);
+  printPlannerNextSteps(true, "api-key");
+}
+async function promptForApiKey(provider, secretsFile, baseSecrets) {
+  const envVar = providerEnvVar(provider);
+  const existing = resolveProviderKey(provider);
+  if (existing) {
+    const shouldUpdate = await confirm3({
+      message: "A planner credential is already available. Enter a new key and save it to .squad/secrets.yaml?",
+      default: false
+    });
+    if (!shouldUpdate) {
+      info("Keeping the existing planner credential; no change to .squad/secrets.yaml for the key.");
+      return;
+    }
+    const key2 = await password3({
+      message: `${envVar} value (input hidden):`,
+      validate: (v) => v.length >= 20 ? true : "key looks too short"
+    });
+    saveSecrets(secretsFile, mergePlannerKeyIntoSecrets(baseSecrets, provider, key2));
+    success("Planner key saved to .squad/secrets.yaml");
+    info(".squad/secrets.yaml updated (chmod 0600 on POSIX)");
+    return;
+  }
+  const key = await password3({
+    message: `${envVar} value (input hidden) \u2014 required:`,
+    validate: (v) => v.length >= 20 ? true : "key looks too short"
+  });
+  saveSecrets(secretsFile, mergePlannerKeyIntoSecrets(baseSecrets, provider, key));
+  success("Planner key saved to .squad/secrets.yaml");
+  info(".squad/secrets.yaml updated (chmod 0600 on POSIX)");
+}
+async function offerBrowserLogin(baseSecrets) {
+  if (detectClaudeLogin(baseSecrets).present) {
+    info("A Claude login is already available on this machine \u2014 no API key needed.");
+    return;
+  }
+  const now = await confirm3({
+    message: "No Claude login found. Run the browser login now?",
+    default: true
+  });
+  if (!now) {
+    info("Skipped. Run `squad auth login` when you are ready \u2014 planning needs it in subscription mode.");
+    return;
+  }
+  await runAuthLogin({});
+}
+function tryResolveAuth(provider, planner) {
+  try {
+    return resolvePlannerAuthForCwd(provider, planner);
+  } catch {
+    return void 0;
+  }
+}
+async function reportSubscriptionSetup(provider, planner, auth2) {
+  blank();
+  success("Planner configuration updated.");
+  kv("provider", provider, 10);
+  kv("model (plan)", modelFor(provider, "plan", planner.modelOverride), 10);
+  kv("model (execute)", modelFor(provider, "execute", planner.modelOverride), 10);
+  kv("auth", `subscription (${describeAuth(auth2).credentialHint})`, 10);
+  if (!skipExternalProbesInAutomation()) {
+    const probe = await probeClaudeAuth(auth2);
+    if (probe.ok) {
+      const account = [probe.account?.email, probe.account?.organization, probe.account?.subscriptionType].filter(Boolean).join(" \xB7 ");
+      info(account ? `Credential check: signed in as ${account}.` : "Credential check: the Claude login responded OK.");
+    } else {
+      warning(`Credential check failed (${probe.kind}). ${probe.detail}`);
+    }
+  }
+  printPlannerNextSteps(true, "subscription");
 }
-function printPlannerNextSteps(credentialReady) {
+function printPlannerNextSteps(credentialReady, mode) {
   blank();
   step("Next:");
+  if (mode === "subscription") {
+    info("1) Confirm the login with `squad auth status` \u2014 it shows the account and how it resolved.");
+    info("2) Verify with `squad doctor` \u2014 every planner check should be green.");
+    info("3) Create a story:  squad new-story <feature-slug>  (or --no-tracker for a manual story).");
+    info("4) Fill the generated intake.md, then run `squad new-plan --api` to generate the plan.");
+    info(
+      "   Planning draws on your Claude usage limits \u2014 there is no per-token API bill. To switch to an API key later, re-run `squad config set planner`."
+    );
+    return;
+  }
   if (!credentialReady) {
     info("1) Save a planner key: re-run `squad config set planner` and paste the key when prompted.");
     info("2) Verify with `squad doctor` \u2014 all planner checks should turn green.");
@@ -1319,7 +2176,7 @@ function printPlannerNextSteps(credentialReady) {
 }
 
 // src/commands/config/set-tracker.ts
-import fs11 from "fs";
+import fs14 from "fs";
 import { select as select2 } from "@inquirer/prompts";
 
 // src/tracker/types.ts
@@ -1335,13 +2192,13 @@ var TrackerError = class extends Error {
 };
 
 // src/tracker/attachments.ts
-import fs10 from "fs";
-import path5 from "path";
+import fs13 from "fs";
+import path6 from "path";
 var DEFAULT_MAX_MB = 10;
 async function downloadAttachmentsWith(refs, targetDir, authHeaders, opts = {}) {
   const maxMb = opts.maxMegabytes ?? DEFAULT_MAX_MB;
   const maxBytes = maxMb * 1024 * 1024;
-  fs10.mkdirSync(targetDir, { recursive: true });
+  fs13.mkdirSync(targetDir, { recursive: true });
   const out = [];
   for (const ref of refs) {
     out.push(await one(ref, targetDir, authHeaders, maxBytes, maxMb));
@@ -1387,7 +2244,7 @@ async function one(ref, targetDir, headers, maxBytes, maxMb) {
       skipReason: `${formatMb(buf.byteLength)} after download exceeds cap (${maxMb} MB)`
     };
   }
-  fs10.writeFileSync(dest, buf);
+  fs13.writeFileSync(dest, buf);
   return {
     source: ref,
     outcome: "written",
@@ -1397,19 +2254,19 @@ async function one(ref, targetDir, headers, maxBytes, maxMb) {
 }
 function sanitizeFilename(raw) {
   const normalized = raw.replace(/\\/g, "/");
-  const base = path5.basename(normalized).replace(/[\\/]/g, "_");
+  const base = path6.basename(normalized).replace(/[\\/]/g, "_");
   const cleaned = base.replace(/[\x00-\x1f]/g, "").replace(/^\.+/, "").replace(/\s+/g, " ").trim();
   if (cleaned.length === 0) return "attachment";
   return cleaned.slice(0, 180);
 }
 function uniqueDestination(dir, name) {
-  let candidate = path5.join(dir, name);
-  if (!fs10.existsSync(candidate)) return candidate;
-  const ext = path5.extname(name);
+  let candidate = path6.join(dir, name);
+  if (!fs13.existsSync(candidate)) return candidate;
+  const ext = path6.extname(name);
   const stem = name.slice(0, name.length - ext.length);
   let n = 1;
-  while (fs10.existsSync(candidate) && n < 1e3) {
-    candidate = path5.join(dir, `${stem} (${n})${ext}`);
+  while (fs13.existsSync(candidate) && n < 1e3) {
+    candidate = path6.join(dir, `${stem} (${n})${ext}`);
     n += 1;
   }
   return candidate;
@@ -2023,7 +2880,7 @@ async function runConfigSetTracker(opts = {}) {
   const root = requireSquadRoot();
   const paths = buildPaths(root);
   const config2 = loadConfig(paths.configFile);
-  const baseSecrets = fs11.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
+  const baseSecrets = fs14.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
   const useYes = Boolean(opts.yes);
   const interactive = !useYes && isInteractive();
   let type;
@@ -2146,7 +3003,7 @@ async function runConfigSetTracker(opts = {}) {
     return;
   }
   const reloaded = loadConfig(paths.configFile);
-  const s = fs11.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
+  const s = fs14.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
   if (reloaded.tracker.type === "jira") {
     const r = await probeJiraConnectivity(s, reloaded);
     if (r.ok) {
@@ -2193,8 +3050,8 @@ function printTrackerNextSteps(type) {
 }
 
 // src/commands/config/unset-tracker.ts
-import fs12 from "fs";
-import { confirm as confirm3 } from "@inquirer/prompts";
+import fs15 from "fs";
+import { confirm as confirm4 } from "@inquirer/prompts";
 async function runConfigUnsetTracker(opts = {}) {
   const root = requireSquadRoot();
   const paths = buildPaths(root);
@@ -2205,7 +3062,7 @@ async function runConfigUnsetTracker(opts = {}) {
       warning("Pass -y in non-interactive mode to confirm setting the tracker to none.");
       return;
     }
-    const ok = await confirm3({ message: "Set tracker to none? (keeps tracker tokens in .squad/secrets.yaml.)", default: false });
+    const ok = await confirm4({ message: "Set tracker to none? (keeps tracker tokens in .squad/secrets.yaml.)", default: false });
     if (!ok) {
       return;
     }
@@ -2213,7 +3070,7 @@ async function runConfigUnsetTracker(opts = {}) {
   const next = { ...config2, tracker: { type: "none" } };
   saveConfig(paths.configFile, next);
   if (opts.removeCredentials) {
-    const s = fs12.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
+    const s = fs15.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
     if (s.tracker) {
       delete s.tracker;
       saveSecrets(paths.secretsFile, s);
@@ -2226,8 +3083,8 @@ async function runConfigUnsetTracker(opts = {}) {
 }
 
 // src/commands/config/remove-credential.ts
-import fs13 from "fs";
-import { confirm as confirm4 } from "@inquirer/prompts";
+import fs16 from "fs";
+import { confirm as confirm5 } from "@inquirer/prompts";
 async function runConfigRemoveCredential(section, opts = {}) {
   if (section !== "planner" && section !== "tracker") {
     throw new Error(
@@ -2242,7 +3099,7 @@ async function runConfigRemoveCredential(section, opts = {}) {
       warning("Pass -y in non-interactive mode to confirm, or run `squad config remove-credential` in a TTY.");
       return;
     }
-    const ok = await confirm4({
+    const ok = await confirm5({
       message: `Delete all ${section} credentials from .squad/secrets.yaml? (config is unchanged)`,
       default: false
     });
@@ -2250,7 +3107,7 @@ async function runConfigRemoveCredential(section, opts = {}) {
       return;
     }
   }
-  const s = fs13.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
+  const s = fs16.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
   if (section === "planner") {
     if (s.planner) {
       delete s.planner;
@@ -2268,10 +3125,10 @@ async function runConfigRemoveCredential(section, opts = {}) {
 // src/commands/init.ts
 var SUPPORTED_AGENTS = ["claude-code", "cursor", "copilot", "gemini"];
 var AGENT_INSTALL = {
-  "claude-code": { subdir: path6.join(".claude", "commands"), srcDir: "claude-code" },
-  cursor: { subdir: path6.join(".cursor", "commands"), srcDir: "cursor" },
-  copilot: { subdir: path6.join(".github", "prompts"), srcDir: "copilot" },
-  gemini: { subdir: path6.join(".gemini", "commands"), srcDir: "gemini" }
+  "claude-code": { subdir: path7.join(".claude", "commands"), srcDir: "claude-code" },
+  cursor: { subdir: path7.join(".cursor", "commands"), srcDir: "cursor" },
+  copilot: { subdir: path7.join(".github", "prompts"), srcDir: "copilot" },
+  gemini: { subdir: path7.join(".gemini", "commands"), srcDir: "gemini" }
 };
 async function runInit(opts) {
   const root = process.cwd();
@@ -2279,7 +3136,7 @@ async function runInit(opts) {
   if (!opts.yes) {
     banner();
   }
-  if (fs14.existsSync(paths.configFile) && !opts.force) {
+  if (fs17.existsSync(paths.configFile) && !opts.force) {
     if (!isInteractive() || opts.yes) {
       warning(
         `A ${SQUAD_DIR}/config.yaml already exists. Run \`squad init --force\` to overwrite, or \`squad config set planner\` / \`squad config set tracker\` to change individual sections.`
@@ -2306,7 +3163,7 @@ async function runInit(opts) {
     }
   }
   const defaults = {
-    name: opts.name ?? path6.basename(root),
+    name: opts.name ?? path7.basename(root),
     language: opts.language ?? "typescript",
     tracker: opts.tracker ?? "none",
     agents: parseAgentsFlag(opts.agents)
@@ -2382,11 +3239,11 @@ async function runInit(opts) {
       };
     }
   } else {
-    const plannerEnabled = await confirm5({
+    const plannerEnabled2 = await confirm6({
       message: "Enable automatic plan generation? (press Enter to skip \u2014 you can always edit .squad/config.yaml later)",
       default: false
     });
-    if (plannerEnabled) {
+    if (plannerEnabled2) {
       const provider = await select3({
         message: "Planner provider:",
         choices: [
@@ -2411,29 +3268,60 @@ async function runInit(opts) {
     }
   }
   if (plannerBlock?.enabled && allowSecretPrompts) {
-    const envVar = providerEnvVar(plannerBlock.provider);
-    const envPresent = Boolean(process.env[envVar]);
-    if (envPresent) {
-      info(`Planner key detected in ${envVar}; keeping env-var resolution as the primary source.`);
-    } else {
-      const storeKey = await select3({
-        message: `No ${envVar} in your environment. How do you want to store your planner API key?`,
+    let needsApiKey = true;
+    if (plannerBlock.provider === "anthropic") {
+      const authMode = await select3({
+        message: "How should squad-kit authenticate with Anthropic?",
         choices: [
-          { name: `Enter it now and save to .squad/secrets.yaml (git-ignored)`, value: "secrets" },
-          { name: `I'll export ${envVar} in my shell profile myself`, value: "env" }
-        ]
+          {
+            name: "Use my Claude subscription (browser login) \u2014 recommended, no API key needed",
+            value: "subscription"
+          },
+          { name: "Use an Anthropic API key", value: "api-key" },
+          {
+            name: "Decide automatically (subscription if signed in, otherwise API key)",
+            value: "auto"
+          }
+        ],
+        default: "subscription"
       });
-      if (storeKey === "secrets") {
-        const key = await password3({
-          message: `${envVar} value (input hidden):`,
-          validate: (v) => v.length >= 20 ? true : "key looks too short"
-        });
-        const base = loadSecrets(paths.secretsFile);
-        const merged = mergePlannerKeyIntoSecrets(base, plannerBlock.provider, key);
-        saveSecrets(paths.secretsFile, merged);
-        success("Planner key saved to .squad/secrets.yaml");
+      plannerBlock = { ...plannerBlock, auth: { anthropic: authMode } };
+      needsApiKey = authMode === "api-key";
+      if (authMode === "subscription") {
+        info("No API key needed. Run `squad auth login` after init to sign in with your Claude account.");
+        info("Already signed in through Claude Code (`claude` then `/login`)? squad-kit picks that up automatically.");
+      } else if (authMode === "auto") {
+        info(
+          "`auto` resolves in this order: a detected Claude login first, then a resolvable API key (ANTHROPIC_API_KEY, SQUAD_PLANNER_API_KEY, or .squad/secrets.yaml)."
+        );
+        info("Run `squad auth login` for the subscription, or `squad config set planner` to save a key.");
+      }
+    }
+    if (needsApiKey) {
+      const envVar = providerEnvVar(plannerBlock.provider);
+      const envPresent = Boolean(process.env[envVar]);
+      if (envPresent) {
+        info(`Planner key detected in ${envVar}; keeping env-var resolution as the primary source.`);
       } else {
-        info(`Remember to export ${envVar} before running \`squad new-plan\`.`);
+        const storeKey = await select3({
+          message: `No ${envVar} in your environment. How do you want to store your planner API key?`,
+          choices: [
+            { name: `Enter it now and save to .squad/secrets.yaml (git-ignored)`, value: "secrets" },
+            { name: `I'll export ${envVar} in my shell profile myself`, value: "env" }
+          ]
+        });
+        if (storeKey === "secrets") {
+          const key = await password4({
+            message: `${envVar} value (input hidden):`,
+            validate: (v) => v.length >= 20 ? true : "key looks too short"
+          });
+          const base = loadSecrets(paths.secretsFile);
+          const merged = mergePlannerKeyIntoSecrets(base, plannerBlock.provider, key);
+          saveSecrets(paths.secretsFile, merged);
+          success("Planner key saved to .squad/secrets.yaml");
+        } else {
+          info(`Remember to export ${envVar} before running \`squad new-plan\`.`);
+        }
       }
     }
   }
@@ -2450,12 +3338,12 @@ async function runInit(opts) {
     agents: answers.agents,
     planner: plannerBlock
   };
-  fs14.mkdirSync(paths.squadDir, { recursive: true });
-  fs14.mkdirSync(paths.storiesDir, { recursive: true });
-  fs14.mkdirSync(paths.plansDir, { recursive: true });
+  fs17.mkdirSync(paths.squadDir, { recursive: true });
+  fs17.mkdirSync(paths.storiesDir, { recursive: true });
+  fs17.mkdirSync(paths.plansDir, { recursive: true });
   writeFileSafe(
     paths.indexFile,
-    readFile(path6.join(templatesDir(), "index.md")),
+    readFile(path7.join(templatesDir(), "index.md")),
     !!opts.force
   );
   saveConfig(paths.configFile, config2);
@@ -2463,7 +3351,7 @@ async function runInit(opts) {
     info("Updated .gitignore with squad-managed patterns (e.g. .squad/secrets.yaml).");
   }
   writeFileSafe(
-    path6.join(paths.squadDir, "README.md"),
+    path7.join(paths.squadDir, "README.md"),
     renderSquadReadme(config2),
     !!opts.force
   );
@@ -2480,8 +3368,13 @@ async function runInit(opts) {
     const model = modelFor(plannerBlock.provider, "plan", plannerBlock.modelOverride);
     const overrideNote = plannerBlock.modelOverride?.[plannerBlock.provider] ? " (override)" : "";
     kv("planner", `${plannerBlock.provider}/${model}${overrideNote}`);
-    kv("key", hasKey ? `\u2713 (${envVar} or .squad/secrets.yaml)` : `missing (set ${envVar})`);
-    if (!hasKey) {
+    const subscriptionMode = plannerBlock.auth?.anthropic === "subscription" && plannerBlock.provider === "anthropic";
+    if (subscriptionMode) {
+      kv("auth", "subscription (Claude login) \u2014 run `squad auth login` if you have not signed in");
+    } else {
+      kv("key", hasKey ? `\u2713 (${envVar} or .squad/secrets.yaml)` : `missing (set ${envVar})`);
+    }
+    if (!hasKey && !subscriptionMode) {
       blank();
       warning("Planner key not found in environment or .squad/secrets.yaml.");
       info("Set one of these before running `squad new-plan`:");
@@ -2503,13 +3396,13 @@ function parseAgentsFlag(flag) {
 }
 async function confirmSafe(message, defaultValue, nonInteractive) {
   if (nonInteractive) return defaultValue;
-  return confirm5({ message, default: defaultValue });
+  return confirm6({ message, default: defaultValue });
 }
 function installAgent(root, agent, overwrite) {
   const config2 = AGENT_INSTALL[agent];
-  const src = path6.join(templatesDir(), "agents", config2.srcDir);
-  const dest = path6.join(root, config2.subdir);
-  if (!fs14.existsSync(src)) return;
+  const src = path7.join(templatesDir(), "agents", config2.srcDir);
+  const dest = path7.join(root, config2.subdir);
+  if (!fs17.existsSync(src)) return;
   copyTree(src, dest, overwrite);
 }
 function renderSquadReadme(config2) {
@@ -2535,22 +3428,22 @@ Plan meta-prompts (\`generate-plan.md\`, \`story-skeleton.md\`) ship inside the
 }
 
 // src/commands/new-story.ts
-import fs20 from "fs";
-import path12 from "path";
+import fs23 from "fs";
+import path13 from "path";
 import { input as input3, select as select5 } from "@inquirer/prompts";
 
 // src/core/stories.ts
-import fs15 from "fs";
-import path7 from "path";
+import fs18 from "fs";
+import path8 from "path";
 var STORY_FILE = /^(\d{2,})-story-.+\.md$/;
 function listFeatures(paths) {
-  if (!fs15.existsSync(paths.storiesDir)) return [];
-  return fs15.readdirSync(paths.storiesDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
+  if (!fs18.existsSync(paths.storiesDir)) return [];
+  return fs18.readdirSync(paths.storiesDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
 }
 function listPlanFeatureNames(paths) {
   const names = new Set(listFeatures(paths));
-  if (fs15.existsSync(paths.plansDir)) {
-    for (const e of fs15.readdirSync(paths.plansDir, { withFileTypes: true })) {
+  if (fs18.existsSync(paths.plansDir)) {
+    for (const e of fs18.readdirSync(paths.plansDir, { withFileTypes: true })) {
       if (e.isDirectory()) names.add(e.name);
     }
   }
@@ -2561,16 +3454,16 @@ function listAllStories(paths) {
 }
 function listStories(paths, opts = {}) {
   const rows = [];
-  if (!fs15.existsSync(paths.storiesDir)) return rows;
-  for (const feature of fs15.readdirSync(paths.storiesDir, { withFileTypes: true })) {
+  if (!fs18.existsSync(paths.storiesDir)) return rows;
+  for (const feature of fs18.readdirSync(paths.storiesDir, { withFileTypes: true })) {
     if (!feature.isDirectory()) continue;
     if (opts.feature && feature.name !== opts.feature) continue;
-    const featureDir = path7.join(paths.storiesDir, feature.name);
-    for (const story of fs15.readdirSync(featureDir, { withFileTypes: true })) {
+    const featureDir = path8.join(paths.storiesDir, feature.name);
+    for (const story of fs18.readdirSync(featureDir, { withFileTypes: true })) {
       if (!story.isDirectory()) continue;
-      const storyDir = path7.join(featureDir, story.name);
-      const intakePath = path7.join(storyDir, "intake.md");
-      if (!fs15.existsSync(intakePath)) continue;
+      const storyDir = path8.join(featureDir, story.name);
+      const intakePath = path8.join(storyDir, "intake.md");
+      if (!fs18.existsSync(intakePath)) continue;
       rows.push({
         feature: feature.name,
         id: story.name,
@@ -2584,10 +3477,10 @@ function listStories(paths, opts = {}) {
   return rows;
 }
 function findPlanFor(plansDir, feature, storyId) {
-  const featureDir = path7.join(plansDir, feature);
-  if (!fs15.existsSync(featureDir)) return void 0;
+  const featureDir = path8.join(plansDir, feature);
+  if (!fs18.existsSync(featureDir)) return void 0;
   const candidates = [];
-  for (const entry of fs15.readdirSync(featureDir)) {
+  for (const entry of fs18.readdirSync(featureDir)) {
     if (!STORY_FILE.test(entry)) continue;
     if (entry.includes(storyId)) candidates.push(entry);
   }
@@ -2600,16 +3493,16 @@ function findStoryByIntake(records, intakePath) {
   return records.find((r) => normalizeIntakePath(r.intakePath) === target);
 }
 function normalizeIntakePath(p) {
-  const resolved = path7.resolve(p);
+  const resolved = path8.resolve(p);
   try {
-    return fs15.realpathSync(resolved);
+    return fs18.realpathSync(resolved);
   } catch {
     return resolved;
   }
 }
 function readTitleHint(intakePath) {
   try {
-    const raw = fs15.readFileSync(intakePath, "utf8");
+    const raw = fs18.readFileSync(intakePath, "utf8");
     const head = raw.split("\n").slice(0, 30).join("\n");
     const hintLine = head.match(/>\s*\*\*Title hint \(from CLI\):\*\*\s*(.+?)\s*$/m);
     const fromHint = hintLine?.[1]?.trim();
@@ -2646,7 +3539,7 @@ function parsePlanMetadataLine(line2) {
 }
 function readPlanMetadata(planFileAbsPath) {
   try {
-    const raw = fs15.readFileSync(planFileAbsPath, "utf8").replace(/^\uFEFF/, "");
+    const raw = fs18.readFileSync(planFileAbsPath, "utf8").replace(/^\uFEFF/, "");
     const lines = raw.split(/\n/);
     const scan = Math.min(lines.length, 40);
     for (let i = 0; i < scan; i++) {
@@ -2678,8 +3571,8 @@ function trackerIdForFilename(type, id) {
 }
 
 // src/core/story-intake-helpers.ts
-import fs16 from "fs";
-import path8 from "path";
+import fs19 from "fs";
+import path9 from "path";
 function buildIntakeTemplateVars(args) {
   const e = escapeTemplateValue;
   const { config: config2, featureSlug, storyFolderName, trackerId, title, fetchedIssue } = args;
@@ -2735,7 +3628,7 @@ function renderAttachmentsTable(downloads) {
     const size = `${sizeNum | 0} KB`;
     switch (d.outcome) {
       case "written":
-        return `| \`attachments/${path8.basename(d.absolutePath)}\` | ${size} | downloaded |`;
+        return `| \`attachments/${path9.basename(d.absolutePath)}\` | ${size} | downloaded |`;
       case "skipped-oversize":
         return `| ${d.source.filename} | ${size} | **skipped** \u2014 ${d.skipReason} |`;
       case "skipped-error":
@@ -2764,34 +3657,34 @@ function buildSkippedTrackerPreamble(trackerType) {
   ].join("\n");
 }
 function ensureFeatureOverview(featurePlanDir, slug) {
-  fs16.mkdirSync(featurePlanDir, { recursive: true });
-  const overviewFile = path8.join(featurePlanDir, "00-overview.md");
-  if (fs16.existsSync(overviewFile)) return;
-  const template = readFile(path8.join(templatesDir(), "overview.md"));
+  fs19.mkdirSync(featurePlanDir, { recursive: true });
+  const overviewFile = path9.join(featurePlanDir, "00-overview.md");
+  if (fs19.existsSync(overviewFile)) return;
+  const template = readFile(path9.join(templatesDir(), "overview.md"));
   writeFileSafe(overviewFile, render(template, { featureSlug: slug }), false);
 }
 
 // src/core/story-mutations.ts
-import fs19 from "fs";
-import path11 from "path";
+import fs22 from "fs";
+import path12 from "path";
 
 // src/commands/rm/shared.ts
-import fs18 from "fs";
-import path10 from "path";
+import fs21 from "fs";
+import path11 from "path";
 import { select as select4 } from "@inquirer/prompts";
 
 // src/core/sequence.ts
-import fs17 from "fs";
-import path9 from "path";
+import fs20 from "fs";
+import path10 from "path";
 var STORY_FILE2 = /^(\d{2,})-story-.+\.md$/;
 function scanPlans(plansDir) {
   const used = [];
   const seen = /* @__PURE__ */ new Map();
-  if (fs17.existsSync(plansDir)) {
-    for (const feature of fs17.readdirSync(plansDir, { withFileTypes: true })) {
+  if (fs20.existsSync(plansDir)) {
+    for (const feature of fs20.readdirSync(plansDir, { withFileTypes: true })) {
       if (!feature.isDirectory()) continue;
-      const featureDir = path9.join(plansDir, feature.name);
-      for (const entry of fs17.readdirSync(featureDir)) {
+      const featureDir = path10.join(plansDir, feature.name);
+      for (const entry of fs20.readdirSync(featureDir)) {
         const match = entry.match(STORY_FILE2);
         if (!match) continue;
         const n = parseInt(match[1], 10);
@@ -2815,9 +3708,9 @@ function canPromptForRm(opts) {
   return isInteractive() && Boolean(process.stdin.isTTY);
 }
 function removeOverviewRow(featurePlanDir, storyId) {
-  const overview = path10.join(featurePlanDir, "00-overview.md");
-  if (!fs18.existsSync(overview)) return;
-  const src = fs18.readFileSync(overview, "utf8");
+  const overview = path11.join(featurePlanDir, "00-overview.md");
+  if (!fs21.existsSync(overview)) return;
+  const src = fs21.readFileSync(overview, "utf8");
   const lines = src.split("\n");
   const filtered = lines.filter((line2) => {
     if (!line2.startsWith("|")) return true;
@@ -2825,12 +3718,12 @@ function removeOverviewRow(featurePlanDir, storyId) {
     if (/^\|\s*-+/.test(line2)) return true;
     return !line2.includes(storyId);
   });
-  fs18.writeFileSync(overview, filtered.join("\n"), "utf8");
+  fs21.writeFileSync(overview, filtered.join("\n"), "utf8");
 }
 function removeOverviewRowForPlanFile(featurePlanDir, planBasename) {
-  const overview = path10.join(featurePlanDir, "00-overview.md");
-  if (!fs18.existsSync(overview)) return;
-  const src = fs18.readFileSync(overview, "utf8");
+  const overview = path11.join(featurePlanDir, "00-overview.md");
+  if (!fs21.existsSync(overview)) return;
+  const src = fs21.readFileSync(overview, "utf8");
   const token = `\`${planBasename}\``;
   const lines = src.split("\n");
   const filtered = lines.filter((line2) => {
@@ -2839,25 +3732,25 @@ function removeOverviewRowForPlanFile(featurePlanDir, planBasename) {
     if (/^\|\s*-+/.test(line2)) return true;
     return !line2.includes(token);
   });
-  fs18.writeFileSync(overview, filtered.join("\n"), "utf8");
+  fs21.writeFileSync(overview, filtered.join("\n"), "utf8");
 }
 function trashOrDelete(absPaths, trashRoot, useTrash) {
   if (!useTrash) {
-    for (const p of absPaths) fs18.rmSync(p, { recursive: true, force: true });
+    for (const p of absPaths) fs21.rmSync(p, { recursive: true, force: true });
     return { removed: absPaths };
   }
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const bucket = path10.join(trashRoot, ts);
-  fs18.mkdirSync(bucket, { recursive: true });
+  const bucket = path11.join(trashRoot, ts);
+  fs21.mkdirSync(bucket, { recursive: true });
   for (const src of absPaths) {
-    const rel = path10.basename(src);
-    let dst = path10.join(bucket, rel);
+    const rel = path11.basename(src);
+    let dst = path11.join(bucket, rel);
     let n = 0;
-    while (fs18.existsSync(dst)) {
+    while (fs21.existsSync(dst)) {
       n += 1;
-      dst = path10.join(bucket, `${n}_${rel}`);
+      dst = path11.join(bucket, `${n}_${rel}`);
     }
-    fs18.renameSync(src, dst);
+    fs21.renameSync(src, dst);
   }
   return { removed: absPaths, trashed: bucket };
 }
@@ -2868,21 +3761,21 @@ function renderPreview(kind, targets, opts) {
     kv(t.kind, t.label, 6);
   }
   if (opts.trash) {
-    info(`Items will move to ${path10.relative(process.cwd(), opts.trashRoot)}/<timestamp>/`);
+    info(`Items will move to ${path11.relative(process.cwd(), opts.trashRoot)}/<timestamp>/`);
   } else if (!opts.dryRun) {
     warning("This is a permanent delete. Pass --trash to move to .squad/.trash/ instead.");
   }
 }
 function listAllPlanListEntries(paths, featureFilter) {
-  if (!fs18.existsSync(paths.plansDir)) return [];
+  if (!fs21.existsSync(paths.plansDir)) return [];
   const out = [];
-  for (const ent of fs18.readdirSync(paths.plansDir, { withFileTypes: true })) {
+  for (const ent of fs21.readdirSync(paths.plansDir, { withFileTypes: true })) {
     if (!ent.isDirectory()) continue;
     if (featureFilter && ent.name !== featureFilter) continue;
-    const featureDir = path10.join(paths.plansDir, ent.name);
-    for (const name of fs18.readdirSync(featureDir)) {
+    const featureDir = path11.join(paths.plansDir, ent.name);
+    for (const name of fs21.readdirSync(featureDir)) {
       if (!STORY_PLAN.test(name)) continue;
-      out.push({ feature: ent.name, file: name, abs: path10.join(featureDir, name) });
+      out.push({ feature: ent.name, file: name, abs: path11.join(featureDir, name) });
     }
   }
   return out.sort((a, b) => (a.feature + a.file).localeCompare(b.feature + b.file));
@@ -2933,34 +3826,34 @@ function resolveStoryFromArg(arg, stories, root) {
     if (s.id === t) return s;
     if (`${s.feature}/${s.id}` === t) return s;
   }
-  const abs = path10.isAbsolute(t) ? t : path10.resolve(root, t);
-  const withIntake = t.endsWith("intake.md") ? abs : path10.join(abs, "intake.md");
+  const abs = path11.isAbsolute(t) ? t : path11.resolve(root, t);
+  const withIntake = t.endsWith("intake.md") ? abs : path11.join(abs, "intake.md");
   return findStoryByIntake(stories, withIntake) ?? findStoryByIntake(stories, abs);
 }
 function isSequenceToken(s) {
   return /^\d{1,4}$/.test(s) && s.length > 0;
 }
 function tryParsePlanFilePath(absPath, paths, featureFilter) {
-  if (!fs18.existsSync(absPath) || !STORY_PLAN.test(path10.basename(absPath))) return void 0;
-  const planRoot = fs18.realpathSync(path10.resolve(paths.plansDir));
-  const fileReal = fs18.realpathSync(path10.resolve(absPath));
-  const rel = path10.relative(planRoot, fileReal);
-  if (rel.startsWith("..") || path10.isAbsolute(rel)) return void 0;
-  const segs = rel.split(path10.sep);
+  if (!fs21.existsSync(absPath) || !STORY_PLAN.test(path11.basename(absPath))) return void 0;
+  const planRoot = fs21.realpathSync(path11.resolve(paths.plansDir));
+  const fileReal = fs21.realpathSync(path11.resolve(absPath));
+  const rel = path11.relative(planRoot, fileReal);
+  if (rel.startsWith("..") || path11.isAbsolute(rel)) return void 0;
+  const segs = rel.split(path11.sep);
   if (segs.length < 2) return void 0;
   const feature = segs[0];
-  const file = segs.slice(1).join(path10.sep);
+  const file = segs.slice(1).join(path11.sep);
   if (featureFilter && feature !== featureFilter) return void 0;
-  return { feature, file, abs: path10.resolve(absPath) };
+  return { feature, file, abs: path11.resolve(absPath) };
 }
 function resolvePlanFromArg(arg, paths, featureFilter) {
   const t = arg.trim();
   if (!t) return void 0;
-  const asPath = path10.isAbsolute(t) ? t : path10.resolve(process.cwd(), t);
+  const asPath = path11.isAbsolute(t) ? t : path11.resolve(process.cwd(), t);
   const a = tryParsePlanFilePath(asPath, paths, featureFilter);
   if (a) return a;
-  if (!path10.isAbsolute(t)) {
-    const under = tryParsePlanFilePath(path10.join(paths.plansDir, t), paths, featureFilter);
+  if (!path11.isAbsolute(t)) {
+    const under = tryParsePlanFilePath(path11.join(paths.plansDir, t), paths, featureFilter);
     if (under) return under;
   }
   if (isSequenceToken(t)) {
@@ -2990,24 +3883,24 @@ function countOverviewDataRows(overviewContent) {
   return n;
 }
 function featureStoriesDirEmpty(paths, feature) {
-  const d = path10.join(paths.storiesDir, feature);
-  if (!fs18.existsSync(d)) return true;
-  return fs18.readdirSync(d).length === 0;
+  const d = path11.join(paths.storiesDir, feature);
+  if (!fs21.existsSync(d)) return true;
+  return fs21.readdirSync(d).length === 0;
 }
 
 // src/core/story-mutations.ts
 function writeNewStoryToDisk(input5) {
   const { paths, config: config2, featureSlug, storyFolderName, id, title, noTracker, sourceBlock, fetchedIssue } = input5;
-  const storyDir = path11.join(paths.storiesDir, featureSlug, storyFolderName);
-  const intakeFile = path11.join(storyDir, "intake.md");
-  const attachmentsDir = path11.join(storyDir, "attachments");
-  if (fs19.existsSync(intakeFile)) {
-    const rel = path11.relative(paths.root, intakeFile);
+  const storyDir = path12.join(paths.storiesDir, featureSlug, storyFolderName);
+  const intakeFile = path12.join(storyDir, "intake.md");
+  const attachmentsDir = path12.join(storyDir, "attachments");
+  if (fs22.existsSync(intakeFile)) {
+    const rel = path12.relative(paths.root, intakeFile);
     throw new Error(
       `Intake already exists: ${intakeFile}. Run \`squad new-plan ${rel}\` to plan it, or \`squad rm story\` to remove the story first.`
     );
   }
-  fs19.mkdirSync(attachmentsDir, { recursive: true });
+  fs22.mkdirSync(attachmentsDir, { recursive: true });
   const template = readBundledPrompt("intake.md");
   const rendered = render(
     template,
@@ -3022,7 +3915,7 @@ function writeNewStoryToDisk(input5) {
   );
   const skippedPreamble = noTracker && config2.tracker.type !== "none" && !sourceBlock ? buildSkippedTrackerPreamble(config2.tracker.type) : "";
   writeFileSafe(intakeFile, skippedPreamble + sourceBlock + rendered, false);
-  ensureFeatureOverview(path11.join(paths.plansDir, featureSlug), featureSlug);
+  ensureFeatureOverview(path12.join(paths.plansDir, featureSlug), featureSlug);
   return { storyDir, intakePath: intakeFile, feature: featureSlug, id: storyFolderName };
 }
 function createStoryRecord(input5) {
@@ -3071,16 +3964,16 @@ async function createStoryRecordFromIssue(input5) {
   }
   const title = input5.issue.title;
   const storyFolderName = trackerIdForFilename(input5.config.tracker.type, id);
-  const storyDir = path11.join(input5.paths.storiesDir, feature, storyFolderName);
-  const intakeFile = path11.join(storyDir, "intake.md");
-  const attachmentsDir = path11.join(storyDir, "attachments");
-  if (fs19.existsSync(intakeFile)) {
-    const rel = path11.relative(input5.paths.root, intakeFile);
+  const storyDir = path12.join(input5.paths.storiesDir, feature, storyFolderName);
+  const intakeFile = path12.join(storyDir, "intake.md");
+  const attachmentsDir = path12.join(storyDir, "attachments");
+  if (fs22.existsSync(intakeFile)) {
+    const rel = path12.relative(input5.paths.root, intakeFile);
     throw new Error(
       `Intake already exists: ${intakeFile}. Run \`squad new-plan ${rel}\` to plan it, or \`squad rm story\` to remove the story first.`
     );
   }
-  fs19.mkdirSync(attachmentsDir, { recursive: true });
+  fs22.mkdirSync(attachmentsDir, { recursive: true });
   let downloads = [];
   if (input5.withAttachments && input5.issue.attachments.length > 0) {
     downloads = await input5.client.downloadAttachments(input5.issue.attachments, attachmentsDir);
@@ -3108,10 +4001,10 @@ async function createStoryRecordFromIssue(input5) {
 function deleteStoryRecord(input5) {
   const targets = [input5.story.storyDir];
   if (input5.story.planFile) {
-    targets.push(path11.join(input5.paths.plansDir, input5.story.feature, input5.story.planFile));
+    targets.push(path12.join(input5.paths.plansDir, input5.story.feature, input5.story.planFile));
   }
   const result = trashOrDelete(targets, input5.paths.trashDir, input5.trash);
-  removeOverviewRow(path11.join(input5.paths.plansDir, input5.story.feature), input5.story.id);
+  removeOverviewRow(path12.join(input5.paths.plansDir, input5.story.feature), input5.story.id);
   return result;
 }
 
@@ -3221,15 +4114,15 @@ async function runNewStory(featureSlug, opts) {
       'Could not derive a story folder name. Pass `--title "<hint>"` when using `--no-tracker`, or `--id <tracker-id>` to name the folder after the tracker id.'
     );
   }
-  const storyDir = path12.join(paths.storiesDir, slug, storyFolderName);
-  const intakeFile = path12.join(storyDir, "intake.md");
-  const attachmentsDir = path12.join(storyDir, "attachments");
-  if (fs20.existsSync(intakeFile)) {
+  const storyDir = path13.join(paths.storiesDir, slug, storyFolderName);
+  const intakeFile = path13.join(storyDir, "intake.md");
+  const attachmentsDir = path13.join(storyDir, "attachments");
+  if (fs23.existsSync(intakeFile)) {
     throw new Error(
-      `Intake already exists: ${intakeFile}. Run \`squad new-plan ${path12.relative(root, intakeFile)}\` to plan it, or \`squad rm story\` to remove the story first.`
+      `Intake already exists: ${intakeFile}. Run \`squad new-plan ${path13.relative(root, intakeFile)}\` to plan it, or \`squad rm story\` to remove the story first.`
     );
   }
-  fs20.mkdirSync(attachmentsDir, { recursive: true });
+  fs23.mkdirSync(attachmentsDir, { recursive: true });
   let sourceBlock = "";
   let fetchedSummary;
   let fetchedIssue;
@@ -3259,14 +4152,14 @@ async function runNewStory(featureSlug, opts) {
     sourceBlock,
     fetchedIssue
   });
-  const relativePath = path12.relative(root, intakeFile);
-  const relAttachDir = path12.relative(root, attachmentsDir);
+  const relativePath = path13.relative(root, intakeFile);
+  const relAttachDir = path13.relative(root, attachmentsDir);
   success("Created intake");
   if (noTracker && config2.tracker.type !== "none") {
     warning("Created without a tracker link. Use `squad tracker link` later to attach one.");
   }
   kv("intake", relativePath, 11);
-  kv("attachments", relAttachDir + path12.sep, 11);
+  kv("attachments", relAttachDir + path13.sep, 11);
   if (fetchedSummary && fetchedSummary.written > 0) {
     kv("fetched", `${fetchedSummary.id} \xB7 ${fetchedSummary.written} attachments saved`, 11);
   }
@@ -3275,7 +4168,7 @@ async function runNewStory(featureSlug, opts) {
   info(`squad new-plan ${relativePath}`);
 }
 async function tryFetchIssue(config2, id, opts, paths, attachmentsDir) {
-  const secretsFromFile = fs20.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
+  const secretsFromFile = fs23.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
   const secrets = overlayTrackerEnv(secretsFromFile);
   const resolution = clientFor(config2, secrets);
   if (resolution.error) {
@@ -3332,12 +4225,12 @@ function truncate(s, n) {
 }
 
 // src/commands/new-plan.ts
-import fs32 from "fs";
-import path24 from "path";
-import { confirm as confirm6, select as select6 } from "@inquirer/prompts";
+import fs35 from "fs";
+import path25 from "path";
+import { confirm as confirm7, select as select6 } from "@inquirer/prompts";
 
 // src/utils/clipboard.ts
-import { spawn, spawnSync } from "child_process";
+import { spawn as spawn2, spawnSync } from "child_process";
 async function copyToClipboard(text) {
   const candidates = clipboardCandidates();
   if (candidates.length === 0) {
@@ -3360,7 +4253,7 @@ function tryCopy(cmd, text) {
   return new Promise((resolve2) => {
     let child;
     try {
-      child = spawn(cmd.command, cmd.args, { stdio: ["pipe", "ignore", "pipe"] });
+      child = spawn2(cmd.command, cmd.args, { stdio: ["pipe", "ignore", "pipe"] });
     } catch (err2) {
       resolve2({ ok: false, reason: `${cmd.command} failed to spawn: ${err2.message}` });
       return;
@@ -3425,16 +4318,16 @@ function noCandidateReason() {
 }
 
 // src/planner/loop.ts
-import path20 from "path";
-import fs28 from "fs";
+import path21 from "path";
+import fs31 from "fs";
 import { APICallError as APICallError3 } from "ai";
 
 // src/planner/tools/index.ts
 import { randomUUID } from "crypto";
 
 // src/planner/tools/read-file.ts
-import fs21 from "fs";
-import path13 from "path";
+import fs24 from "fs";
+import path14 from "path";
 import { tool } from "ai";
 import { z } from "zod";
 var MAX_BYTES_PER_FULL_READ = 32e3;
@@ -3469,15 +4362,15 @@ function readFileTool(root, budget, input5) {
   if (offset === void 0 !== (limit === void 0)) {
     return err("read_file: pass both offset and limit for a ranged read, or neither for a full read.");
   }
-  const resolved = path13.resolve(root, raw);
-  const relCheck = path13.relative(root, resolved);
-  if (relCheck.startsWith("..") || path13.isAbsolute(relCheck)) {
+  const resolved = path14.resolve(root, raw);
+  const relCheck = path14.relative(root, resolved);
+  if (relCheck.startsWith("..") || path14.isAbsolute(relCheck)) {
     return err(`read_file: path "${raw}" escapes the project root and was refused.`);
   }
-  if (!fs21.existsSync(resolved)) {
+  if (!fs24.existsSync(resolved)) {
     return err(`read_file: not found "${raw}".`);
   }
-  const stat = fs21.statSync(resolved);
+  const stat = fs24.statSync(resolved);
   if (stat.isDirectory()) {
     return err(`read_file: "${raw}" is a directory. Ask for a specific file path.`);
   }
@@ -3495,7 +4388,7 @@ function readFileTool(root, budget, input5) {
   }
   let buf;
   try {
-    buf = fs21.readFileSync(resolved);
+    buf = fs24.readFileSync(resolved);
   } catch (e) {
     return err(`read_file: failed to read "${raw}" (${e.message}).`);
   }
@@ -3518,7 +4411,7 @@ function readFileRanged(resolved, rawRel, budget, fileSize, offset, limit) {
   }
   let data;
   try {
-    data = fs21.readFileSync(resolved);
+    data = fs24.readFileSync(resolved);
   } catch (e) {
     return err(`read_file: failed to read "${rawRel}" (${e.message}).`);
   }
@@ -3574,14 +4467,14 @@ function looksBinary(buf) {
 }
 
 // src/planner/tools/grep.ts
-import fs23 from "fs";
-import path15 from "path";
+import fs26 from "fs";
+import path16 from "path";
 import { tool as tool2 } from "ai";
 import { z as z2 } from "zod";
 
 // src/core/repo-map.ts
-import fs22 from "fs";
-import path14 from "path";
+import fs25 from "fs";
+import path15 from "path";
 import ignore from "ignore";
 var DEFAULT_IGNORES = [
   "node_modules",
@@ -3597,10 +4490,10 @@ var DEFAULT_IGNORES = [
 ];
 function buildRepoIgnore(root) {
   const ig = ignore().add(DEFAULT_IGNORES);
-  const gitignore = path14.join(root, ".gitignore");
-  if (fs22.existsSync(gitignore)) {
+  const gitignore = path15.join(root, ".gitignore");
+  if (fs25.existsSync(gitignore)) {
     try {
-      ig.add(fs22.readFileSync(gitignore, "utf8"));
+      ig.add(fs25.readFileSync(gitignore, "utf8"));
     } catch {
     }
   }
@@ -3656,7 +4549,7 @@ function renderDirTree(name, tree, depth) {
 function renderRepoTree(entries) {
   const root = { files: [], dirs: /* @__PURE__ */ new Map() };
   for (const e of entries) {
-    const parts = e.rel.split(path14.sep).filter(Boolean);
+    const parts = e.rel.split(path15.sep).filter(Boolean);
     if (parts.length === 0) continue;
     insertTree(root, parts, e.size);
   }
@@ -3666,26 +4559,26 @@ function collectFileEntries(root, dir, ig, out, max, includeHidden) {
   if (out.length >= max) return out;
   let dirents;
   try {
-    dirents = fs22.readdirSync(dir, { withFileTypes: true });
+    dirents = fs25.readdirSync(dir, { withFileTypes: true });
   } catch {
     return out;
   }
   for (const entry of dirents) {
     if (out.length >= max) break;
     if (!includeHidden && entry.name.startsWith(".") && entry.name !== ".squad") continue;
-    const abs = path14.join(dir, entry.name);
-    const rel = path14.relative(root, abs);
+    const abs = path15.join(dir, entry.name);
+    const rel = path15.relative(root, abs);
     if (!rel || ig.ignores(rel) || entry.isDirectory() && ig.ignores(rel + "/")) continue;
     if (entry.isDirectory()) {
       collectFileEntries(root, abs, ig, out, max, includeHidden);
     } else if (entry.isFile()) {
       let size = 0;
       try {
-        size = fs22.statSync(abs).size;
+        size = fs25.statSync(abs).size;
       } catch {
         size = 0;
       }
-      out.push({ rel: rel.split(path14.sep).join("/"), size });
+      out.push({ rel: rel.split(path15.sep).join("/"), size });
     }
   }
   return out;
@@ -3694,20 +4587,20 @@ function walkFlat(root, dir, ig, out, max, includeHidden) {
   if (out.length >= max) return;
   let entries;
   try {
-    entries = fs22.readdirSync(dir, { withFileTypes: true });
+    entries = fs25.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
     if (out.length >= max) return;
     if (!includeHidden && entry.name.startsWith(".") && entry.name !== ".squad") continue;
-    const abs = path14.join(dir, entry.name);
-    const rel = path14.relative(root, abs);
+    const abs = path15.join(dir, entry.name);
+    const rel = path15.relative(root, abs);
     if (!rel || ig.ignores(rel) || entry.isDirectory() && ig.ignores(rel + "/")) continue;
     if (entry.isDirectory()) {
       walkFlat(root, abs, ig, out, max, includeHidden);
     } else if (entry.isFile()) {
-      out.push(rel.split(path14.sep).join("/"));
+      out.push(rel.split(path15.sep).join("/"));
     }
   }
 }
@@ -3743,12 +4636,12 @@ function runGrep(root, budget, args) {
     return { content: `grep: invalid pattern (${e.message}).`, isError: true };
   }
   const ig = buildRepoIgnore(root);
-  const scopeRoot = args.path?.trim() ? path15.resolve(root, args.path) : root;
-  const relScope = path15.relative(root, scopeRoot);
-  if (relScope.startsWith("..") || path15.isAbsolute(relScope)) {
+  const scopeRoot = args.path?.trim() ? path16.resolve(root, args.path) : root;
+  const relScope = path16.relative(root, scopeRoot);
+  if (relScope.startsWith("..") || path16.isAbsolute(relScope)) {
     return { content: `grep: scope path escapes the project root and was refused.`, isError: true };
   }
-  if (!fs23.existsSync(scopeRoot)) {
+  if (!fs26.existsSync(scopeRoot)) {
     return { content: `grep: scope path not found "${args.path}".`, isError: true };
   }
   const matches = [];
@@ -3756,28 +4649,28 @@ function runGrep(root, budget, args) {
     if (matches.length >= MAX_GREP_MATCHES) return;
     let entries;
     try {
-      entries = fs23.readdirSync(dir, { withFileTypes: true });
+      entries = fs26.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (matches.length >= MAX_GREP_MATCHES) return;
-      const abs = path15.join(dir, entry.name);
-      const rel = path15.relative(root, abs).split(path15.sep).join("/");
+      const abs = path16.join(dir, entry.name);
+      const rel = path16.relative(root, abs).split(path16.sep).join("/");
       if (!rel || ig.ignores(rel) || entry.isDirectory() && ig.ignores(rel + "/")) continue;
       if (entry.isDirectory()) {
         walk2(abs);
       } else if (entry.isFile()) {
         let st;
         try {
-          st = fs23.statSync(abs);
+          st = fs26.statSync(abs);
         } catch {
           continue;
         }
         if (st.size > MAX_GREP_FILE_SIZE_BYTES) continue;
         let buf;
         try {
-          buf = fs23.readFileSync(abs);
+          buf = fs26.readFileSync(abs);
         } catch {
           continue;
         }
@@ -3796,14 +4689,14 @@ function runGrep(root, budget, args) {
       }
     }
   };
-  if (fs23.statSync(scopeRoot).isFile()) {
-    const rel = path15.relative(root, scopeRoot).split(path15.sep).join("/");
+  if (fs26.statSync(scopeRoot).isFile()) {
+    const rel = path16.relative(root, scopeRoot).split(path16.sep).join("/");
     if (ig.ignores(rel)) {
       return { content: `grep: file is ignored by repository filters.`, isError: true };
     }
     let st;
     try {
-      st = fs23.statSync(scopeRoot);
+      st = fs26.statSync(scopeRoot);
     } catch {
       return { content: `grep: not found.`, isError: true };
     }
@@ -3812,7 +4705,7 @@ function runGrep(root, budget, args) {
     }
     let buf;
     try {
-      buf = fs23.readFileSync(scopeRoot);
+      buf = fs26.readFileSync(scopeRoot);
     } catch (e) {
       return { content: `grep: failed to read (${e.message}).`, isError: true };
     }
@@ -3846,8 +4739,8 @@ ${matches.join("\n")}` : `No matches found for "${args.pattern}".`;
 }
 
 // src/planner/tools/list-dir.ts
-import fs24 from "fs";
-import path16 from "path";
+import fs27 from "fs";
+import path17 from "path";
 import { tool as tool3 } from "ai";
 import { z as z3 } from "zod";
 var MAX_ENTRIES_PER_LIST = 200;
@@ -3865,44 +4758,44 @@ function runListDir(root, budget, rawPath) {
     };
   }
   const normalized = rawPath.trim() === "" ? "." : rawPath.trim();
-  const resolved = path16.resolve(root, normalized);
-  const relCheck = path16.relative(root, resolved);
-  if (relCheck.startsWith("..") || path16.isAbsolute(relCheck)) {
+  const resolved = path17.resolve(root, normalized);
+  const relCheck = path17.relative(root, resolved);
+  if (relCheck.startsWith("..") || path17.isAbsolute(relCheck)) {
     return {
       content: `list_dir: path "${rawPath}" escapes the project root and was refused.`,
       isError: true
     };
   }
-  const relNorm = relCheck.split(path16.sep).join("/");
+  const relNorm = relCheck.split(path17.sep).join("/");
   const ig = buildRepoIgnore(root);
   if (relNorm && (ig.ignores(relNorm) || ig.ignores(`${relNorm}/`))) {
     return { content: "list_dir: (directory ignored by repo-map filter)", isError: true };
   }
-  if (!fs24.existsSync(resolved)) {
+  if (!fs27.existsSync(resolved)) {
     return { content: `list_dir: not found "${rawPath}".`, isError: true };
   }
-  const st = fs24.statSync(resolved);
+  const st = fs27.statSync(resolved);
   if (!st.isDirectory()) {
     return { content: `list_dir: "${rawPath}" is not a directory.`, isError: true };
   }
   let dirents;
   try {
-    dirents = fs24.readdirSync(resolved, { withFileTypes: true });
+    dirents = fs27.readdirSync(resolved, { withFileTypes: true });
   } catch (e) {
     return { content: `list_dir: failed to read (${e.message}).`, isError: true };
   }
   const rows = [];
   for (const d of dirents) {
     if (rows.length >= MAX_ENTRIES_PER_LIST) break;
-    const childAbs = path16.join(resolved, d.name);
-    const childRel = path16.relative(root, childAbs).split(path16.sep).join("/");
+    const childAbs = path17.join(resolved, d.name);
+    const childRel = path17.relative(root, childAbs).split(path17.sep).join("/");
     if (childRel && (ig.ignores(childRel) || d.isDirectory() && ig.ignores(`${childRel}/`))) continue;
     if (d.isDirectory()) {
       rows.push({ type: "d", name: d.name + "/", size: null });
     } else if (d.isFile()) {
       let size = 0;
       try {
-        size = fs24.statSync(childAbs).size;
+        size = fs27.statSync(childAbs).size;
       } catch {
         size = 0;
       }
@@ -4181,96 +5074,9 @@ function vercelToolsFromDefinitions(defs) {
   return out;
 }
 
-// src/planner/provider-errors.ts
-function detectModelNotFound(provider, model, status, rawBody) {
-  if (status !== 404) return void 0;
-  const body = rawBody.toLowerCase();
-  const hints = ["not_found_error", "model_not_found", "not_found", "model:"];
-  if (!hints.some((h) => body.includes(h))) return void 0;
-  return { provider, model, status, rawBody };
-}
-function modelNotFoundMessage(err2) {
-  return [
-    `The ${err2.provider} planner model "${err2.model}" is no longer available.`,
-    "",
-    "Recovery options:",
-    `  1. Run \`squad upgrade\` to install a newer squad-kit (or install manually from npm).`,
-    `  2. Run \`squad config set planner --provider openai\` (or another \`--provider\`) to switch models via a different provider, then save a key when prompted.`,
-    `  3. Run \`squad config set planner\` to set \`planner.modelOverride.${err2.provider}\` to a still-valid id (no raw YAML), then \`squad doctor\` to confirm.`,
-    "",
-    `Raw provider response: ${err2.rawBody.slice(0, 200)}`
-  ].join("\n");
-}
-function detectRateLimit(provider, status, headers, rawBody) {
-  if (status !== 429) return void 0;
-  return {
-    provider,
-    status: 429,
-    retryAfterSec: parseRetryAfter(headers, rawBody),
-    rawBody
-  };
-}
-function parseRetryAfterSec(headers) {
-  const raw = headerGet(headers, "retry-after");
-  if (!raw) return void 0;
-  const sec = Number(raw);
-  if (Number.isFinite(sec) && sec >= 0) return Math.ceil(sec);
-  const asDate = Date.parse(raw);
-  if (Number.isFinite(asDate)) {
-    return Math.max(0, Math.ceil((asDate - Date.now()) / 1e3));
-  }
-  return void 0;
-}
-function parseRetryAfter(headers, body) {
-  const fromHeader = parseRetryAfterSec(headers);
-  if (fromHeader !== void 0) return fromHeader;
-  const bodyMatch = /"retryDelay"\s*:\s*"(\d+)(?:\.\d+)?s"/i.exec(body);
-  if (bodyMatch) {
-    const sec = Number(bodyMatch[1]);
-    if (Number.isFinite(sec) && sec >= 0) return sec;
-  }
-  return void 0;
-}
-function headerGet(h, name) {
-  if (typeof h.get === "function") {
-    return h.get(name);
-  }
-  const key = name.toLowerCase();
-  const rec = h;
-  for (const k of Object.keys(rec)) {
-    if (k.toLowerCase() === key) return rec[k] ?? null;
-  }
-  return null;
-}
-function rateLimitMessage(err2) {
-  const waitHint = err2.retryAfterSec ?? 60;
-  const limitsUrl = {
-    anthropic: "https://console.anthropic.com/settings/limits",
-    openai: "https://platform.openai.com/settings/organization/limits",
-    google: "https://aistudio.google.com/app/plan_information"
-  };
-  const headline = err2.retryAfterSec ? `${err2.provider} rate limit hit \u2014 provider asked us to wait ${err2.retryAfterSec}s before retrying.` : `${err2.provider} rate limit hit.`;
-  const cap = err2.maxRetrySec ?? 90;
-  const retried = err2.retrySkippedReason === "retry_after_too_long" ? `squad-kit did not auto-retry: the provider's ${err2.retryAfterSec}s wait is longer than our ${cap}s cap, so retrying would just burn another request inside the same throttle window.` : err2.retryAlreadyAttempted ? "squad-kit already retried once automatically and was throttled again \u2014 your org is firmly over its per-minute quota." : "squad-kit aborted before retrying.";
-  return [
-    headline,
-    retried,
-    "",
-    "Recovery options:",
-    `  1. Wait ${waitHint}s and rerun \`squad new-plan --api\`. Per-minute limits reset quickly.`,
-    `  2. Switch to a smaller planner model: \`squad config set planner\` (pick a cheaper model id).`,
-    `  3. Tighten \`planner.budget\` in \`.squad/config.yaml\` (smaller \`maxContextBytes\` / \`maxFileReads\`) so each request carries fewer tokens.`,
-    `  4. Upgrade your ${err2.provider} tier: ${limitsUrl[err2.provider]}.`,
-    "",
-    "Full runbook: docs/migrating-from-0.1.md (see \xA78. If something goes wrong).",
-    "",
-    `Raw provider response: ${err2.rawBody.slice(0, 200)}`
-  ].join("\n");
-}
-
 // src/core/runs.ts
-import fs26 from "fs/promises";
-import path18 from "path";
+import fs29 from "fs/promises";
+import path19 from "path";
 import { randomBytes } from "crypto";
 
 // src/core/run-retention.ts
@@ -4278,9 +5084,9 @@ var RUN_HISTORY_RING_SIZE = 20;
 var RUN_EVENT_JSONL_UNCOMPRESSED_HEAD = 5;
 
 // src/core/run-events-store.ts
-import fs25, { createWriteStream } from "fs";
+import fs28, { createWriteStream } from "fs";
 import fsPromises from "fs/promises";
-import path17 from "path";
+import path18 from "path";
 import readline from "readline";
 import { pipeline } from "stream/promises";
 import zlib from "zlib";
@@ -4288,10 +5094,14 @@ var SUFFIX_JSONL = ".events.jsonl";
 var SUFFIX_GZ = ".events.jsonl.gz";
 function redactPlannerEventForDisk(e) {
   if (e.kind === "thinking_delta") return { ...e, delta: "" };
+  if (e.kind === "auth_info") {
+    const { account: _account, ...rest } = e;
+    return rest;
+  }
   return e;
 }
 function runsDir(paths) {
-  return path17.join(paths.squadDir, "runs");
+  return path18.join(paths.squadDir, "runs");
 }
 function logAppendErrorOnce(err2) {
   console.error("[run-events-store] append failed:", err2);
@@ -4348,8 +5158,8 @@ var RunEventsStoreImpl = class {
 };
 function createRunEventsStore(paths, runId) {
   const dir = runsDir(paths);
-  fs25.mkdirSync(dir, { recursive: true });
-  const file = path17.join(dir, `${runId}${SUFFIX_JSONL}`);
+  fs28.mkdirSync(dir, { recursive: true });
+  const file = path18.join(dir, `${runId}${SUFFIX_JSONL}`);
   return new RunEventsStoreImpl(file);
 }
 var RunEventsReaderImpl = class {
@@ -4374,7 +5184,7 @@ var RunEventsReaderImpl = class {
     const limit = opts?.limit ?? Number.POSITIVE_INFINITY;
     let logical = 0;
     let yielded = 0;
-    const stream = fs25.createReadStream(this.filePath);
+    const stream = fs28.createReadStream(this.filePath);
     const input5 = this.useGunzip ? stream.pipe(zlib.createGunzip()) : stream;
     const rl = readline.createInterface({ input: input5, crlfDelay: Infinity });
     try {
@@ -4402,8 +5212,8 @@ var RunEventsReaderImpl = class {
 };
 async function openRunEventsReader(paths, runId) {
   const dir = runsDir(paths);
-  const jsonl = path17.join(dir, `${runId}${SUFFIX_JSONL}`);
-  const gz = path17.join(dir, `${runId}${SUFFIX_GZ}`);
+  const jsonl = path18.join(dir, `${runId}${SUFFIX_JSONL}`);
+  const gz = path18.join(dir, `${runId}${SUFFIX_GZ}`);
   let jsonlStat = null;
   let gzStat = null;
   try {
@@ -4435,10 +5245,10 @@ function collectEventLogs(dir, names) {
       kind = "jsonl";
     }
     if (!runId || !kind) continue;
-    const full = path17.join(dir, name);
+    const full = path18.join(dir, name);
     let st;
     try {
-      st = { mtimeMs: fs25.statSync(full).mtimeMs };
+      st = { mtimeMs: fs28.statSync(full).mtimeMs };
     } catch {
       continue;
     }
@@ -4466,7 +5276,7 @@ async function fsyncFile(filePath) {
 async function gzipAtomic(jsonlPath, gzPath) {
   const gzTmp = `${gzPath}.tmp`;
   await fsPromises.rm(gzTmp, { force: true });
-  await pipeline(fs25.createReadStream(jsonlPath), zlib.createGzip(), fs25.createWriteStream(gzTmp));
+  await pipeline(fs28.createReadStream(jsonlPath), zlib.createGzip(), fs28.createWriteStream(gzTmp));
   await fsyncFile(gzTmp);
   await fsPromises.rename(gzTmp, gzPath);
   await fsPromises.unlink(jsonlPath);
@@ -4481,14 +5291,14 @@ async function rotateRunEventsUnlocked(paths) {
   }
   for (const name of names) {
     if (name.endsWith(`${SUFFIX_GZ}.tmp`)) {
-      await fsPromises.rm(path17.join(dir, name), { force: true });
+      await fsPromises.rm(path18.join(dir, name), { force: true });
     }
   }
   names = await fsPromises.readdir(dir);
   const ordered = collectEventLogs(dir, names);
   for (let i = RUN_HISTORY_RING_SIZE; i < ordered.length; i++) {
     const e = ordered[i];
-    const summary = path17.join(dir, `${e.runId}.json`);
+    const summary = path18.join(dir, `${e.runId}.json`);
     await fsPromises.rm(summary, { force: true });
     if (e.jsonlPath) await fsPromises.rm(e.jsonlPath, { force: true });
     if (e.gzPath) await fsPromises.rm(e.gzPath, { force: true });
@@ -4498,7 +5308,7 @@ async function rotateRunEventsUnlocked(paths) {
     const e = keep[i];
     const jsonl = e.jsonlPath;
     if (!jsonl) continue;
-    const gz = path17.join(dir, `${e.runId}${SUFFIX_GZ}`);
+    const gz = path18.join(dir, `${e.runId}${SUFFIX_GZ}`);
     await gzipAtomic(jsonl, gz);
   }
 }
@@ -4515,34 +5325,34 @@ function newRunId() {
   return `${ts}-${rnd}`;
 }
 async function pruneOldRuns(paths) {
-  const dir = path18.join(paths.squadDir, "runs");
-  const entries = (await fs26.readdir(dir)).filter((n) => n.endsWith(".json"));
+  const dir = path19.join(paths.squadDir, "runs");
+  const entries = (await fs29.readdir(dir)).filter((n) => n.endsWith(".json"));
   if (entries.length <= RUN_HISTORY_RING_SIZE) return;
   entries.sort();
   const drop = entries.slice(0, entries.length - RUN_HISTORY_RING_SIZE);
   await Promise.all(
     drop.map(async (n) => {
-      const runPath = path18.join(dir, n);
+      const runPath = path19.join(dir, n);
       const runId = n.replace(/\.json$/u, "");
-      await fs26.rm(runPath, { force: true });
-      await fs26.rm(path18.join(dir, `${runId}.events.jsonl`), { force: true });
-      await fs26.rm(path18.join(dir, `${runId}.events.jsonl.gz`), { force: true });
+      await fs29.rm(runPath, { force: true });
+      await fs29.rm(path19.join(dir, `${runId}.events.jsonl`), { force: true });
+      await fs29.rm(path19.join(dir, `${runId}.events.jsonl.gz`), { force: true });
     })
   );
 }
 async function appendRun(paths, rec) {
-  const dir = path18.join(paths.squadDir, "runs");
-  await fs26.mkdir(dir, { recursive: true });
-  const file = path18.join(dir, `${rec.runId}.json`);
-  await fs26.writeFile(file, JSON.stringify({ ...rec, version: 1 }, null, 2) + "\n", "utf8");
+  const dir = path19.join(paths.squadDir, "runs");
+  await fs29.mkdir(dir, { recursive: true });
+  const file = path19.join(dir, `${rec.runId}.json`);
+  await fs29.writeFile(file, JSON.stringify({ ...rec, version: 1 }, null, 2) + "\n", "utf8");
   await pruneOldRuns(paths);
   await rotateRunEvents(paths);
 }
 async function listRuns(paths) {
-  const dir = path18.join(paths.squadDir, "runs");
+  const dir = path19.join(paths.squadDir, "runs");
   let entries;
   try {
-    entries = await fs26.readdir(dir);
+    entries = await fs29.readdir(dir);
   } catch {
     return [];
   }
@@ -4550,7 +5360,7 @@ async function listRuns(paths) {
   const out = [];
   for (const f of files) {
     try {
-      const raw = await fs26.readFile(path18.join(dir, f), "utf8");
+      const raw = await fs29.readFile(path19.join(dir, f), "utf8");
       const parsed = JSON.parse(raw);
       if (parsed.version === 1) out.push(parsed);
     } catch {
@@ -4887,6 +5697,11 @@ var VercelRuntime = class {
     if (typeof apiKeyOrModel !== "string") {
       throw new Error("VercelRuntime: apiKey must be a string unless injectModel is true");
     }
+    if (!apiKeyOrModel) {
+      throw new Error(
+        `VercelRuntime: a non-empty ${provider} API key is required. Run \`squad config set planner\` to save one.`
+      );
+    }
     this.languageModel = resolveModel(provider, modelId, apiKeyOrModel).model;
   }
   async runScout(input5) {
@@ -5339,8 +6154,8 @@ async function runScout(input5) {
 }
 
 // src/planner/validation.ts
-import fs27 from "fs";
-import path19 from "path";
+import fs30 from "fs";
+import path20 from "path";
 var CODE_EXT = /\.(ts|tsx|js|jsx|mjs|cjs|md|json|ya?ml|css|html|py|go|rs|cs|java|kt|kts|swift|rb|php|vue|svelte)$/i;
 function summariseIssuesByKind(issues) {
   const out = {};
@@ -5410,21 +6225,21 @@ function trigramSimilarity(a, b) {
   return inter / Math.sqrt(A.size * B.size);
 }
 function suggestPaths(root, missingRel, max = 3) {
-  const targetBase = path19.basename(missingRel).toLowerCase();
+  const targetBase = path20.basename(missingRel).toLowerCase();
   const ig = buildRepoIgnore(root);
   const candidates = [];
   const walk2 = (dir) => {
     if (candidates.length >= 2e3) return;
     let ents;
     try {
-      ents = fs27.readdirSync(dir, { withFileTypes: true });
+      ents = fs30.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const ent of ents) {
       if (candidates.length >= 2e3) return;
-      const abs = path19.join(dir, ent.name);
-      const rel = path19.relative(root, abs).split(path19.sep).join("/");
+      const abs = path20.join(dir, ent.name);
+      const rel = path20.relative(root, abs).split(path20.sep).join("/");
       if (!rel || ig.ignores(rel) || ent.isDirectory() && ig.ignores(`${rel}/`)) continue;
       if (ent.isDirectory()) walk2(abs);
       else if (ent.isFile()) candidates.push(rel);
@@ -5433,7 +6248,7 @@ function suggestPaths(root, missingRel, max = 3) {
   walk2(root);
   const rows = [];
   for (const rel of candidates) {
-    const base = path19.basename(rel).toLowerCase();
+    const base = path20.basename(rel).toLowerCase();
     let score = 0;
     if (base === targetBase) score = 1e3;
     else if (base.startsWith(targetBase) || targetBase.startsWith(base)) score = 500;
@@ -5511,12 +6326,12 @@ function validatePlan(input5) {
   const cache = /* @__PURE__ */ new Map();
   const readCached = (rel) => {
     if (cache.has(rel)) return cache.get(rel);
-    const resolved = path19.resolve(input5.root, rel);
-    const rc = path19.relative(input5.root, resolved);
-    if (rc.startsWith("..") || path19.isAbsolute(rc)) return void 0;
-    if (!fs27.existsSync(resolved) || !fs27.statSync(resolved).isFile()) return void 0;
+    const resolved = path20.resolve(input5.root, rel);
+    const rc = path20.relative(input5.root, resolved);
+    if (rc.startsWith("..") || path20.isAbsolute(rc)) return void 0;
+    if (!fs30.existsSync(resolved) || !fs30.statSync(resolved).isFile()) return void 0;
     try {
-      const buf = fs27.readFileSync(resolved);
+      const buf = fs30.readFileSync(resolved);
       const isBinary = buf.includes(0);
       const text = isBinary ? "" : buf.toString("utf8");
       const lines = isBinary ? 0 : text.split(/\r?\n/).length;
@@ -5530,10 +6345,10 @@ function validatePlan(input5) {
   const pathClaims = mergePathClaims(input5.planText);
   for (const c of pathClaims) {
     if (c.isCreate) continue;
-    const resolved = path19.resolve(input5.root, c.path);
-    const rel = path19.relative(input5.root, resolved);
-    if (rel.startsWith("..") || path19.isAbsolute(rel)) continue;
-    if (!fs27.existsSync(resolved)) {
+    const resolved = path20.resolve(input5.root, c.path);
+    const rel = path20.relative(input5.root, resolved);
+    if (rel.startsWith("..") || path20.isAbsolute(rel)) continue;
+    if (!fs30.existsSync(resolved)) {
       const suggestions = suggestPaths(input5.root, c.path);
       issues.push({
         severity: "warning",
@@ -5553,8 +6368,8 @@ function validatePlan(input5) {
     if (!Number.isFinite(lo) || !Number.isFinite(hi)) continue;
     const filePath = pathNear(rangeText, rm2.index);
     if (!filePath) continue;
-    const cached = readCached(filePath);
-    const lines = cached?.isBinary ? void 0 : cached?.lines;
+    const cached2 = readCached(filePath);
+    const lines = cached2?.isBinary ? void 0 : cached2?.lines;
     if (lines !== void 0 && hi > lines) {
       issues.push({
         severity: "warning",
@@ -5571,8 +6386,8 @@ function validatePlan(input5) {
     if (!Number.isFinite(n)) continue;
     const filePath = pathNear(rangeText, rm2.index);
     if (!filePath) continue;
-    const cached = readCached(filePath);
-    const lines = cached?.isBinary ? void 0 : cached?.lines;
+    const cached2 = readCached(filePath);
+    const lines = cached2?.isBinary ? void 0 : cached2?.lines;
     if (lines !== void 0 && n > lines) {
       issues.push({
         severity: "warning",
@@ -5588,8 +6403,8 @@ function validatePlan(input5) {
     const fp = rm2[1].trim().replace(/^\.\//, "");
     const n = parseInt(rm2[2], 10);
     if (!Number.isFinite(n)) continue;
-    const cached = readCached(fp);
-    const lines = cached?.isBinary ? void 0 : cached?.lines;
+    const cached2 = readCached(fp);
+    const lines = cached2?.isBinary ? void 0 : cached2?.lines;
     if (lines !== void 0 && n > lines) {
       issues.push({
         severity: "warning",
@@ -5607,8 +6422,8 @@ function validatePlan(input5) {
     const pathNearCell = near.match(/`([^`\n/]+\/[^`\n]+?\.[a-z0-9]{1,6})`/i);
     if (!pathNearCell) continue;
     const fp = pathNearCell[1].replace(/^\.\//, "");
-    const cached = readCached(fp);
-    if (!cached || cached.isBinary) continue;
+    const cached2 = readCached(fp);
+    if (!cached2 || cached2.isBinary) continue;
     const symRe = /`([A-Za-z_][A-Za-z0-9_]{2,50})`/g;
     let sm;
     while ((sm = symRe.exec(line2)) !== null) {
@@ -5618,8 +6433,8 @@ function validatePlan(input5) {
       )) {
         continue;
       }
-      if (!cached.text.includes(sym)) {
-        const suggestions = suggestSymbols(cached.text, sym);
+      if (!cached2.text.includes(sym)) {
+        const suggestions = suggestSymbols(cached2.text, sym);
         issues.push({
           severity: "warning",
           kind: "symbol_not_found",
@@ -5700,9 +6515,9 @@ ${result.content}
       }
       continue;
     }
-    const resolved = path20.resolve(root, cleaned);
-    const rc = path20.relative(root, resolved);
-    if (rc.startsWith("..") || path20.isAbsolute(rc)) {
+    const resolved = path21.resolve(root, cleaned);
+    const rc = path21.relative(root, resolved);
+    if (rc.startsWith("..") || path21.isAbsolute(rc)) {
       bus.emit({
         kind: "validation_issue",
         runId,
@@ -5713,7 +6528,7 @@ ${result.content}
       });
       continue;
     }
-    if (!fs28.existsSync(resolved)) {
+    if (!fs31.existsSync(resolved)) {
       bus.emit({
         kind: "validation_issue",
         runId,
@@ -5724,7 +6539,7 @@ ${result.content}
       });
       continue;
     }
-    const st = fs28.statSync(resolved);
+    const st = fs31.statSync(resolved);
     if (!st.isFile()) continue;
     const n = Math.min(st.size, MAX_BYTES_PER_FULL_READ);
     const cap = budget.canRead(n);
@@ -5738,7 +6553,7 @@ _(skipped: ${cap.reason})_
     }
     let buf;
     try {
-      buf = fs28.readFileSync(resolved);
+      buf = fs31.readFileSync(resolved);
     } catch {
       continue;
     }
@@ -5931,6 +6746,9 @@ async function runPlanner(input5) {
       }
     } : void 0
   });
+  if (input5.auth) {
+    bus.emit({ kind: "auth_info", runId, ...describeAuth(input5.auth) });
+  }
   const merged = { ...input5, events: bus, runId };
   const systemPrompt = input5.systemPrompt;
   let scoutSummary;
@@ -6071,8 +6889,16 @@ async function runPlanner(input5) {
 }
 
 // src/planner/planner-limit-messages.ts
-function printPlannerApiCostNotice() {
+function printPlannerApiCostNotice(authMode = "api-key") {
   blank();
+  if (authMode === "subscription") {
+    step("Usage");
+    info(
+      "`squad new-plan --api` runs on your Claude subscription \u2014 there is no per-token API bill. Agent SDK usage draws on the same usage limits as Claude and Claude Code, so a long planning run consumes part of your window. Hitting the limit means waiting for the reset, not a larger invoice."
+    );
+    blank();
+    return;
+  }
   step("Billing");
   info(
     "`squad new-plan --api` sends your intake and repo context to the configured provider. Each model round is billed like any other API usage (input tokens, output tokens, and cache-related tokens when applicable). Choosing \u201CContinue\u201D after a limit runs more rounds and usually increases cost."
@@ -6095,12 +6921,12 @@ function tokenSummary(ctx) {
   const snap = ctx.budgetSnapshot;
   return `Tokens so far: ${snap.usage.inputTokens} in / ${snap.usage.outputTokens} out for this session.`;
 }
-function kindDetail(ctx) {
+function kindDetail(ctx, authMode) {
   switch (ctx.kind) {
     case "max_output_tokens":
       return [
         `The model hit the per-request output cap (${ctx.maxOutputTokens} completion tokens). Long plans can stop mid-markdown even though the session is otherwise healthy.`,
-        "You can continue: squad-kit will ask the model to append the rest of the plan in a follow-up request (extra tokens apply).",
+        "You can continue: squad-kit will ask the model to append the rest of the plan in a follow-up request " + (authMode === "subscription" ? "(it draws further on your Claude usage limits)." : "(extra tokens apply)."),
         tokenSummary(ctx)
       ];
     case "max_iterations":
@@ -6123,9 +6949,9 @@ function kindDetail(ctx) {
       ];
   }
 }
-function printPlannerLimitExplanation(ctx) {
+function printPlannerLimitExplanation(ctx, authMode = "api-key") {
   warning(kindTitle(ctx.kind));
-  for (const line2 of kindDetail(ctx)) {
+  for (const line2 of kindDetail(ctx, authMode)) {
     info(line2);
   }
   kv("session so far", `${snapSummary(ctx)}`, 18);
@@ -6176,6 +7002,23 @@ function thinkingConfigFromProviderSpecific(ps) {
 }
 
 // src/planner/runtimes/agent-sdk-runtime.ts
+var ACCOUNT_INFO_TIMEOUT_MS = 2e3;
+var MAX_RATE_LIMIT_RETRY_SEC2 = 90;
+var enrichedAuthInfoRuns = /* @__PURE__ */ new WeakMap();
+function markAuthInfoEmitted(bus, runId) {
+  let seen = enrichedAuthInfoRuns.get(bus);
+  if (!seen) {
+    seen = /* @__PURE__ */ new Set();
+    enrichedAuthInfoRuns.set(bus, seen);
+  }
+  if (seen.has(runId)) return false;
+  seen.add(runId);
+  return true;
+}
+var API_KEY_SOURCES = ["user", "project", "org", "temporary", "oauth"];
+function asApiKeySource(v) {
+  return API_KEY_SOURCES.find((s) => s === v);
+}
 var BUILTIN_TOOL_DENY = [
   "Read",
   "Write",
@@ -6347,15 +7190,96 @@ function handleDecodedStreamEvent(decoded, input5) {
     }
   }
 }
+async function readSdkAccountInfo(q) {
+  const fn = q?.accountInfo;
+  if (typeof fn !== "function") return void 0;
+  let timer;
+  try {
+    const info2 = await Promise.race([
+      fn.call(q),
+      new Promise((resolve2) => {
+        timer = setTimeout(() => resolve2(void 0), ACCOUNT_INFO_TIMEOUT_MS);
+      })
+    ]);
+    if (!info2 || typeof info2 !== "object") return void 0;
+    const o = info2;
+    const out = {};
+    if (typeof o.email === "string") out.email = o.email;
+    if (typeof o.organization === "string") out.organization = o.organization;
+    if (typeof o.subscriptionType === "string") out.subscriptionType = o.subscriptionType;
+    return Object.keys(out).length > 0 ? out : void 0;
+  } catch {
+    return void 0;
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
 var AgentSdkRuntime = class {
-  constructor(modelId, apiKey) {
+  constructor(modelId, auth2) {
     this.modelId = modelId;
-    this.apiKey = apiKey;
+    this.auth = auth2;
   }
   modelId;
-  apiKey;
+  auth;
   kind = "agent-sdk";
   providerName = "anthropic";
+  /** Safe-to-log auth projection — never carries the key or the token. */
+  authDescriptor() {
+    return describeAuth(this.auth);
+  }
+  /**
+   * Handle a `system` message. On `init` this emits the enriched `auth_info` (once per run, even
+   * though scout and draft are separate instances); on `api_retry` it forwards a rate limit through
+   * the existing 0.8.0 rate-limit channel so the console countdown and CLI spinner keep working.
+   */
+  async handleSystemMessage(m, input5, ctx) {
+    if (m.subtype === "init") {
+      const apiKeySource = asApiKeySource(m.apiKeySource);
+      if (!apiKeySource || !markAuthInfoEmitted(input5.bus, input5.runId)) return;
+      const account = ctx.withAccountInfo && this.auth.mode === "subscription" ? await readSdkAccountInfo(ctx.query) : void 0;
+      input5.bus.emit({
+        kind: "auth_info",
+        runId: input5.runId,
+        ...this.authDescriptor(),
+        apiKeySource,
+        ...account ? { account } : {}
+      });
+      return;
+    }
+    if (m.subtype === "api_retry" && detectAuthShapedSdkError(m.error) === "rate_limit") {
+      const delayMs = typeof m.retry_delay_ms === "number" ? m.retry_delay_ms : 0;
+      const waitSec = Math.max(1, Math.ceil(delayMs / 1e3));
+      input5.bus.emit({
+        kind: "rate_limit",
+        runId: input5.runId,
+        turn: ctx.turn,
+        retryAfterSec: waitSec,
+        waitSec,
+        capSec: MAX_RATE_LIMIT_RETRY_SEC2,
+        phase: "retrying",
+        provider: "anthropic"
+      });
+    }
+  }
+  /**
+   * Turn an auth-shaped SDK failure into an actionable error. Rate limits also emit the terminal
+   * `rate_limit` event so the UI closes its countdown before the throw.
+   */
+  authError(signal, input5, turn) {
+    if (signal === "rate_limit") {
+      input5.bus.emit({
+        kind: "rate_limit",
+        runId: input5.runId,
+        turn,
+        retryAfterSec: void 0,
+        waitSec: 0,
+        capSec: MAX_RATE_LIMIT_RETRY_SEC2,
+        phase: "aborted",
+        provider: "anthropic"
+      });
+    }
+    return new Error(authErrorMessage(signal, authErrorContextFrom(this.auth)));
+  }
   async runDraft(input5) {
     const { query, createSdkMcpServer, tool: tool5 } = await import("@anthropic-ai/claude-agent-sdk");
     const sdkTools = input5.tools.map(
@@ -6390,7 +7314,7 @@ var AgentSdkRuntime = class {
       persistSession: false,
       settingSources: [],
       abortController: ac,
-      env: { ...process.env, ANTHROPIC_API_KEY: this.apiKey },
+      env: buildSdkEnv(this.auth),
       thinking,
       effort
     };
@@ -6400,6 +7324,7 @@ var AgentSdkRuntime = class {
     let finishedNormally = false;
     let incompleteKind;
     let userCancelled = false;
+    let authSignal;
     const think = initialThinkingState();
     try {
       const q = query({
@@ -6421,6 +7346,7 @@ var AgentSdkRuntime = class {
             break;
           }
           case "assistant": {
+            authSignal = detectAuthShapedSdkError(m.error) ?? authSignal;
             think.blockIndexCounter = 0;
             think.inThinkingBlock = false;
             think.thinkingBlockIndex = -1;
@@ -6447,10 +7373,17 @@ var AgentSdkRuntime = class {
               finishedNormally = false;
             } else if (typeof sub === "string" && sub.startsWith("error")) {
               finishedNormally = false;
+              const signal = authSignal ?? detectAuthShapedSdkError(m.errors);
+              if (signal) throw this.authError(signal, input5, assistantTurns);
             }
             break;
           }
           case "system":
+            await this.handleSystemMessage(m, input5, {
+              query: q,
+              withAccountInfo: true,
+              turn: assistantTurns
+            });
             break;
           default:
             break;
@@ -6509,12 +7442,13 @@ var AgentSdkRuntime = class {
       includePartialMessages: true,
       persistSession: false,
       settingSources: [],
-      env: { ...process.env, ANTHROPIC_API_KEY: this.apiKey },
+      env: buildSdkEnv(this.auth),
       thinking,
       effort
     };
     let usage = { inputTokens: 0, outputTokens: 0 };
     let assistantTurns = 0;
+    let authSignal;
     const think = initialThinkingState();
     const ac = new AbortController();
     const onAbort = () => ac.abort();
@@ -6539,6 +7473,7 @@ var AgentSdkRuntime = class {
             });
             break;
           case "assistant":
+            authSignal = detectAuthShapedSdkError(m.error) ?? authSignal;
             think.blockIndexCounter = 0;
             think.inThinkingBlock = false;
             think.thinkingBlockIndex = -1;
@@ -6549,8 +7484,17 @@ var AgentSdkRuntime = class {
             usage = usageFromAgentSdkResult(
               m.usage
             );
+            if (typeof m.subtype === "string" && m.subtype.startsWith("error")) {
+              const signal = authSignal ?? detectAuthShapedSdkError(m.errors);
+              if (signal) throw this.authError(signal, input5, assistantTurns);
+            }
             break;
           case "system":
+            await this.handleSystemMessage(m, input5, {
+              query: q,
+              withAccountInfo: false,
+              turn: assistantTurns
+            });
             break;
           default:
             break;
@@ -6572,14 +7516,40 @@ var AgentSdkRuntime = class {
   }
 };
 
+// src/planner/runtimes/auth-runtime-mismatch.ts
+var SUBSCRIPTION_NEEDS_AGENT_SDK_LEAD = "Subscription auth needs the Claude Agent SDK runtime.";
+var SUBSCRIPTION_VERCEL_RUNTIME_HINT = "Remove `planner.runtime.anthropic: vercel` from .squad/config.yaml (the default is agent-sdk), or set `planner.auth.anthropic: api-key` and provide an ANTHROPIC_API_KEY.";
+function subscriptionProviderMismatchHint(provider) {
+  return `The planner provider is \`${provider}\`, which is API-key only. Switch to Anthropic with \`squad config set planner\`, or set \`planner.auth.anthropic: api-key\` and provide an ANTHROPIC_API_KEY.`;
+}
+function plannerAuthRuntimeMismatchMessage(provider) {
+  return `${SUBSCRIPTION_NEEDS_AGENT_SDK_LEAD} ${provider === "anthropic" ? SUBSCRIPTION_VERCEL_RUNTIME_HINT : subscriptionProviderMismatchHint(provider)}`;
+}
+
 // src/planner/runtimes/index.ts
+var PlannerAuthRuntimeMismatchError = class extends Error {
+  constructor(provider, runtimeChoice) {
+    super(plannerAuthRuntimeMismatchMessage(provider));
+    this.provider = provider;
+    this.runtimeChoice = runtimeChoice;
+    this.name = "PlannerAuthRuntimeMismatchError";
+  }
+  provider;
+  runtimeChoice;
+};
 function resolveRuntime(input5) {
-  if (input5.provider === "anthropic") {
-    const choice = input5.anthropicRuntime ?? "agent-sdk";
-    if (choice === "agent-sdk") return new AgentSdkRuntime(input5.modelId, input5.apiKey);
-    return new VercelRuntime("anthropic", input5.modelId, input5.apiKey);
+  const choice = input5.provider === "anthropic" ? input5.anthropicRuntime ?? "agent-sdk" : "vercel";
+  const auth2 = input5.auth;
+  if (auth2.mode === "subscription") {
+    if (input5.provider !== "anthropic" || choice !== "agent-sdk") {
+      throw new PlannerAuthRuntimeMismatchError(input5.provider, choice);
+    }
+    return new AgentSdkRuntime(input5.modelId, auth2);
+  }
+  if (input5.provider === "anthropic" && choice === "agent-sdk") {
+    return new AgentSdkRuntime(input5.modelId, auth2);
   }
-  return new VercelRuntime(input5.provider, input5.modelId, input5.apiKey);
+  return new VercelRuntime(input5.provider, input5.modelId, auth2.key);
 }
 
 // src/planner/budget.ts
@@ -6651,8 +7621,8 @@ var Budget = class {
 };
 
 // src/planner/writer.ts
-import fs29 from "fs";
-import path21 from "path";
+import fs32 from "fs";
+import path22 from "path";
 function planFileSlugParts(config2, story) {
   const baseSlug = slugify(story.id);
   const trackerId = config2.naming.includeTrackerId && config2.tracker.type !== "none" ? trackerIdForFilename(config2.tracker.type, story.id) : "";
@@ -6661,8 +7631,8 @@ function planFileSlugParts(config2, story) {
 }
 function writePlanFile(input5) {
   const { paths, config: config2, story } = input5;
-  const featurePlanDir = path21.join(paths.plansDir, story.feature);
-  fs29.mkdirSync(featurePlanDir, { recursive: true });
+  const featurePlanDir = path22.join(paths.plansDir, story.feature);
+  fs32.mkdirSync(featurePlanDir, { recursive: true });
   if (input5.partial) {
     return writePartialPlanFile(input5, featurePlanDir, paths, config2, story);
   }
@@ -6677,14 +7647,14 @@ function writePlanFile(input5) {
   } else {
     nn = scanPlans(paths.plansDir).nextGlobal;
     const { baseSlug, trackerPart } = planFileSlugParts(config2, story);
-    targetPath = path21.join(featurePlanDir, `${formatSequence(nn)}-story-${baseSlug}${trackerPart}.md`);
+    targetPath = path22.join(featurePlanDir, `${formatSequence(nn)}-story-${baseSlug}${trackerPart}.md`);
   }
   const body = `${input5.metadataHeader.trimEnd()}
 
 ${input5.planBodyMarkdown.trimStart()}
 `;
-  fs29.writeFileSync(targetPath, body, "utf8");
-  upsertOverviewRow(featurePlanDir, story.feature, nn, path21.basename(targetPath), story, false);
+  fs32.writeFileSync(targetPath, body, "utf8");
+  upsertOverviewRow(featurePlanDir, story.feature, nn, path22.basename(targetPath), story, false);
   return { planFile: targetPath, sequenceNumber: nn, overwrote };
 }
 function writePartialPlanFile(input5, featurePlanDir, paths, config2, story) {
@@ -6699,42 +7669,42 @@ function writePartialPlanFile(input5, featurePlanDir, paths, config2, story) {
   } else {
     nn = scanPlans(paths.plansDir).nextGlobal;
     const { baseSlug, trackerPart } = planFileSlugParts(config2, story);
-    targetPath = path21.join(featurePlanDir, `${formatSequence(nn)}-story-${baseSlug}${trackerPart}.partial.md`);
+    targetPath = path22.join(featurePlanDir, `${formatSequence(nn)}-story-${baseSlug}${trackerPart}.partial.md`);
   }
   const body = `${input5.metadataHeader.trimEnd()}
 
 ${input5.planBodyMarkdown.trimStart()}
 `;
-  fs29.writeFileSync(targetPath, body, "utf8");
-  upsertOverviewRow(featurePlanDir, story.feature, nn, path21.basename(targetPath), story, true);
+  fs32.writeFileSync(targetPath, body, "utf8");
+  upsertOverviewRow(featurePlanDir, story.feature, nn, path22.basename(targetPath), story, true);
   return { planFile: targetPath, sequenceNumber: nn, overwrote };
 }
 function findExistingPlan(featureDir, storyId) {
-  if (!fs29.existsSync(featureDir)) return void 0;
+  if (!fs32.existsSync(featureDir)) return void 0;
   const pattern = /^(\d{2,})-story-.+\.md$/;
-  for (const entry of fs29.readdirSync(featureDir)) {
+  for (const entry of fs32.readdirSync(featureDir)) {
     if (entry.endsWith(".partial.md")) continue;
     const m = entry.match(pattern);
     if (!m) continue;
-    if (entry.includes(storyId)) return { absPath: path21.join(featureDir, entry), nn: parseInt(m[1], 10) };
+    if (entry.includes(storyId)) return { absPath: path22.join(featureDir, entry), nn: parseInt(m[1], 10) };
   }
   return void 0;
 }
 function findExistingPartialPlan(featureDir, storyId) {
-  if (!fs29.existsSync(featureDir)) return void 0;
+  if (!fs32.existsSync(featureDir)) return void 0;
   const pattern = /^(\d{2,})-story-.+\.partial\.md$/;
-  for (const entry of fs29.readdirSync(featureDir)) {
+  for (const entry of fs32.readdirSync(featureDir)) {
     const m = entry.match(pattern);
     if (!m) continue;
-    if (entry.includes(storyId)) return { absPath: path21.join(featureDir, entry), nn: parseInt(m[1], 10) };
+    if (entry.includes(storyId)) return { absPath: path22.join(featureDir, entry), nn: parseInt(m[1], 10) };
   }
   return void 0;
 }
 function upsertOverviewRow(featureDir, feature, nn, filename, story, isPartial) {
-  const overviewPath = path21.join(featureDir, "00-overview.md");
+  const overviewPath = path22.join(featureDir, "00-overview.md");
   const titleCell = isPartial ? `${story.titleHint ?? story.id} (partial)` : story.titleHint ?? story.id;
   const row = `| ${formatSequence(nn)} | \`${filename}\` | ${titleCell} | ${story.id} | \u2014 |`;
-  if (!fs29.existsSync(overviewPath)) {
+  if (!fs32.existsSync(overviewPath)) {
     const content = `# ${feature} \u2014 plan overview
 
 Entry point for the **${feature}** feature. Stories execute in order by their \`NN\` prefix.
@@ -6745,10 +7715,10 @@ Entry point for the **${feature}** feature. Stories execute in order by their \`
 |----|------|-------|------------|------------|
 ${row}
 `;
-    fs29.writeFileSync(overviewPath, content, "utf8");
+    fs32.writeFileSync(overviewPath, content, "utf8");
     return;
   }
-  const current = fs29.readFileSync(overviewPath, "utf8");
+  const current = fs32.readFileSync(overviewPath, "utf8");
   const lines = current.split("\n");
   const existingIdx = lines.findIndex((l) => l.includes(`\`${filename}\``) || l.includes(`| ${formatSequence(nn)} |`));
   if (existingIdx >= 0) {
@@ -6757,7 +7727,7 @@ ${row}
     const tableEnd = findTableEnd(lines);
     lines.splice(tableEnd, 0, row);
   }
-  fs29.writeFileSync(overviewPath, lines.join("\n"), "utf8");
+  fs32.writeFileSync(overviewPath, lines.join("\n"), "utf8");
 }
 function findTableEnd(lines) {
   let inTable = false;
@@ -6810,16 +7780,16 @@ function buildCopyPlanPromptMarkdown(config2, intakeContent) {
 }
 
 // src/core/last-run.ts
-import fs30 from "fs/promises";
-import path22 from "path";
+import fs33 from "fs/promises";
+import path23 from "path";
 async function writeLastRun(paths, rec) {
-  const file = path22.join(paths.squadDir, ".last-run.json");
-  await fs30.writeFile(file, JSON.stringify({ ...rec, version: 1 }, null, 2) + "\n", "utf8");
+  const file = path23.join(paths.squadDir, ".last-run.json");
+  await fs33.writeFile(file, JSON.stringify({ ...rec, version: 1 }, null, 2) + "\n", "utf8");
 }
 async function readLastRun(paths) {
-  const file = path22.join(paths.squadDir, ".last-run.json");
+  const file = path23.join(paths.squadDir, ".last-run.json");
   try {
-    const raw = await fs30.readFile(file, "utf8");
+    const raw = await fs33.readFile(file, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed.version !== 1) return void 0;
     return parsed;
@@ -6852,8 +7822,8 @@ function formatPlannerCacheLine(opts) {
 }
 
 // src/core/plans-index.ts
-import fs31 from "fs";
-import path23 from "path";
+import fs34 from "fs";
+import path24 from "path";
 var MAX_ENTRIES = 30;
 function firstMarkdownH1(src) {
   const lines = src.split(/\r?\n/);
@@ -6868,12 +7838,12 @@ function collectPlanMarkdownFiles(plansDir) {
   const walk2 = (dir) => {
     let ents;
     try {
-      ents = fs31.readdirSync(dir, { withFileTypes: true });
+      ents = fs34.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const ent of ents) {
-      const abs = path23.join(dir, ent.name);
+      const abs = path24.join(dir, ent.name);
       if (ent.isDirectory()) {
         walk2(abs);
       } else if (ent.isFile() && ent.name.endsWith(".md")) {
@@ -6882,7 +7852,7 @@ function collectPlanMarkdownFiles(plansDir) {
       }
     }
   };
-  if (fs31.existsSync(plansDir)) walk2(plansDir);
+  if (fs34.existsSync(plansDir)) walk2(plansDir);
   out.sort((a, b) => a.localeCompare(b));
   return out.slice(0, MAX_ENTRIES);
 }
@@ -6891,13 +7861,13 @@ function buildPlansIndex(paths) {
   if (files.length === 0) return "(no prior plans yet)";
   const bullets = [];
   for (const abs of files) {
-    const rel = path23.relative(paths.root, abs).split(path23.sep).join("/");
+    const rel = path24.relative(paths.root, abs).split(path24.sep).join("/");
     let title = "";
     try {
-      const raw = fs31.readFileSync(abs, "utf8");
-      title = firstMarkdownH1(raw) ?? path23.basename(abs);
+      const raw = fs34.readFileSync(abs, "utf8");
+      title = firstMarkdownH1(raw) ?? path24.basename(abs);
     } catch {
-      title = path23.basename(abs);
+      title = path24.basename(abs);
     }
     bullets.push(`- ${rel} \u2014 "${title}"`);
   }
@@ -7157,9 +8127,10 @@ function decideMode(opts, config2) {
   }
   if (opts.api) return "api";
   if (opts.copy) return "copy";
-  const enabled = config2.planner?.enabled;
-  const key = enabled && config2.planner?.provider ? readProviderKey(config2.planner.provider) : void 0;
-  return enabled && key ? "api" : "copy";
+  const planner = config2.planner;
+  if (!planner?.enabled || !planner.provider) return "copy";
+  if (planner.provider === "anthropic" && planner.auth?.anthropic === "subscription") return "api";
+  return readProviderKey(planner.provider) ? "api" : "copy";
 }
 async function runNewPlan(intakePath, opts) {
   const root = requireSquadRoot();
@@ -7170,7 +8141,7 @@ async function runNewPlan(intakePath, opts) {
   const story = intakePath ? resolveFromPath(intakePath, stories, root) : await pickStory(stories, { all: !!opts.all, interactive, feature: opts.feature });
   if (!story) return;
   if (story.planFile) {
-    const proceed = await confirmOverwrite(story, interactive, !!opts.yes);
+    const proceed = await confirmOverwrite2(story, interactive, !!opts.yes);
     if (!proceed) return;
   }
   const mode = decideMode(opts, config2);
@@ -7181,8 +8152,8 @@ async function runNewPlan(intakePath, opts) {
   }
 }
 function resolveFromPath(intakePath, stories, root) {
-  const resolved = path24.resolve(intakePath.trim());
-  if (!fs32.existsSync(resolved)) {
+  const resolved = path25.resolve(intakePath.trim());
+  if (!fs35.existsSync(resolved)) {
     throw new Error(
       `Intake not found: ${resolved}. Run \`squad list\` to see intakes, or \`squad new-story\` to create one first.`
     );
@@ -7194,7 +8165,7 @@ function resolveFromPath(intakePath, stories, root) {
   );
 }
 function relativeStoriesDir(root) {
-  return path24.relative(root, path24.join(root, ".squad", "stories"));
+  return path25.relative(root, path25.join(root, ".squad", "stories"));
 }
 async function pickStory(stories, opts) {
   const candidates = opts.all ? stories : stories.filter((s) => !s.planFile);
@@ -7225,7 +8196,7 @@ async function pickStory(stories, opts) {
       value: s.intakePath
     }))
   });
-  return candidates.find((s) => path24.resolve(s.intakePath) === path24.resolve(pick));
+  return candidates.find((s) => path25.resolve(s.intakePath) === path25.resolve(pick));
 }
 function formatLabel(s) {
   const head = `${s.feature} / ${s.id}`;
@@ -7233,7 +8204,7 @@ function formatLabel(s) {
   const plannedTag = s.planFile ? `  ${theme_exports.warn("(planned)")}` : "";
   return head + tail + plannedTag;
 }
-async function confirmOverwrite(story, interactive, yes) {
+async function confirmOverwrite2(story, interactive, yes) {
   warning(`A plan already exists for this intake:`);
   kv("plan", `.squad/plans/${story.feature}/${story.planFile}`);
   info("Regenerating will replace it when your planner writes the new version.");
@@ -7243,7 +8214,7 @@ async function confirmOverwrite(story, interactive, yes) {
       `Plan already exists (.squad/plans/${story.feature}/${story.planFile}). Run \`squad new-plan\` with \`--yes\` to overwrite non-interactively, or in a TTY to confirm in the prompt.`
     );
   }
-  const go = await confirm6({ message: "Proceed and regenerate?", default: false });
+  const go = await confirm7({ message: "Proceed and regenerate?", default: false });
   return go;
 }
 function printPlannerRunIncompleteSummary(result, relPlanFile) {
@@ -7258,6 +8229,10 @@ function printPlannerRunIncompleteSummary(result, relPlanFile) {
   info("The file uses the `.partial.md` suffix and YAML `squad-kit-plan-status: partial`.");
   info("Raise limits in `.squad/config.yaml` (`planner.budget`, `planner.maxOutputTokens`) or re-run when ready.");
 }
+function formatAuthRow(auth2) {
+  if (auth2.mode === "subscription") return "subscription (Claude login)";
+  return `api-key (${describeAuth(auth2).credentialHint})`;
+}
 async function emitViaApi(story, paths, config2, opts) {
   const planner = config2.planner;
   if (!planner?.enabled) {
@@ -7265,18 +8240,13 @@ async function emitViaApi(story, paths, config2, opts) {
       "Direct planner API is not configured. Run `squad init --force` to enable it, or `squad new-plan --copy` for the manual copy-paste flow."
     );
   }
-  const apiKey = readProviderKey(planner.provider);
-  if (!apiKey) {
-    throw new Error(
-      `Missing ${providerEnvVar(planner.provider)}. Run \`squad config set planner\` to save a key to secrets, or export the env var, or run \`squad new-plan --copy\` without the API.`
-    );
-  }
+  const auth2 = resolvePlannerAuthForCwd(planner.provider, planner);
   const modelId = modelFor(planner.provider, "plan", planner.modelOverride);
   const anthropicRuntimeChoice = opts.anthropicRuntime ?? planner.runtime?.anthropic ?? "agent-sdk";
   const draftRuntime = resolveRuntime({
     provider: planner.provider,
     modelId,
-    apiKey,
+    auth: auth2,
     anthropicRuntime: planner.provider === "anthropic" ? anthropicRuntimeChoice : void 0
   });
   const thinkingCli = opts.noThinking ? "off" : void 0;
@@ -7295,10 +8265,11 @@ async function emitViaApi(story, paths, config2, opts) {
   step(`planning   ${story.feature} / ${story.id}`);
   kv("provider", planner.provider);
   kv("model", modelId);
+  kv("auth", formatAuthRow(auth2));
   blank();
   const interactive = !opts.yes && Boolean(process.stdin.isTTY);
   if (interactive) {
-    printPlannerApiCostNotice();
+    printPlannerApiCostNotice(auth2.mode);
   }
   const mapSpinner = spinner("building repo map\u2026");
   const repoMap = buildRepoMap(paths.root, { format: "tree" });
@@ -7330,7 +8301,7 @@ async function emitViaApi(story, paths, config2, opts) {
     scoutRuntime = resolveRuntime({
       provider: planner.provider,
       modelId: scoutModelId,
-      apiKey,
+      auth: auth2,
       anthropicRuntime: planner.provider === "anthropic" ? anthropicRuntimeChoice : void 0
     });
     scoutSystemPrompt = composeScoutSystemPrompt({
@@ -7369,9 +8340,9 @@ async function emitViaApi(story, paths, config2, opts) {
     dispatchNewPlanApiPlannerEvent(apiUiCtx, e);
   });
   const decideOnLimit = interactive ? async (ctx) => {
-    printPlannerLimitExplanation(ctx);
+    printPlannerLimitExplanation(ctx, auth2.mode);
     const ans = await select6({
-      message: "Continue this planning session? (Continuing sends more API requests and is billed.)",
+      message: auth2.mode === "subscription" ? "Continue this planning session? (Continuing runs more model rounds against your Claude usage limits.)" : "Continue this planning session? (Continuing sends more API requests and is billed.)",
       choices: [
         { name: "Continue \u2014 extend limits for this run", value: "continue" },
         { name: "Stop \u2014 save partial plan and exit", value: "cancel" }
@@ -7387,6 +8358,7 @@ async function emitViaApi(story, paths, config2, opts) {
       runtime: draftRuntime,
       provider: planner.provider,
       modelId,
+      auth: auth2,
       anthropicProviderSpecific,
       systemPrompt,
       userPrompt,
@@ -7452,7 +8424,7 @@ async function emitViaApi(story, paths, config2, opts) {
     metadataHeader: header,
     partial: !success2
   });
-  const relPlan = path24.relative(paths.root, planFile);
+  const relPlan = path25.relative(paths.root, planFile);
   try {
     await writeLastRun(paths, {
       stats: result.stats,
@@ -7487,6 +8459,7 @@ async function emitViaApi(story, paths, config2, opts) {
         durationMs: result.validation?.durationMs
       },
       plannerRuntime: { kind: draftRuntime.kind, provider: planner.provider },
+      authMode: describeAuth(auth2).mode,
       providerOptionsSnapshot: anthropicProviderSpecific ? { anthropic: anthropicProviderSpecific } : void 0
     });
   } catch {
@@ -7588,14 +8561,14 @@ async function emitViaApi(story, paths, config2, opts) {
     info("Note: file-read budget was reached; the model finalised without further reads.");
   }
   blank();
-  info(`next  \u2192  open a new agent chat and attach only ${path24.basename(planFile)}`);
+  info(`next  \u2192  open a new agent chat and attach only ${path25.basename(planFile)}`);
 }
 async function emitCopyPrompt(story, paths, config2, clipboard) {
   const intakeContent = readFile(story.intakePath);
   const composed = buildCopyPlanPromptMarkdown(config2, intakeContent);
-  const promptFile = path24.join(paths.squadDir, ".last-copy-prompt.md");
-  fs32.writeFileSync(promptFile, composed, "utf8");
-  const relPromptFile = path24.relative(paths.root, promptFile);
+  const promptFile = path25.join(paths.squadDir, ".last-copy-prompt.md");
+  fs35.writeFileSync(promptFile, composed, "utf8");
+  const relPromptFile = path25.relative(paths.root, promptFile);
   const bytes = Buffer.byteLength(composed, "utf8");
   const estTokens = Math.round(bytes / 4);
   const clipResult = clipboard ? await copyToClipboard(composed) : { ok: false, reason: "clipboard disabled (--no-clipboard)" };
@@ -7653,7 +8626,7 @@ function printModelBanner(config2) {
 }
 
 // src/commands/status.ts
-import fs33 from "fs";
+import fs36 from "fs";
 var kw = 28;
 function probeTrackerCredential(config2, overlay) {
   const { client, error } = clientFor(config2, overlay);
@@ -7679,7 +8652,7 @@ async function runStatus() {
   const scan = scanPlans(paths.plansDir);
   const storyCount = listStories(paths).length;
   const planCount = scan.usedNumbers.length;
-  const secrets = fs33.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
+  const secrets = fs36.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
   const overlay = overlayTrackerEnv(secrets);
   banner();
   step("squad-kit status");
@@ -7695,12 +8668,7 @@ async function runStatus() {
     const model = modelFor(config2.planner.provider, "plan", config2.planner.modelOverride);
     const overrideNote = config2.planner.modelOverride?.[config2.planner.provider] ? " (override)" : "";
     kv("planner", `${config2.planner.provider}/${model}${overrideNote}`, kw);
-    const cred = resolveProviderKey(config2.planner.provider);
-    kv(
-      "planner key",
-      cred ? `set via ${cred.detail}` : `missing \u2014 set ${providerEnvVar(config2.planner.provider)} or run \`squad init\``,
-      kw
-    );
+    kv("planner auth", buildPlannerAuthLine(config2.planner), kw);
   } else {
     kv("planner", "disabled (copy-paste flow)", kw);
   }
@@ -7711,6 +8679,15 @@ async function runStatus() {
     warning(`duplicate NN numbers: ${scan.duplicates.map(formatSequence).join(", ")}`);
   }
 }
+function buildPlannerAuthLine(planner) {
+  try {
+    const described = describeAuth(resolvePlannerAuthForCwd(planner.provider, planner));
+    return `${described.mode} \xB7 ${described.credentialHint} (${authReasonText(described.reason, planner.provider)})`;
+  } catch (err2) {
+    if (!(err2 instanceof PlannerAuthUnavailableError)) throw err2;
+    return planner.provider === "anthropic" ? "missing \u2014 run `squad auth login` for your Claude subscription, or `squad config set planner` for an API key" : `missing \u2014 set ${providerEnvVar(planner.provider)} or run \`squad config set planner\``;
+  }
+}
 function buildTrackerLine(config2, overlay) {
   if (config2.tracker.type === "none") return "none";
   let trackerLine = config2.tracker.type;
@@ -7733,13 +8710,13 @@ function buildTrackerLine(config2, overlay) {
 }
 
 // src/commands/list.ts
-import path25 from "path";
+import path26 from "path";
 async function runList(opts) {
   const root = requireSquadRoot();
   const paths = buildPaths(root);
   const records = listStories(paths, { feature: opts.feature });
   const rows = records.map((r) => {
-    const planAbs = r.planFile ? path25.join(paths.plansDir, r.feature, r.planFile) : void 0;
+    const planAbs = r.planFile ? path26.join(paths.plansDir, r.feature, r.planFile) : void 0;
     const meta = planAbs ? readPlanMetadata(planAbs) : void 0;
     return {
       feature: r.feature,
@@ -7778,8 +8755,8 @@ function stripAnsi(s) {
 }
 
 // src/commands/tracker-link.ts
-import fs34 from "fs";
-import path26 from "path";
+import fs37 from "fs";
+import path27 from "path";
 import { input as input4, select as select7 } from "@inquirer/prompts";
 async function runTrackerLink(storyPath, trackerId, opts = {}) {
   const root = requireSquadRoot();
@@ -7826,17 +8803,17 @@ async function runTrackerLink(storyPath, trackerId, opts = {}) {
       `Invalid tracker id "${resolvedTrackerId}" for tracker type "${config2.tracker.type}". Run \`squad config show\` to review the expected format, or \`squad config set tracker\` if the type is wrong.`
     );
   }
-  const resolved = path26.resolve(resolvedStoryPath);
-  const intakeFile = resolved.endsWith("intake.md") ? resolved : path26.join(resolved, "intake.md");
-  if (!fs34.existsSync(intakeFile)) {
+  const resolved = path27.resolve(resolvedStoryPath);
+  const intakeFile = resolved.endsWith("intake.md") ? resolved : path27.join(resolved, "intake.md");
+  if (!fs37.existsSync(intakeFile)) {
     throw new Error(
       `intake.md not found at ${intakeFile}. Run \`squad list\` to see valid paths, or \`squad new-story\` to create a story first.`
     );
   }
-  const content = fs34.readFileSync(intakeFile, "utf8");
+  const content = fs37.readFileSync(intakeFile, "utf8");
   const updated = upsertTrackerId(content, resolvedTrackerId);
-  fs34.writeFileSync(intakeFile, updated, "utf8");
-  success(`Linked tracker id ${resolvedTrackerId} \u2192 ${path26.relative(root, intakeFile)}`);
+  fs37.writeFileSync(intakeFile, updated, "utf8");
+  success(`Linked tracker id ${resolvedTrackerId} \u2192 ${path27.relative(root, intakeFile)}`);
   blank();
   step("Next:");
   info("1) Review the intake \u2014 the Source block at the top now carries the tracker id.");
@@ -7854,8 +8831,8 @@ function upsertTrackerId(content, id) {
 }
 
 // src/commands/doctor-engine.ts
-import fs35 from "fs";
-import path27 from "path";
+import fs38 from "fs";
+import path28 from "path";
 async function gatherContext(paths) {
   const ctx = { hasLegacyPromptsDir: false };
   try {
@@ -7864,29 +8841,30 @@ async function gatherContext(paths) {
     ctx.configError = err2;
   }
   try {
-    ctx.secrets = fs35.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
+    ctx.secrets = fs38.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
   } catch (err2) {
     ctx.secretsError = err2;
   }
-  ctx.hasLegacyPromptsDir = fs35.existsSync(paths.promptsDir);
+  ctx.hasLegacyPromptsDir = fs38.existsSync(paths.promptsDir);
   return ctx;
 }
 function gitignoreHasManagedBlock(repoRoot) {
-  const gitignore = path27.join(repoRoot, ".gitignore");
-  return fs35.existsSync(gitignore) && fs35.readFileSync(gitignore, "utf8").includes(".squad/secrets.yaml");
+  const gitignore = path28.join(repoRoot, ".gitignore");
+  return fs38.existsSync(gitignore) && fs38.readFileSync(gitignore, "utf8").includes(".squad/secrets.yaml");
 }
 function gitignoreHasTrashPattern(repoRoot) {
-  const gitignore = path27.join(repoRoot, ".gitignore");
-  return fs35.existsSync(gitignore) && fs35.readFileSync(gitignore, "utf8").includes(SQUAD_TRASH_PATTERN);
+  const gitignore = path28.join(repoRoot, ".gitignore");
+  return fs38.existsSync(gitignore) && fs38.readFileSync(gitignore, "utf8").includes(SQUAD_TRASH_PATTERN);
 }
+var DOCTOR_AUTH_PROBE_TIMEOUT_MS = 25e3;
 async function checkDirStructure(paths, _ctx, fix) {
-  const need = [paths.squadDir, paths.storiesDir, paths.plansDir].filter((p) => !fs35.existsSync(p));
+  const need = [paths.squadDir, paths.storiesDir, paths.plansDir].filter((p) => !fs38.existsSync(p));
   if (need.length === 0) {
     return { id: "dirs", name: ".squad/ directory structure", status: "ok" };
   }
   if (fix) {
     for (const p of need) {
-      fs35.mkdirSync(p, { recursive: true });
+      fs38.mkdirSync(p, { recursive: true });
     }
     return { id: "dirs", name: ".squad/ directory structure", status: "ok", detail: "repaired" };
   }
@@ -7894,7 +8872,7 @@ async function checkDirStructure(paths, _ctx, fix) {
     id: "dirs",
     name: ".squad/ directory structure",
     status: "warn",
-    detail: `missing: ${need.map((p) => path27.relative(paths.root, p)).join(", ")}`,
+    detail: `missing: ${need.map((p) => path28.relative(paths.root, p)).join(", ")}`,
     fixable: true,
     fixHint: "squad doctor --fix"
   };
@@ -7949,15 +8927,15 @@ async function checkSecretsPermissions(paths, _ctx, fix) {
   if (process.platform === "win32") {
     return { id: "secrets-perms", name: ".squad/secrets.yaml permissions", status: "skip", detail: "Windows" };
   }
-  if (!fs35.existsSync(paths.secretsFile)) {
+  if (!fs38.existsSync(paths.secretsFile)) {
     return { id: "secrets-perms", name: ".squad/secrets.yaml permissions", status: "ok", detail: "not present" };
   }
-  const mode = fs35.statSync(paths.secretsFile).mode & 511;
+  const mode = fs38.statSync(paths.secretsFile).mode & 511;
   if (mode === 384) {
     return { id: "secrets-perms", name: ".squad/secrets.yaml permissions", status: "ok" };
   }
   if (fix) {
-    fs35.chmodSync(paths.secretsFile, 384);
+    fs38.chmodSync(paths.secretsFile, 384);
     return { id: "secrets-perms", name: ".squad/secrets.yaml permissions", status: "ok", detail: "repaired" };
   }
   return {
@@ -7978,7 +8956,7 @@ async function checkSecretsParseable(_paths, ctx) {
       detail: ctx.secretsError.message
     };
   }
-  if (!fs35.existsSync(_paths.secretsFile)) {
+  if (!fs38.existsSync(_paths.secretsFile)) {
     return { id: "secrets-yaml", name: ".squad/secrets.yaml parseable", status: "ok", detail: "not present" };
   }
   return { id: "secrets-yaml", name: ".squad/secrets.yaml parseable", status: "ok" };
@@ -8040,36 +9018,142 @@ async function checkPlannerConfig(_paths, ctx) {
   }
   return { id: "planner-config", name: "planner configuration", status: "ok" };
 }
-async function checkPlannerCredential(_paths, ctx) {
-  if (!ctx.config || ctx.config.planner?.enabled !== true) {
-    return { id: "planner-cred", name: "planner credential resolves", status: "skip", detail: "planner disabled" };
+var LOGIN_FIX_HINT = "Run `squad auth login` to sign in with your Claude account.";
+var ORG_NOT_ALLOWED_FIX_HINT = "That Claude account is signed in, but its organization policy blocks this kind of access. Ask an administrator to allow Claude Agent SDK usage, or set `planner.auth.anthropic: api-key` in .squad/config.yaml and provide an ANTHROPIC_API_KEY.";
+function plannerEnabled(ctx) {
+  return ctx.config?.planner?.enabled === true;
+}
+function authFor(paths, ctx, provider) {
+  const memo = ctx.authMemo ??= {};
+  if (!memo.resolution) {
+    try {
+      memo.resolution = { ok: true, auth: resolvePlannerAuthForPaths(paths, provider, ctx.config?.planner) };
+    } catch (err2) {
+      memo.resolution = { ok: false, error: err2 };
+    }
+  }
+  return memo.resolution;
+}
+async function probeAuthOnce(ctx, auth2) {
+  const memo = ctx.authMemo ??= {};
+  if (!memo.probe) {
+    memo.probe = skipExternalProbesInAutomation() ? { skipped: true } : await probeClaudeAuth(auth2, { timeoutMs: DOCTOR_AUTH_PROBE_TIMEOUT_MS });
+  }
+  return memo.probe;
+}
+function probeWasSkipped(outcome) {
+  return "skipped" in outcome;
+}
+async function checkPlannerAuthMode(paths, ctx, _fix) {
+  const id = "planner-auth-mode";
+  const name = "planner auth mode";
+  if (!plannerEnabled(ctx) || !ctx.config?.planner) {
+    return { id, name, status: "skip", detail: "planner disabled" };
+  }
+  const planner = ctx.config.planner;
+  const provider = planner.provider;
+  if (provider !== "anthropic") {
+    return { id, name, status: "skip", detail: `api key only for ${provider}` };
+  }
+  const resolution = authFor(paths, ctx, provider);
+  if (!resolution.ok) {
+    return { id, name, status: "fail", detail: resolution.error.message, fixHint: LOGIN_FIX_HINT };
+  }
+  const auth2 = resolution.auth;
+  const described = describeAuth(auth2);
+  let detail = `${described.mode} (${authReasonText(described.reason, provider)}) \u2192 ${described.credentialHint}`;
+  if (auth2.mode === "subscription") {
+    const ignoredKey = resolveProviderKeyForPaths(paths, provider);
+    if (ignoredKey) detail += ` \xB7 ignoring the API key from ${ignoredKey.detail}`;
+  }
+  const implicitApiKey = (planner.auth?.anthropic ?? "auto") === "auto" && auth2.reason === "auto-fallback-api-key";
+  if (implicitApiKey) {
+    return {
+      id,
+      name,
+      status: "ok",
+      detail,
+      fixHint: "Resolving by fallback. Set `planner.auth.anthropic` explicitly (`squad config set planner`) if you want to pin this, or run `squad auth login` to plan on your Claude subscription instead."
+    };
+  }
+  return { id, name, status: "ok", detail };
+}
+function describeProbeAccount(probe) {
+  const bits = [];
+  const email = probe.account?.email;
+  const plan = probe.account?.subscriptionType;
+  if (email) {
+    bits.push(`signed in as ${email}${plan ? ` (${plan})` : ""}`);
+  } else if (probe.unverifiable) {
+    bits.push(`credential resolved (${probe.credentialSource ?? "token auth"}) \xB7 not verifiable without a run`);
+  } else {
+    bits.push("Claude login verified");
+  }
+  if (probe.account?.organization) bits.push(probe.account.organization);
+  if (probe.apiKeySource) bits.push(`apiKeySource=${probe.apiKeySource}`);
+  return bits.join(" \xB7 ");
+}
+async function checkPlannerCredential(paths, ctx) {
+  const id = "planner-cred";
+  const name = "planner credential resolves";
+  if (!plannerEnabled(ctx) || !ctx.config?.planner) {
+    return { id, name, status: "skip", detail: "planner disabled" };
   }
   const provider = ctx.config.planner.provider;
-  const resolved = resolveProviderKey(provider);
-  if (!resolved) {
+  const resolution = authFor(paths, ctx, provider);
+  if (!resolution.ok) {
     const envVar = providerEnvVar(provider);
     return {
-      id: "planner-cred",
-      name: "planner credential resolves",
+      id,
+      name,
       status: "fail",
       detail: `no API key found (${envVar} or .squad/secrets.yaml)`,
-      fixHint: `Set ${envVar} or save a key via 'squad init' interactive setup`
+      fixHint: resolution.error.message
     };
   }
-  return {
-    id: "planner-cred",
-    name: "planner credential resolves",
-    status: "ok",
-    detail: `source=${resolved.source} (${resolved.detail})`
-  };
+  const auth2 = resolution.auth;
+  if (auth2.mode === "api-key") {
+    return { id, name, status: "ok", detail: `source=${auth2.source} (${auth2.detail})` };
+  }
+  const credentialHint = describeAuth(auth2).credentialHint;
+  const probe = await probeAuthOnce(ctx, auth2);
+  if (probeWasSkipped(probe)) {
+    return credentialPresent(auth2) ? { id, name, status: "ok", detail: `${credentialHint} \xB7 offline check only` } : {
+      id,
+      name,
+      status: "warn",
+      detail: "no Claude login detected \xB7 offline check only",
+      fixHint: LOGIN_FIX_HINT
+    };
+  }
+  if (probe.ok) {
+    return { id, name, status: "ok", detail: describeProbeAccount(probe) };
+  }
+  switch (probe.kind) {
+    case "not-logged-in":
+    case "expired":
+      return { id, name, status: "fail", detail: probe.detail, fixHint: LOGIN_FIX_HINT };
+    case "org-not-allowed":
+      return { id, name, status: "fail", detail: probe.detail, fixHint: ORG_NOT_ALLOWED_FIX_HINT };
+    case "no-binary":
+      return { id, name, status: "warn", detail: probe.detail, fixHint: MISSING_CLAUDE_BINARY_MESSAGE };
+    default:
+      return credentialPresent(auth2) ? { id, name, status: "warn", detail: `${probe.kind}: ${probe.detail}` } : {
+        id,
+        name,
+        status: "fail",
+        detail: `no Claude login detected (live check: ${probe.kind})`,
+        fixHint: LOGIN_FIX_HINT
+      };
+  }
 }
-async function checkPlannerModel(_paths, ctx) {
-  if (!ctx.config || ctx.config.planner?.enabled !== true) {
+async function checkPlannerModel(paths, ctx) {
+  if (!plannerEnabled(ctx) || !ctx.config?.planner) {
     return { id: "planner-model", name: "planner model resolves at provider", status: "skip", detail: "planner disabled" };
   }
   const provider = ctx.config.planner.provider;
-  const cred = resolveProviderKey(provider);
-  if (!cred) {
+  const resolution = authFor(paths, ctx, provider);
+  if (!resolution.ok) {
     return {
       id: "planner-model",
       name: "planner model resolves at provider",
@@ -8077,9 +9161,18 @@ async function checkPlannerModel(_paths, ctx) {
       detail: "no credential"
     };
   }
+  const auth2 = resolution.auth;
+  if (auth2.mode === "subscription") {
+    return {
+      id: "planner-model",
+      name: "planner model resolves at provider",
+      status: "skip",
+      detail: "model list needs an API key; skipped in subscription mode"
+    };
+  }
   const model = modelFor(provider, "plan", ctx.config.planner.modelOverride);
   try {
-    const listed = await fetchProviderModelIds(provider, cred.value);
+    const listed = await fetchProviderModelIds(provider, auth2.key);
     if (!listed.ok) {
       const st = listed.status;
       if (st === 401 || st === 403) {
@@ -8121,7 +9214,7 @@ async function checkPlannerModel(_paths, ctx) {
     };
   }
 }
-async function checkPlannerTierAwareness(_paths, ctx) {
+async function checkPlannerTierAwareness(paths, ctx) {
   const id = "planner-tier";
   const name = "planner tier vs. model";
   if (!ctx.config || ctx.config.planner?.enabled !== true) {
@@ -8131,6 +9224,10 @@ async function checkPlannerTierAwareness(_paths, ctx) {
   if (provider !== "anthropic") {
     return { id, name, status: "skip", detail: `not applicable for ${provider}` };
   }
+  const tierAuth = authFor(paths, ctx, provider);
+  if (tierAuth.ok && tierAuth.auth.mode === "subscription") {
+    return { id, name, status: "skip", detail: "not applicable on subscription auth (no API rate tier)" };
+  }
   const planModel = modelFor(provider, "plan", ctx.config.planner.modelOverride);
   if (!/opus/i.test(planModel)) {
     return { id, name, status: "ok", detail: `${planModel} is comfortably under Tier 1` };
@@ -8259,18 +9356,57 @@ async function checkPlannerAnthropicRuntimeModelFit(_paths, ctx) {
     fixHint: "Remove planner.runtime.anthropic: vercel (default is agent-sdk), or set planner.modelOverride.anthropic to a pre-4.7 id (e.g. claude-sonnet-4-5-20250929)."
   };
 }
-async function checkAgentSdkBinaryPresent(_paths, ctx) {
+async function checkPlannerAuthRuntimeFit(paths, ctx) {
+  const id = "planner-auth-runtime-fit";
+  const name = "planner auth vs. runtime";
+  if (!plannerEnabled(ctx) || !ctx.config?.planner) {
+    return { id, name, status: "skip", detail: "planner disabled" };
+  }
+  const planner = ctx.config.planner;
+  const provider = planner.provider;
+  const configuredMode = planner.auth?.anthropic ?? "auto";
+  if (provider !== "anthropic") {
+    if (configuredMode === "subscription") {
+      return {
+        id,
+        name,
+        status: "fail",
+        detail: `planner.auth.anthropic: subscription with planner.provider: ${provider}`,
+        fixHint: plannerAuthRuntimeMismatchMessage(provider)
+      };
+    }
+    return { id, name, status: "skip", detail: `api key only for ${provider}` };
+  }
+  const runtime = runtimeNameFor(provider, planner);
+  const resolution = authFor(paths, ctx, provider);
+  if (!resolution.ok) {
+    return { id, name, status: "skip", detail: "auth unresolved" };
+  }
+  const mode = resolution.auth.mode;
+  if (mode === "subscription" && runtime !== "agent-sdk") {
+    return {
+      id,
+      name,
+      status: "fail",
+      detail: `subscription auth with planner.runtime.anthropic: ${runtime}`,
+      fixHint: plannerAuthRuntimeMismatchMessage(provider)
+    };
+  }
+  return { id, name, status: "ok", detail: `${mode} + ${runtime} runtime` };
+}
+async function checkAgentSdkBinaryPresent(paths, ctx) {
   const id = "agent-sdk-binary-present";
   const name = "Anthropic Agent SDK install";
   if (!ctx.config?.planner?.enabled || ctx.config.planner.provider !== "anthropic") {
     return { id, name, status: "skip", detail: "not applicable" };
   }
-  if ((ctx.config.planner.runtime?.anthropic ?? "agent-sdk") === "vercel") {
+  const resolution = authFor(paths, ctx, "anthropic");
+  const subscription = resolution.ok && resolution.auth.mode === "subscription";
+  if ((ctx.config.planner.runtime?.anthropic ?? "agent-sdk") === "vercel" && !subscription) {
     return { id, name, status: "skip", detail: "vercel runtime selected" };
   }
   try {
     await import("@anthropic-ai/claude-agent-sdk");
-    return { id, name, status: "ok", detail: "package resolves" };
   } catch (e) {
     return {
       id,
@@ -8280,6 +9416,22 @@ async function checkAgentSdkBinaryPresent(_paths, ctx) {
       fixHint: "Run pnpm install / npm install in the squad-kit package so the Agent SDK (and its platform binary) is present."
     };
   }
+  const binary = resolveClaudeBinary();
+  if (!binary) {
+    return {
+      id,
+      name,
+      status: subscription ? "fail" : "warn",
+      detail: "package resolves; no `claude` executable found",
+      fixHint: MISSING_CLAUDE_BINARY_MESSAGE
+    };
+  }
+  return {
+    id,
+    name,
+    status: "ok",
+    detail: `package + ${binary.source === "bundled" ? "bundled" : "PATH"} binary`
+  };
 }
 async function checkTrackerConfig(_paths, ctx) {
   if (!ctx.config) {
@@ -8418,11 +9570,13 @@ async function runAllChecks(paths, ctx, fix) {
   await add(".squad/secrets.yaml parseable", () => checkSecretsParseable(paths, ctx));
   await add("legacy .squad/prompts/ directory", () => checkLegacyPrompts(paths, ctx));
   await add("planner configuration", () => checkPlannerConfig(paths, ctx));
+  await add("planner auth mode", () => checkPlannerAuthMode(paths, ctx, fix));
   await add("planner credential resolves", () => checkPlannerCredential(paths, ctx));
   await add("planner model resolves at provider", () => checkPlannerModel(paths, ctx));
   await add("planner tier vs. model", () => checkPlannerTierAwareness(paths, ctx));
   await add("planner cache effectiveness", () => checkPlannerCache(paths, ctx));
   await add("planner runtime (resolved)", () => checkPlannerRuntimeInfo(paths, ctx));
+  await add("planner auth vs. runtime", () => checkPlannerAuthRuntimeFit(paths, ctx));
   await add("Anthropic Opus 4.7+ vs Vercel runtime", () => checkPlannerAnthropicRuntimeModelFit(paths, ctx));
   await add("Anthropic Agent SDK install", () => checkAgentSdkBinaryPresent(paths, ctx));
   await add("tracker configuration", () => checkTrackerConfig(paths, ctx));
@@ -8532,23 +9686,23 @@ async function runDoctor(opts) {
 }
 
 // src/commands/migrate.ts
-import fs36 from "fs";
-import path28 from "path";
-import { confirm as confirm7 } from "@inquirer/prompts";
+import fs39 from "fs";
+import path29 from "path";
+import { confirm as confirm8 } from "@inquirer/prompts";
 var LEGACY_PROMPTS_MIGRATION = {
   id: "legacy-prompts",
   name: "Remove legacy .squad/prompts/",
-  isApplied: (paths) => !fs36.existsSync(paths.promptsDir),
-  describe: (paths) => `delete ${path28.relative(paths.root, paths.promptsDir)} (prompts are now bundled in squad-kit)`,
+  isApplied: (paths) => !fs39.existsSync(paths.promptsDir),
+  describe: (paths) => `delete ${path29.relative(paths.root, paths.promptsDir)} (prompts are now bundled in squad-kit)`,
   apply: (paths) => {
     const target = paths.promptsDir;
-    if (!target.includes(path28.sep + ".squad" + path28.sep + "prompts")) {
+    if (!target.includes(path29.sep + ".squad" + path29.sep + "prompts")) {
       throw new Error(
         `Refusing to delete suspicious path: ${target}. This is a safety check \u2014 run \`squad doctor\` if .squad/ paths look wrong.`
       );
     }
-    if (fs36.existsSync(target)) {
-      fs36.rmSync(target, { recursive: true, force: true });
+    if (fs39.existsSync(target)) {
+      fs39.rmSync(target, { recursive: true, force: true });
     }
   }
 };
@@ -8556,8 +9710,8 @@ var GITIGNORE_MIGRATION = {
   id: "gitignore",
   name: "Ensure .gitignore managed block",
   isApplied: (paths) => {
-    const f = path28.join(paths.root, ".gitignore");
-    return fs36.existsSync(f) && fs36.readFileSync(f, "utf8").includes(".squad/secrets.yaml");
+    const f = path29.join(paths.root, ".gitignore");
+    return fs39.existsSync(f) && fs39.readFileSync(f, "utf8").includes(".squad/secrets.yaml");
   },
   describe: () => "add squad-kit managed block to .gitignore",
   apply: (paths) => {
@@ -8569,23 +9723,23 @@ var SECRETS_PERMS_MIGRATION = {
   name: "Tighten .squad/secrets.yaml permissions",
   isApplied: (paths) => {
     if (process.platform === "win32") return true;
-    if (!fs36.existsSync(paths.secretsFile)) return true;
-    const st = fs36.statSync(paths.secretsFile);
+    if (!fs39.existsSync(paths.secretsFile)) return true;
+    const st = fs39.statSync(paths.secretsFile);
     return (st.mode & 511) === 384;
   },
-  describe: (paths) => `chmod 0600 ${path28.relative(paths.root, paths.secretsFile)}`,
+  describe: (paths) => `chmod 0600 ${path29.relative(paths.root, paths.secretsFile)}`,
   apply: (paths) => {
     if (process.platform === "win32") return;
-    if (fs36.existsSync(paths.secretsFile)) fs36.chmodSync(paths.secretsFile, 384);
+    if (fs39.existsSync(paths.secretsFile)) fs39.chmodSync(paths.secretsFile, 384);
   }
 };
 var PLANNER_BUDGET_DEFAULTS_MIGRATION = {
   id: "planner-budget-defaults",
   name: "Backfill planner.budget defaults in config.yaml",
   isApplied: (paths) => {
-    if (!fs36.existsSync(paths.configFile)) return true;
+    if (!fs39.existsSync(paths.configFile)) return true;
     try {
-      const raw = fs36.readFileSync(paths.configFile, "utf8");
+      const raw = fs39.readFileSync(paths.configFile, "utf8");
       if (!/^\s*planner:/m.test(raw)) return true;
       if (/^\s*budget:/m.test(raw)) return true;
       const cfg = loadConfig(paths.configFile);
@@ -8604,9 +9758,9 @@ var CONFIG_NORMALIZE_MIGRATION = {
   id: "config-normalize",
   name: "Normalise .squad/config.yaml formatting",
   isApplied: (paths) => {
-    if (!fs36.existsSync(paths.configFile)) return true;
+    if (!fs39.existsSync(paths.configFile)) return true;
     try {
-      const raw = fs36.readFileSync(paths.configFile, "utf8");
+      const raw = fs39.readFileSync(paths.configFile, "utf8");
       const cfg = loadConfig(paths.configFile);
       return raw.trim() === serializeConfig(cfg).trim();
     } catch {
@@ -8615,7 +9769,7 @@ var CONFIG_NORMALIZE_MIGRATION = {
   },
   describe: () => "rewrite config.yaml with canonical YAML formatting (drops comments)",
   apply: (paths) => {
-    if (!fs36.existsSync(paths.configFile)) return;
+    if (!fs39.existsSync(paths.configFile)) return;
     const cfg = loadConfig(paths.configFile);
     saveConfig(paths.configFile, cfg);
   }
@@ -8663,7 +9817,7 @@ async function runMigrate(opts) {
       );
       process.exit(1);
     }
-    const go = await confirm7({ message: `Apply ${pending.length} migration(s)?`, default: true });
+    const go = await confirm8({ message: `Apply ${pending.length} migration(s)?`, default: true });
     if (!go) {
       info("Cancelled. No changes applied.");
       return;
@@ -8691,13 +9845,13 @@ async function runMigrate(opts) {
 }
 
 // src/commands/upgrade.ts
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 import process3 from "process";
-import { confirm as confirm8 } from "@inquirer/prompts";
+import { confirm as confirm9 } from "@inquirer/prompts";
 
 // src/core/package-info.ts
-import fs37 from "fs";
-import path29 from "path";
+import fs40 from "fs";
+import path30 from "path";
 function changelogBlobUrl(repositoryUrl, version) {
   let base = repositoryUrl;
   if (!base) base = "https://github.com/AzmSquad/squad-kit";
@@ -8708,9 +9862,9 @@ function changelogBlobUrl(repositoryUrl, version) {
 }
 function readInstalledPackage() {
   const root = packageRoot();
-  const pkgFile = path29.join(root, "package.json");
-  const pkg = JSON.parse(fs37.readFileSync(pkgFile, "utf8"));
-  const isDevInstall = fs37.existsSync(path29.join(root, "src"));
+  const pkgFile = path30.join(root, "package.json");
+  const pkg = JSON.parse(fs40.readFileSync(pkgFile, "utf8"));
+  const isDevInstall = fs40.existsSync(path30.join(root, "src"));
   return {
     name: pkg.name,
     version: pkg.version,
@@ -8750,7 +9904,7 @@ function isNewer(a, b) {
 }
 
 // src/core/package-manager.ts
-import path30 from "path";
+import path31 from "path";
 import process2 from "process";
 function detectPackageManager(installRoot) {
   const ua = process2.env.npm_config_user_agent;
@@ -8761,11 +9915,11 @@ function detectPackageManager(installRoot) {
     if (ua.startsWith("npm/")) return { pm: "npm", reason: "npm_config_user_agent" };
   }
   const root = installRoot.toLowerCase();
-  if (root.includes(`${path30.sep}pnpm${path30.sep}`) || root.includes(`${path30.sep}.pnpm${path30.sep}`))
+  if (root.includes(`${path31.sep}pnpm${path31.sep}`) || root.includes(`${path31.sep}.pnpm${path31.sep}`))
     return { pm: "pnpm", reason: `install path contains pnpm` };
-  if (root.includes(`${path30.sep}.yarn${path30.sep}`) || root.includes(`${path30.sep}yarn${path30.sep}`))
+  if (root.includes(`${path31.sep}.yarn${path31.sep}`) || root.includes(`${path31.sep}yarn${path31.sep}`))
     return { pm: "yarn", reason: `install path contains yarn` };
-  if (root.includes(`${path30.sep}.bun${path30.sep}`) || root.includes(`${path30.sep}bun${path30.sep}`))
+  if (root.includes(`${path31.sep}.bun${path31.sep}`) || root.includes(`${path31.sep}bun${path31.sep}`))
     return { pm: "bun", reason: `install path contains bun` };
   return { pm: "npm", reason: "default fallback" };
 }
@@ -8838,7 +9992,7 @@ async function runUpgrade(opts) {
       );
       process3.exit(1);
     }
-    const go = await confirm8({ message: `Run "${cmd} ${args.join(" ")}"?`, default: true });
+    const go = await confirm9({ message: `Run "${cmd} ${args.join(" ")}"?`, default: true });
     if (!go) {
       info("Cancelled. No changes applied.");
       return;
@@ -8859,7 +10013,7 @@ async function runUpgrade(opts) {
 }
 function spawnInherit(cmd, args) {
   return new Promise((resolve2, reject) => {
-    const child = spawn2(cmd, args, { stdio: "inherit", shell: process3.platform === "win32" });
+    const child = spawn3(cmd, args, { stdio: "inherit", shell: process3.platform === "win32" });
     child.on("exit", (code) => resolve2(code ?? 0));
     child.on("error", (err2) => reject(err2));
   });
@@ -8878,14 +10032,14 @@ import { cors } from "hono/cors";
 import { secureHeaders } from "hono/secure-headers";
 
 // src/console/api/stories.ts
-import fs38 from "fs";
+import fs41 from "fs";
 import { z as z6 } from "zod";
 
 // src/utils/path-safety.ts
-import path31 from "path";
+import path32 from "path";
 function isInside(abs, parent) {
-  const a = path31.resolve(abs) + path31.sep;
-  const p = path31.resolve(parent) + path31.sep;
+  const a = path32.resolve(abs) + path32.sep;
+  const p = path32.resolve(parent) + path32.sep;
   return a.startsWith(p);
 }
 
@@ -8925,7 +10079,7 @@ function mountStoriesApi(app, opts) {
     if (!isInside(hit.intakePath, opts.paths.storiesDir)) return c.json({ error: "forbidden" }, 403);
     let intakeContent = "";
     try {
-      intakeContent = fs38.readFileSync(hit.intakePath, "utf8");
+      intakeContent = fs41.readFileSync(hit.intakePath, "utf8");
     } catch {
     }
     return c.json({
@@ -8969,7 +10123,7 @@ function mountStoriesApi(app, opts) {
     const hit = stories.find((s) => s.id === id);
     if (!hit) return c.json({ error: "not_found" }, 404);
     if (!isInside(hit.intakePath, opts.paths.storiesDir)) return c.json({ error: "forbidden" }, 403);
-    fs38.writeFileSync(hit.intakePath, body.data.intakeContent, "utf8");
+    fs41.writeFileSync(hit.intakePath, body.data.intakeContent, "utf8");
     return c.json({ ok: true });
   });
   app.delete("/api/stories/:feature/:id", (c) => {
@@ -8986,8 +10140,8 @@ function mountStoriesApi(app, opts) {
 }
 
 // src/console/api/plans.ts
-import fs39 from "fs";
-import path32 from "path";
+import fs42 from "fs";
+import path33 from "path";
 import { z as z7 } from "zod";
 import { diffLines } from "diff";
 var DiffQuery = z7.object({
@@ -9002,11 +10156,11 @@ function mountPlansApi(app, opts) {
   app.get("/api/plans", (c) => {
     const out = [];
     for (const feature of listPlanFeatureNames(opts.paths)) {
-      const featureDir = path32.join(opts.paths.plansDir, feature);
-      if (!fs39.existsSync(featureDir)) continue;
-      for (const entry of fs39.readdirSync(featureDir)) {
+      const featureDir = path33.join(opts.paths.plansDir, feature);
+      if (!fs42.existsSync(featureDir)) continue;
+      for (const entry of fs42.readdirSync(featureDir)) {
         if (!entry.endsWith(".md") || entry === "00-index.md") continue;
-        const abs = path32.join(featureDir, entry);
+        const abs = path33.join(featureDir, entry);
         out.push({ feature, planFile: entry, metadata: readPlanMetadata(abs) });
       }
     }
@@ -9015,10 +10169,10 @@ function mountPlansApi(app, opts) {
   app.get("/api/plans/:feature/:planFile", (c) => {
     const { feature, planFile } = c.req.param();
     if (!safeFeatureParam2(feature)) return c.json({ error: "forbidden" }, 403);
-    const abs = path32.resolve(path32.join(opts.paths.plansDir, feature, planFile));
+    const abs = path33.resolve(path33.join(opts.paths.plansDir, feature, planFile));
     if (!isInside(abs, opts.paths.plansDir)) return c.json({ error: "forbidden" }, 403);
-    if (!fs39.existsSync(abs)) return c.json({ error: "not_found" }, 404);
-    const content = fs39.readFileSync(abs, "utf8");
+    if (!fs42.existsSync(abs)) return c.json({ error: "not_found" }, 404);
+    const content = fs42.readFileSync(abs, "utf8");
     return c.json({
       feature,
       planFile,
@@ -9036,15 +10190,15 @@ function mountPlansApi(app, opts) {
     if (!parse.success) return c.json({ error: "invalid_query", issues: parse.error.issues }, 400);
     const { feature, a, b } = parse.data;
     if (!safeFeatureParam2(feature)) return c.json({ error: "forbidden" }, 403);
-    const featureDir = path32.join(opts.paths.plansDir, feature);
-    const aAbs = path32.join(featureDir, a);
-    const bAbs = path32.join(featureDir, b);
+    const featureDir = path33.join(opts.paths.plansDir, feature);
+    const aAbs = path33.join(featureDir, a);
+    const bAbs = path33.join(featureDir, b);
     if (!isInside(aAbs, opts.paths.plansDir) || !isInside(bAbs, opts.paths.plansDir)) {
       return c.json({ error: "forbidden" }, 403);
     }
-    if (!fs39.existsSync(aAbs) || !fs39.existsSync(bAbs)) return c.json({ error: "not_found" }, 404);
-    const aText = fs39.readFileSync(aAbs, "utf8");
-    const bText = fs39.readFileSync(bAbs, "utf8");
+    if (!fs42.existsSync(aAbs) || !fs42.existsSync(bAbs)) return c.json({ error: "not_found" }, 404);
+    const aText = fs42.readFileSync(aAbs, "utf8");
+    const bText = fs42.readFileSync(bAbs, "utf8");
     const changes = diffLines(aText, bText);
     return c.json({ feature, a, b, changes });
   });
@@ -9052,16 +10206,16 @@ function mountPlansApi(app, opts) {
     const trash = c.req.query("trash") === "1";
     const { feature, planFile } = c.req.param();
     if (!safeFeatureParam2(feature)) return c.json({ error: "forbidden" }, 403);
-    const abs = path32.join(opts.paths.plansDir, feature, planFile);
+    const abs = path33.join(opts.paths.plansDir, feature, planFile);
     if (!isInside(abs, opts.paths.plansDir)) return c.json({ error: "forbidden" }, 403);
-    if (!fs39.existsSync(abs)) return c.json({ error: "not_found" }, 404);
+    if (!fs42.existsSync(abs)) return c.json({ error: "not_found" }, 404);
     if (trash) {
       const result = trashOrDelete([abs], opts.paths.trashDir, true);
-      removeOverviewRowForPlanFile(path32.join(opts.paths.plansDir, feature), planFile);
+      removeOverviewRowForPlanFile(path33.join(opts.paths.plansDir, feature), planFile);
       return c.json({ ok: true, trashed: result.trashed });
     }
-    fs39.rmSync(abs);
-    removeOverviewRowForPlanFile(path32.join(opts.paths.plansDir, feature), planFile);
+    fs42.rmSync(abs);
+    removeOverviewRowForPlanFile(path33.join(opts.paths.plansDir, feature), planFile);
     return c.json({ ok: true });
   });
 }
@@ -9109,8 +10263,8 @@ function mountMetaApi(app, opts) {
 // src/console/api/runs.ts
 import { streamSSE } from "hono/streaming";
 import { z as z9 } from "zod";
-import path33 from "path";
-import fs40 from "fs";
+import path34 from "path";
+import fs43 from "fs";
 var active = /* @__PURE__ */ new Map();
 var EVENT_BUF_CAP = 4096;
 var StartBody = z9.object({
@@ -9146,15 +10300,21 @@ function mountRunsApi(app, opts) {
     if (!cfg.planner?.enabled) {
       return c.json({ error: "planner_disabled", detail: "Run `squad config set planner` first." }, 400);
     }
-    const apiKey = readProviderKeyForPaths(opts.paths, cfg.planner.provider);
-    if (!apiKey) {
-      return c.json(
-        {
-          error: "missing_credentials",
-          detail: `Set ${providerEnvVar(cfg.planner.provider)} or save a key via the Secrets tab.`
-        },
-        400
-      );
+    let auth2;
+    try {
+      auth2 = resolvePlannerAuthForPaths(opts.paths, cfg.planner.provider, cfg.planner);
+    } catch (err2) {
+      if (err2 instanceof PlannerAuthUnavailableError) {
+        return c.json(
+          {
+            error: "auth_unavailable",
+            mode: cfg.planner.auth?.anthropic ?? "auto",
+            detail: err2.message
+          },
+          400
+        );
+      }
+      throw err2;
     }
     const stories = listStories(opts.paths, { feature: body.data.feature });
     const story = stories.find((s) => s.id === body.data.storyId);
@@ -9176,7 +10336,7 @@ function mountRunsApi(app, opts) {
       const draftRuntime = resolveRuntime({
         provider: planner.provider,
         modelId,
-        apiKey,
+        auth: auth2,
         anthropicRuntime: planner.provider === "anthropic" ? anthropicRuntimeChoice : void 0
       });
       const anthropicProviderSpecific = planner.provider === "anthropic" ? {
@@ -9202,7 +10362,7 @@ function mountRunsApi(app, opts) {
         scoutRuntime = resolveRuntime({
           provider: planner.provider,
           modelId: scoutModelId,
-          apiKey,
+          auth: auth2,
           anthropicRuntime: planner.provider === "anthropic" ? anthropicRuntimeChoice : void 0
         });
       }
@@ -9223,7 +10383,7 @@ function mountRunsApi(app, opts) {
         repoMap
       });
       const userPrompt = composeUserPrompt({
-        intakeContent: fs40.readFileSync(story.intakePath, "utf8")
+        intakeContent: fs43.readFileSync(story.intakePath, "utf8")
       });
       let result;
       try {
@@ -9233,6 +10393,7 @@ function mountRunsApi(app, opts) {
             runtime: draftRuntime,
             provider: planner.provider,
             modelId,
+            auth: auth2,
             anthropicProviderSpecific,
             systemPrompt,
             userPrompt,
@@ -9302,7 +10463,7 @@ function mountRunsApi(app, opts) {
             metadataHeader: header,
             partial: !runSuccess
           });
-          planFile = path33.relative(opts.paths.root, out.planFile);
+          planFile = path34.relative(opts.paths.root, out.planFile);
         }
         try {
           await writeLastRun(opts.paths, {
@@ -9338,6 +10499,7 @@ function mountRunsApi(app, opts) {
               durationMs: result.validation?.durationMs
             },
             plannerRuntime: { kind: draftRuntime.kind, provider: planner.provider },
+            authMode: describeAuth(auth2).mode,
             providerOptionsSnapshot: anthropicProviderSpecific ? { anthropic: anthropicProviderSpecific } : void 0
           });
         } catch {
@@ -9469,7 +10631,13 @@ function mountSecretsApi(app, opts) {
       planner: {
         anthropic: maskToken(s.planner?.anthropic),
         openai: maskToken(s.planner?.openai),
-        google: maskToken(s.planner?.google)
+        google: maskToken(s.planner?.google),
+        /**
+         * `claude setup-token` output. Masked exactly like the API keys — the Claude account
+         * card shows it so a user can tell "a token is stored here" from "the OS login store
+         * is being used". Never returned in full, and never by `/api/planner-auth`.
+         */
+        anthropicOauthToken: maskToken(s.planner?.anthropicOauthToken)
       },
       tracker: {
         jira: {
@@ -9493,7 +10661,8 @@ function mountSecretsApi(app, opts) {
     planner: z10.object({
       anthropic: z10.string().optional(),
       openai: z10.string().optional(),
-      google: z10.string().optional()
+      google: z10.string().optional(),
+      anthropicOauthToken: z10.string().optional()
     }).optional(),
     tracker: z10.object({
       jira: z10.object({
@@ -9517,6 +10686,9 @@ function mountSecretsApi(app, opts) {
     if (!parse.success) return c.json({ error: "invalid_body", issues: parse.error.issues }, 400);
     const current = loadSecrets(opts.paths.secretsFile);
     const merged = mergeSecrets(current, parse.data);
+    if (parse.data.planner?.anthropicOauthToken === "" && merged.planner) {
+      delete merged.planner.anthropicOauthToken;
+    }
     saveSecrets(opts.paths.secretsFile, merged);
     return c.json({ ok: true });
   });
@@ -9547,13 +10719,166 @@ function mountSecretsApi(app, opts) {
   });
 }
 
-// src/console/api/tracker.ts
+// src/console/api/planner-auth.ts
 import { z as z11 } from "zod";
-var SearchQuery = z11.object({ q: z11.string().max(500) });
-var ImportBody = z11.object({
-  issueId: z11.string().min(1),
-  feature: z11.string().min(1).max(80),
-  withAttachments: z11.boolean().optional()
+
+// src/commands/auth/status.ts
+async function runAuthStatus(opts = {}) {
+  const paths = buildPaths(requireSquadRoot());
+  const config2 = loadConfig(paths.configFile);
+  const planner = config2.planner;
+  const provider = planner?.provider ?? "anthropic";
+  const auth2 = resolvePlannerAuthForCwd(provider, planner);
+  const described = describeAuth(auth2);
+  const probe = shouldProbe(opts, provider) ? await probeClaudeAuth(auth2) : void 0;
+  const payload = buildPayload2({ auth: described, provider, planner, probe, fallbackLoggedIn: credentialPresent(auth2) });
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(payload, null, 2)}
+`);
+    return;
+  }
+  const kw2 = 15;
+  step("squad-kit auth");
+  blank();
+  kv("auth mode", `${payload.mode}  (${payload.reason})`, kw2);
+  kv("credential", payload.credentialHint, kw2);
+  if (payload.account) {
+    const account = [payload.account.email, payload.account.organization, payload.account.subscriptionType].filter(Boolean).join(" \xB7 ");
+    if (account) kv("account", account, kw2);
+  }
+  if (payload.apiKeySource) kv("api key source", payload.apiKeySource, kw2);
+  kv("runtime", payload.runtime, kw2);
+  if (probe && !probe.ok) {
+    blank();
+    warning(`Live check failed (${probe.kind}).`);
+    info(probe.detail);
+    if (probe.kind === "not-logged-in" || probe.kind === "expired") {
+      info("Run `squad auth login` to sign in again.");
+    }
+  } else if (!probe) {
+    blank();
+    info("Account details skipped (offline). Re-run without --offline to check the live login.");
+  }
+}
+function shouldProbe(opts, provider) {
+  if (opts.offline) return false;
+  if (skipExternalProbesInAutomation()) return false;
+  return provider === "anthropic";
+}
+function buildPayload2(input5) {
+  const { auth: auth2, provider, planner, probe } = input5;
+  const payload = {
+    mode: auth2.mode,
+    reason: authReasonText(auth2.reason, provider),
+    credentialHint: auth2.credentialHint,
+    runtime: runtimeNameFor(provider, planner),
+    // Without a probe the honest answer is "a credential resolved locally"; with one, the live
+    // result wins. Either way the key is always present so scripts can rely on the shape.
+    loggedIn: probe ? probe.ok : input5.fallbackLoggedIn
+  };
+  if (probe?.ok) {
+    if (probe.account) payload.account = probe.account;
+    if (probe.apiKeySource) payload.apiKeySource = probe.apiKeySource;
+  }
+  return payload;
+}
+
+// src/console/api/planner-auth.ts
+var PLANNER_AUTH_LOGIN_COMMAND = "squad auth login";
+var PROBE_CACHE_TTL_MS = 6e4;
+var probeCache;
+function probeCacheKey(auth2) {
+  const described = describeAuth(auth2);
+  return `${described.mode}:${described.credentialHint}`;
+}
+async function probeWithCache(auth2, now) {
+  const key = probeCacheKey(auth2);
+  if (probeCache && probeCache.key === key && now - probeCache.at < PROBE_CACHE_TTL_MS) {
+    return probeCache.result;
+  }
+  const result = await probeClaudeAuth(auth2);
+  if (result.ok) probeCache = { key, at: now, result };
+  return result;
+}
+function resetPlannerAuthProbeCache() {
+  probeCache = void 0;
+}
+function subscriptionRuntimeConflict(provider, planner) {
+  if (provider !== "anthropic") return plannerAuthRuntimeMismatchMessage(provider);
+  if (runtimeNameFor(provider, planner) === "vercel") return plannerAuthRuntimeMismatchMessage(provider);
+  return null;
+}
+function mountPlannerAuthApi(app, opts) {
+  app.get("/api/planner-auth", async (c) => {
+    const config2 = loadConfig(opts.paths.configFile);
+    const planner = config2.planner;
+    const provider = planner?.provider ?? "anthropic";
+    const configuredMode = planner?.auth?.anthropic ?? "auto";
+    const loginProbe = detectClaudeLogin(loadSecrets(opts.paths.secretsFile));
+    const binary = resolveClaudeBinary();
+    let auth2;
+    let error = null;
+    try {
+      auth2 = resolvePlannerAuthForPaths(opts.paths, provider, planner);
+    } catch (err2) {
+      if (!(err2 instanceof PlannerAuthUnavailableError)) throw err2;
+      error = err2.message;
+    }
+    const wantProbe = c.req.query("probe") === "1" && provider === "anthropic" && auth2 !== void 0;
+    const probe = wantProbe ? await probeWithCache(auth2, Date.now()) : void 0;
+    const status = auth2 ? buildPayload2({
+      auth: describeAuth(auth2),
+      provider,
+      planner,
+      probe,
+      fallbackLoggedIn: credentialPresent(auth2)
+    }) : void 0;
+    const payload = {
+      provider,
+      configuredMode,
+      resolved: status ? { mode: status.mode, reason: status.reason, credentialHint: status.credentialHint } : null,
+      error,
+      login: { present: loginProbe.present, hint: loginProbe.hint, detail: loginProbe.detail },
+      account: status?.account ?? null,
+      apiKeySource: status?.apiKeySource ?? null,
+      runtime: runtimeNameFor(provider, planner) === "vercel" ? "vercel" : "agent-sdk",
+      binary: { found: Boolean(binary), source: binary?.source ?? null },
+      loginCommand: PLANNER_AUTH_LOGIN_COMMAND,
+      loggedIn: status?.loggedIn ?? false,
+      probe: probe ? { ran: true, ok: probe.ok, ...probe.ok ? {} : { kind: probe.kind, detail: probe.detail } } : null,
+      runtimeConflict: subscriptionRuntimeConflict(provider, planner)
+    };
+    return c.json(payload);
+  });
+  const ModeBody = z11.object({ mode: z11.string() });
+  app.post("/api/planner-auth/mode", async (c) => {
+    const parsed = ModeBody.safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) return c.json({ error: "invalid_body", issues: parsed.error.issues }, 400);
+    const config2 = loadConfig(opts.paths.configFile);
+    const next = {
+      ...config2,
+      planner: {
+        ...config2.planner ?? {},
+        auth: { ...config2.planner?.auth ?? {}, anthropic: parsed.data.mode }
+      }
+    };
+    try {
+      saveConfig(opts.paths.configFile, next);
+    } catch (err2) {
+      return c.json({ error: "invalid_auth_mode", detail: err2.message }, 400);
+    }
+    resetPlannerAuthProbeCache();
+    return c.json({ ok: true, mode: parsed.data.mode });
+  });
+}
+
+// src/console/api/tracker.ts
+import { z as z12 } from "zod";
+var SearchQuery = z12.object({ q: z12.string().max(500) });
+var ImportBody = z12.object({
+  issueId: z12.string().min(1),
+  feature: z12.string().min(1).max(80),
+  withAttachments: z12.boolean().optional()
 });
 function mountTrackerApi(app, opts) {
   app.get("/api/tracker/search", async (c) => {
@@ -9694,17 +11019,17 @@ function countStories(stories) {
 }
 
 // src/console/api/projects.ts
-import fs41 from "fs/promises";
-import path34 from "path";
-import os from "os";
+import fs44 from "fs/promises";
+import path35 from "path";
+import os2 from "os";
 var MAX = 10;
 function recentFilePath() {
-  return path34.join(os.homedir(), ".squad", "recent-projects.json");
+  return path35.join(os2.homedir(), ".squad", "recent-projects.json");
 }
 async function loadRecent() {
   const RECENT_FILE = recentFilePath();
   try {
-    const raw = await fs41.readFile(RECENT_FILE, "utf8");
+    const raw = await fs44.readFile(RECENT_FILE, "utf8");
     const parsed = JSON.parse(raw);
     return Array.isArray(parsed) ? parsed.slice(0, MAX) : [];
   } catch {
@@ -9713,8 +11038,8 @@ async function loadRecent() {
 }
 async function saveRecent(list) {
   const RECENT_FILE = recentFilePath();
-  await fs41.mkdir(path34.dirname(RECENT_FILE), { recursive: true });
-  await fs41.writeFile(RECENT_FILE, JSON.stringify(list.slice(0, MAX), null, 2) + "\n", "utf8");
+  await fs44.mkdir(path35.dirname(RECENT_FILE), { recursive: true });
+  await fs44.writeFile(RECENT_FILE, JSON.stringify(list.slice(0, MAX), null, 2) + "\n", "utf8");
 }
 function mountProjectsApi(app, opts) {
   app.get("/api/projects/recent", async (c) => c.json(await loadRecent()));
@@ -9737,14 +11062,15 @@ function mountApi(app, opts) {
   mountConfigApi(app, opts);
   mountRunsApi(app, opts);
   mountSecretsApi(app, opts);
+  mountPlannerAuthApi(app, opts);
   mountTrackerApi(app, opts);
   mountDoctorApi(app, opts);
   mountCopyPlanPromptApi(app, opts);
 }
 
 // src/console/static-assets.ts
-import fs42 from "fs";
-import path35 from "path";
+import fs45 from "fs";
+import path36 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { Readable } from "stream";
 function pathnameForStatic(c) {
@@ -9774,18 +11100,18 @@ function mountStaticAssets(app, _opts) {
     }
     if (c.req.path.startsWith("/api/") || c.req.path.startsWith("/healthz")) return c.notFound();
     if (!distDir) return c.text("UI not built. Run `pnpm -C console-ui build`.", 404);
-    const indexHtml = path35.join(distDir, "index.html");
-    if (!fs42.existsSync(indexHtml)) return c.text("UI not built", 404);
-    return c.html(fs42.readFileSync(indexHtml, "utf8"), 200, { "cache-control": "no-store" });
+    const indexHtml = path36.join(distDir, "index.html");
+    if (!fs45.existsSync(indexHtml)) return c.text("UI not built", 404);
+    return c.html(fs45.readFileSync(indexHtml, "utf8"), 200, { "cache-control": "no-store" });
   });
 }
 function assetResponse(c, distDir, pathname) {
   if (!distDir) return c.text("UI not built", 404);
   const rel = pathname.replace(/^\//, "");
-  const abs = path35.normalize(path35.join(distDir, rel));
+  const abs = path36.normalize(path36.join(distDir, rel));
   if (!isInside2(abs, distDir)) return c.text("forbidden", 403);
-  if (!fs42.existsSync(abs) || !fs42.statSync(abs).isFile()) return c.text("not found", 404);
-  const body = Readable.toWeb(fs42.createReadStream(abs));
+  if (!fs45.existsSync(abs) || !fs45.statSync(abs).isFile()) return c.text("not found", 404);
+  const body = Readable.toWeb(fs45.createReadStream(abs));
   return new Response(body, {
     headers: {
       "content-type": contentTypeFor(abs),
@@ -9795,9 +11121,9 @@ function assetResponse(c, distDir, pathname) {
 }
 function serveFile(c, distDir, name, ct) {
   if (!distDir) return c.text("UI not built", 404);
-  const abs = path35.join(distDir, name);
-  if (!fs42.existsSync(abs)) return c.text("not found", 404);
-  return new Response(fs42.readFileSync(abs), {
+  const abs = path36.join(distDir, name);
+  if (!fs45.existsSync(abs)) return c.text("not found", 404);
+  return new Response(fs45.readFileSync(abs), {
     headers: { "content-type": ct, "cache-control": "public, max-age=86400" }
   });
 }
@@ -9812,13 +11138,13 @@ function contentTypeFor(p) {
   return "application/octet-stream";
 }
 function isInside2(abs, parent) {
-  const a = path35.resolve(abs) + path35.sep;
-  const p = path35.resolve(parent) + path35.sep;
+  const a = path36.resolve(abs) + path36.sep;
+  const p = path36.resolve(parent) + path36.sep;
   return a.startsWith(p);
 }
 function resolveConsoleUiDist() {
   const fromEnv = process.env.SQUAD_CONSOLE_UI_DIST;
-  if (fromEnv && fs42.existsSync(path35.join(fromEnv, "index.html"))) return fromEnv;
+  if (fromEnv && fs45.existsSync(path36.join(fromEnv, "index.html"))) return fromEnv;
   const candidates = [
     fileURLToPath2(new URL("./console-ui/", import.meta.url)),
     // dist/cli.js → dist/console-ui/
@@ -9830,7 +11156,7 @@ function resolveConsoleUiDist() {
     // src/console/*.ts → project/console-ui/dist
   ];
   for (const c of candidates) {
-    if (fs42.existsSync(path35.join(c, "index.html"))) return c;
+    if (fs45.existsSync(path36.join(c, "index.html"))) return c;
   }
   return null;
 }
@@ -9846,9 +11172,9 @@ function authMiddleware(expected) {
   };
 }
 function readPresentedToken(req) {
-  const auth = req.headers.get("authorization");
-  if (auth && auth.toLowerCase().startsWith("bearer ")) {
-    return auth.slice("bearer ".length).trim();
+  const auth2 = req.headers.get("authorization");
+  if (auth2 && auth2.toLowerCase().startsWith("bearer ")) {
+    return auth2.slice("bearer ".length).trim();
   }
   const url = new URL(req.url);
   return url.searchParams.get("t");
@@ -10012,18 +11338,18 @@ async function runConsole(opts) {
 }
 
 // src/commands/rm/story.ts
-import fs44 from "fs";
-import path37 from "path";
-import { confirm as confirm10 } from "@inquirer/prompts";
+import fs47 from "fs";
+import path38 from "path";
+import { confirm as confirm11 } from "@inquirer/prompts";
 
 // src/commands/rm/feature.ts
-import fs43 from "fs";
-import path36 from "path";
-import { confirm as confirm9 } from "@inquirer/prompts";
+import fs46 from "fs";
+import path37 from "path";
+import { confirm as confirm10 } from "@inquirer/prompts";
 function countStoryDirs(storiesDir, feature) {
-  const d = path36.join(storiesDir, feature);
-  if (!fs43.existsSync(d)) return 0;
-  return fs43.readdirSync(d, { withFileTypes: true }).filter((x) => x.isDirectory()).length;
+  const d = path37.join(storiesDir, feature);
+  if (!fs46.existsSync(d)) return 0;
+  return fs46.readdirSync(d, { withFileTypes: true }).filter((x) => x.isDirectory()).length;
 }
 async function runRmFeature(featureSlug, opts = {}) {
   const root = requireSquadRoot();
@@ -10057,17 +11383,17 @@ async function runRmFeature(featureSlug, opts = {}) {
       feature = await pickFeatureInteractive(paths);
     }
   }
-  const storyDir = path36.join(paths.storiesDir, feature);
-  const planDir = path36.join(paths.plansDir, feature);
+  const storyDir = path37.join(paths.storiesDir, feature);
+  const planDir = path37.join(paths.plansDir, feature);
   const nStories = countStoryDirs(paths.storiesDir, feature);
   const nPlans = listAllPlanListEntries(paths, feature).length;
-  const hasOverview = fs43.existsSync(path36.join(planDir, "00-overview.md")) ? 1 : 0;
+  const hasOverview = fs46.existsSync(path37.join(planDir, "00-overview.md")) ? 1 : 0;
   const targets = [];
-  if (fs43.existsSync(storyDir)) {
-    targets.push({ label: path36.relative(root, storyDir), absPath: storyDir, kind: "dir" });
+  if (fs46.existsSync(storyDir)) {
+    targets.push({ label: path37.relative(root, storyDir), absPath: storyDir, kind: "dir" });
   }
-  if (fs43.existsSync(planDir)) {
-    targets.push({ label: path36.relative(root, planDir), absPath: planDir, kind: "dir" });
+  if (fs46.existsSync(planDir)) {
+    targets.push({ label: path37.relative(root, planDir), absPath: planDir, kind: "dir" });
   }
   divider("squad rm feature");
   info(`Feature:  ${feature}`);
@@ -10082,7 +11408,7 @@ async function runRmFeature(featureSlug, opts = {}) {
     kv(t.kind, t.label, 6);
   }
   if (useTrash) {
-    info(`Items will move to ${path36.relative(process.cwd(), paths.trashDir)}/<timestamp>/`);
+    info(`Items will move to ${path37.relative(process.cwd(), paths.trashDir)}/<timestamp>/`);
   } else if (!dryRun) {
     warning("This is a permanent delete. Pass --trash to move to .squad/.trash/ instead.");
   }
@@ -10100,7 +11426,7 @@ async function runRmFeature(featureSlug, opts = {}) {
         "This command removes an entire feature. Run `squad rm feature --yes` in CI, or `squad rm feature` in a TTY to confirm the prompt interactively."
       );
     }
-    const ok = await confirm9({
+    const ok = await confirm10({
       message: `Delete all of feature "${feature}" (stories + plans)?`,
       default: false
     });
@@ -10115,7 +11441,7 @@ async function runRmFeature(featureSlug, opts = {}) {
     useTrash
   );
   if (result.trashed) {
-    success(`Feature removed. Items moved to ${path36.relative(root, result.trashed)}.`);
+    success(`Feature removed. Items moved to ${path37.relative(root, result.trashed)}.`);
   } else {
     success("Feature removed (stories and plans directories).");
   }
@@ -10156,11 +11482,11 @@ async function runRmStory(storyPathOrId, opts = {}) {
     }
   }
   const targets = [
-    { label: path37.relative(root, story.storyDir), absPath: story.storyDir, kind: "dir" }
+    { label: path38.relative(root, story.storyDir), absPath: story.storyDir, kind: "dir" }
   ];
   if (story.planFile) {
-    const planAbs = path37.join(paths.plansDir, story.feature, story.planFile);
-    targets.push({ label: path37.relative(root, planAbs), absPath: planAbs, kind: "file" });
+    const planAbs = path38.join(paths.plansDir, story.feature, story.planFile);
+    targets.push({ label: path38.relative(root, planAbs), absPath: planAbs, kind: "file" });
   }
   renderPreview("story", targets, {
     dryRun,
@@ -10177,7 +11503,7 @@ async function runRmStory(storyPathOrId, opts = {}) {
         "Pass --yes to confirm deletion in a non-interactive environment, or run `squad rm story` in a TTY to confirm the prompt interactively."
       );
     }
-    const ok = await confirm10({ message: "Delete this story and related plan/overview row?", default: false });
+    const ok = await confirm11({ message: "Delete this story and related plan/overview row?", default: false });
     if (!ok) {
       info("Cancelled.");
       return;
@@ -10185,18 +11511,18 @@ async function runRmStory(storyPathOrId, opts = {}) {
   }
   const result = deleteStoryRecord({ paths, story, trash: useTrash });
   if (result.trashed) {
-    success(`Removed (moved to ${path37.relative(root, result.trashed)}).`);
+    success(`Removed (moved to ${path38.relative(root, result.trashed)}).`);
   } else {
     success("Removed story folder, plan file (if any), and overview row.");
   }
-  const featurePlanDir = path37.join(paths.plansDir, story.feature);
-  const overviewPath = path37.join(featurePlanDir, "00-overview.md");
-  if (fs44.existsSync(overviewPath)) {
-    const body = fs44.readFileSync(overviewPath, "utf8");
+  const featurePlanDir = path38.join(paths.plansDir, story.feature);
+  const overviewPath = path38.join(featurePlanDir, "00-overview.md");
+  if (fs47.existsSync(overviewPath)) {
+    const body = fs47.readFileSync(overviewPath, "utf8");
     const onlyShell = countOverviewDataRows(body) === 0;
     if (onlyShell && featureStoriesDirEmpty(paths, story.feature)) {
       if (canPrompt) {
-        const also = await confirm10({
+        const also = await confirm11({
           message: `Feature "${story.feature}" has no stories left and an empty overview table. Remove the whole feature with \`squad rm feature ${story.feature}\` now?`,
           default: false
         });
@@ -10212,8 +11538,8 @@ async function runRmStory(storyPathOrId, opts = {}) {
 }
 
 // src/commands/rm/plan.ts
-import path38 from "path";
-import { confirm as confirm11 } from "@inquirer/prompts";
+import path39 from "path";
+import { confirm as confirm12 } from "@inquirer/prompts";
 async function runRmPlan(planPathOrSequence, opts = {}) {
   const root = requireSquadRoot();
   const paths = buildPaths(root);
@@ -10248,7 +11574,7 @@ async function runRmPlan(planPathOrSequence, opts = {}) {
   }
   const storyRows = listStories(paths, { feature: plan.feature });
   const linked = storyRows.find((s) => s.planFile === plan.file);
-  const targets = [{ label: path38.relative(root, plan.abs), absPath: plan.abs, kind: "file" }];
+  const targets = [{ label: path39.relative(root, plan.abs), absPath: plan.abs, kind: "file" }];
   renderPreview("plan", targets, {
     dryRun,
     trash: useTrash,
@@ -10264,18 +11590,54 @@ async function runRmPlan(planPathOrSequence, opts = {}) {
         "Pass --yes to confirm deletion in a non-interactive environment, or run `squad rm plan` in a TTY."
       );
     }
-    const ok = await confirm11({ message: "Delete this plan file only? (intake and config are kept.)", default: false });
+    const ok = await confirm12({ message: "Delete this plan file only? (intake and config are kept.)", default: false });
     if (!ok) {
       info("Cancelled.");
       return;
     }
   }
   trashOrDelete([plan.abs], paths.trashDir, useTrash);
-  removeOverviewRowForPlanFile(path38.join(paths.plansDir, plan.feature), plan.file);
-  const intakeHint = linked ? path38.relative(root, linked.intakePath) : `under .squad/stories/${plan.feature}/`;
+  removeOverviewRowForPlanFile(path39.join(paths.plansDir, plan.feature), plan.file);
+  const intakeHint = linked ? path39.relative(root, linked.intakePath) : `under .squad/stories/${plan.feature}/`;
   success(`Plan removed. Run \`squad new-plan ${intakeHint}\` to regenerate.`);
 }
 
+// src/commands/auth/logout.ts
+import fs48 from "fs";
+import { confirm as confirm13 } from "@inquirer/prompts";
+async function runAuthLogout(opts = {}) {
+  const paths = buildPaths(requireSquadRoot());
+  const secrets = fs48.existsSync(paths.secretsFile) ? loadSecrets(paths.secretsFile) : {};
+  if (!secrets.planner?.anthropicOauthToken) {
+    info("No Claude OAuth token is stored in .squad/secrets.yaml \u2014 nothing to remove.");
+    info("Your Claude Code login (OS credential store) is separate and was not touched.");
+    return;
+  }
+  if (!opts.yes) {
+    if (!isInteractive()) {
+      warning("Pass -y in non-interactive mode to confirm, or run `squad auth logout` in a TTY.");
+      return;
+    }
+    const ok = await confirm13({
+      message: "Remove the Claude OAuth token squad-kit stored in .squad/secrets.yaml?",
+      default: false
+    });
+    if (!ok) return;
+  }
+  delete secrets.planner.anthropicOauthToken;
+  saveSecrets(paths.secretsFile, secrets);
+  success("Removed the OAuth token squad-kit stored.");
+  info(
+    "Your Claude Code login is untouched \u2014 run `claude` and `/logout` if you also want to sign out of Claude Code."
+  );
+  const mode = loadConfig(paths.configFile).planner?.auth?.anthropic;
+  if (mode === "subscription") {
+    info(
+      "`planner.auth.anthropic` is still `subscription`. If no Claude login remains on this machine, the next run fails with a message pointing back at `squad auth login`."
+    );
+  }
+}
+
 // src/cli.ts
 var program = new Command();
 program.name("squad").description("Plan once, execute cheap. A 3-step SDD workflow CLI.").version(readInstalledPackage().version);
@@ -10344,6 +11706,14 @@ rm.command("plan [plan-path-or-sequence]").description("Delete a single plan fil
 rm.command("feature [feature-slug]").description("Delete an entire feature: every story, every plan, the overview file").option("--dry-run", "Show what would be deleted without touching the filesystem", false).option("--trash", "Move into .squad/.trash/<ts>/ instead of permanent delete", false).option("-y, --yes", "Skip the confirmation prompt", false).action(wrapArgs(runRmFeature));
 var tracker = program.command("tracker").description("Tracker id helpers");
 tracker.command("link [story-path] [tracker-id]").description("Attach/update a tracker id on an existing story intake").option("-y, --yes", "Fail fast instead of prompting for missing values", false).action(wrapArgs(runTrackerLink));
+var auth = program.command("auth").description(
+  "Sign in to Anthropic with your Claude subscription, inspect it, or clear the stored token. Precedence, CI setup, usage limits, and troubleshooting: https://squad-kit.com/docs/auth"
+);
+auth.command("login").description(
+  "Run the Anthropic browser authorization flow and store the resulting token in .squad/secrets.yaml. Prefer not to store a token? Run `claude` and use `/login` instead \u2014 squad-kit picks up the OS credential store automatically under `auth: subscription`."
+).option("--token <value>", "Use a `claude setup-token` value you already have (CI / remote machines; no browser)").option("--print-only", "Run the flow, print the token, store nothing and change no config", false).option("-y, --yes", "Overwrite an already-stored token without confirming", false).action(wrap(runAuthLogin));
+auth.command("status").description("Show the resolved auth mode, the credential behind it, and the signed-in account").option("--json", "Emit a stable JSON object for scripting (never contains the token)", false).option("--offline", "Skip the live account check; report only what resolves locally", false).action(wrap(runAuthStatus));
+auth.command("logout").description("Remove only the OAuth token squad-kit stored; your Claude Code login is untouched").option("-y, --yes", "Skip the confirmation prompt", false).action(wrap(runAuthLogout));
 var config = program.command("config").description("Inspect and change .squad/ settings");
 config.command("show").description("Show the current .squad/config.yaml and .squad/secrets.yaml state (secrets masked)").option("--json", "Emit as JSON to stdout (secrets still masked)", false).action(wrap(runConfigShow));
 var set = config.command("set").description("Interactively change a section");