agentic-dev/docs/work/sandcastle-subscription-auth-v1/_epic.md

id, prd, title, type, status, features, created

id	prd	title	type	status	features	created
sandcastle-subscription-auth-v1	null	Sandcastle subscription auth as primary flow	epic	done	tooling ci	2026-05-13

Goal

Subscription-based Claude Code auth (via host ~/.claude mount) becomes the default for pnpm work dispatch --execute. API-key auth remains as a fallback. Works for any developer who has run claude login on their host — zero per-user configuration in the repo.

Why

The sandcastle community has explicitly rejected native subscription support (issue #191, wontfix). But the host's ~/.claude/ directory contains the logged-in session; mounting it into the sandbox lets the container's Claude Code CLI use that session. This pattern is environment-agnostic (each developer has their own ~/.claude) and spends zero per-task agent tokens for Pro/Max subscribers.

Stories

• 01 — Subscription-first dispatch + Dockerfile + docs