---
id: sandcastle-subscription-auth-v1
prd: null
title: Sandcastle subscription auth as primary flow
type: epic
status: in-progress
features: [tooling, ci]
created: 2026-05-13
---

## Goal

Subscription-based Claude Code auth (via host `~/.claude` mount) becomes
the default for `pnpm work dispatch --execute`. API-key auth remains as a
fallback. Works for any developer who has run `claude login` on their
host — zero per-user configuration in the repo.

## Why

The sandcastle community has explicitly rejected native subscription
support (issue #191, wontfix). But the host's `~/.claude/` directory
contains the logged-in session; mounting it into the sandbox lets the
container's Claude Code CLI use that session. This pattern is
environment-agnostic (each developer has their own `~/.claude`) and
spends zero per-task agent tokens for Pro/Max subscribers.

## Stories

- [ ] [01 — Subscription-first dispatch + Dockerfile + docs](01-subscription-first/_story.md)