feat: add subscription-based OAuth authentication (like pi.dev)

- OAuthManager: Handle OAuth tokens from Claude Pro, ChatGPT Plus, etc
- SubscriptionAuthStrategy: Use subscription tokens instead of API keys
- AuthManager: Support both API keys AND subscription-based auth
- Priority: OAuth subscription → API key → env vars → interactive

Usage:
  # Login to Claude Pro
  ml-agent login claude

  # Login to ChatGPT Plus
  ml-agent login openai

  # Check subscriptions
  ml-agent status

  # Use ml-agent with active subscriptions
  python3 run_agent.py

Supports multiple auth methods:
1. API Keys (pay-as-you-go)
2. Subscription OAuth (Claude Pro, ChatGPT Plus)
3. Environment variables
4. auth.json file

Credentials stored locally, auto-refresh on expiry.

Author: Claude Code

.gates/hook-log.jsonl

@@ -1033,3 +1033,12 @@
 {"ts": "2026-07-23T21:23:41.719488+00:00", "gate": "pr_structure", "tool": "Bash", "decision": "allow", "reason": "not a gh pr create"}
 {"ts": "2026-07-23T21:23:41.726470+00:00", "gate": "metadata", "tool": "Bash", "decision": "allow", "reason": "not a git commit"}
 {"ts": "2026-07-23T21:23:41.737085+00:00", "gate": "file-size", "tool": "", "decision": "allow", "reason": "all 0 staged files within 150-line limit"}
+{"ts": "2026-07-23T21:23:44.278320+00:00", "gate": "file-size", "tool": "", "decision": "allow", "reason": "not a git commit"}
+{"ts": "2026-07-23T21:23:44.281000+00:00", "gate": "pr_structure", "tool": "Bash", "decision": "allow", "reason": "not a gh pr create"}
+{"ts": "2026-07-23T21:23:44.292392+00:00", "gate": "metadata", "tool": "Bash", "decision": "allow", "reason": "not a git commit"}
+{"ts": "2026-07-23T22:04:29.897272+00:00", "gate": "role", "tool": "Write", "decision": "allow", "reason": "CLAUDE_ACTIVE_SPECIALIST not set — permissive mode"}
+{"ts": "2026-07-23T22:04:43.763404+00:00", "gate": "role", "tool": "Edit", "decision": "allow", "reason": "CLAUDE_ACTIVE_SPECIALIST not set — permissive mode"}
+{"ts": "2026-07-23T22:04:59.787609+00:00", "gate": "role", "tool": "Write", "decision": "allow", "reason": "CLAUDE_ACTIVE_SPECIALIST not set — permissive mode"}
+{"ts": "2026-07-23T22:05:04.763901+00:00", "gate": "pr_structure", "tool": "Bash", "decision": "allow", "reason": "not a gh pr create"}
+{"ts": "2026-07-23T22:05:04.786149+00:00", "gate": "metadata", "tool": "Bash", "decision": "allow", "reason": "not a git commit"}
+{"ts": "2026-07-23T22:05:04.800465+00:00", "gate": "file-size", "tool": "", "decision": "allow", "reason": "all 0 staged files within 150-line limit"}

AUTH_METHODS.md

@@ -0,0 +1,212 @@
+# 🔐 Authentication Methods
+
+ML-Agent supports **both API keys AND subscription-based OAuth** (like pi.dev).
+
+---
+
+## Method 1: API Keys (Simple)
+
+Use your API keys directly from Claude/OpenAI.
+
+### Claude API Key
+
+```bash
+export CLAUDE_API_KEY="sk-ant-..."
+python3 run_agent.py
+```
+
+### OpenAI API Key
+
+```bash
+export OPENAI_API_KEY="sk-..."
+python3 run_agent.py
+```
+
+---
+
+## Method 2: Subscription-Based OAuth (Like pi.dev)
+
+Use your **Claude Pro**, **ChatGPT Plus**, or other subscriptions!
+
+### Login
+
+```bash
+ml-agent login claude      # Login to Claude Pro
+ml-agent login openai      # Login to ChatGPT Plus
+```
+
+This opens OAuth flow:
+1. Redirects to Claude.ai / ChatGPT login
+2. You authenticate and grant permission
+3. Token saved to `~/.ml-agent/auth.json`
+4. Auto-refreshes when expired
+
+### Check Subscriptions
+
+```bash
+ml-agent status
+```
+
+Output:
+```
+Active Subscriptions:
+  ✓ Claude Pro (claude)
+  ✓ ChatGPT Plus (openai)
+
+Credentials:
+  API Keys: 0
+  OAuth Subscriptions: 2
+```
+
+---
+
+## Method 3: auth.json File
+
+Manual configuration with both API keys and subscriptions:
+
+```json
+{
+  "api_keys": {
+    "claude": "sk-ant-...",
+    "openai": "sk-..."
+  },
+  "oauth": {
+    "claude": {
+      "auth_code": "...",
+      "subscription": "claude-pro",
+      "type": "oauth"
+    },
+    "openai": {
+      "auth_code": "...",
+      "subscription": "chatgpt-plus",
+      "type": "oauth"
+    }
+  }
+}
+```
+
+Location: `~/.ml-agent/auth.json` (chmod 600)
+
+---
+
+## Authentication Priority
+
+When running ml-agent, it checks credentials in this order:
+
+1. **CLI flag**: `--api-key "sk-ant-..."`
+2. **OAuth subscription**: `~/.ml-agent/auth.json` (if logged in)
+3. **Environment variables**: `CLAUDE_API_KEY`, `OPENAI_API_KEY`
+4. **auth.json file**: API keys section
+5. **Interactive prompt**: Ask user
+
+---
+
+## Comparison
+
+| Method | Setup | Cost | Renewal |
+|--------|-------|------|---------|
+| **API Key** | `export CLAUDE_API_KEY=...` | Pay-as-you-go | Manual |
+| **Subscription OAuth** | `ml-agent login claude` | Monthly subscription | Auto |
+
+---
+
+## Examples
+
+### Example 1: Use Claude Pro (subscription)
+
+```bash
+# First time
+ml-agent login claude
+# → Opens claude.ai, you authenticate
+# → Token saved to auth.json
+
+# Next runs
+python3 run_agent.py
+# → Automatically uses Claude Pro
+```
+
+### Example 2: Use ChatGPT Plus (subscription)
+
+```bash
+ml-agent login openai
+python3 run_agent.py
+```
+
+### Example 3: Mix API Keys + Subscriptions
+
+```bash
+export CLAUDE_API_KEY="sk-ant-..."  # API key
+ml-agent login openai               # Subscription
+
+python3 run_agent.py
+# → Uses ChatGPT Plus (subscription) first
+# → Falls back to Claude API key if needed
+```
+
+---
+
+## Troubleshooting
+
+### "No credentials found"
+
+Check what you have configured:
+
+```bash
+ml-agent status
+
+# If nothing, do:
+export CLAUDE_API_KEY="sk-ant-..."  # OR
+ml-agent login claude
+```
+
+### "OAuth token expired"
+
+Auto-refreshes on next run. If issues persist:
+
+```bash
+rm ~/.ml-agent/auth.json
+ml-agent login claude  # Re-authenticate
+```
+
+### "Permission denied on auth.json"
+
+Fix permissions:
+
+```bash
+chmod 600 ~/.ml-agent/auth.json
+```
+
+---
+
+## Security
+
+✅ **Safe:**
+- Credentials stored locally (not cloud)
+- `auth.json` has chmod 600 (owner only)
+- OAuth tokens auto-refresh
+- No telemetry or logging of credentials
+
+⚠️ **Be careful:**
+- Don't commit `auth.json` to git
+- Don't share API keys in messages
+- Use subscription auth over API keys when possible
+
+---
+
+## Cost Comparison
+
+### API Key Method
+- **Cost**: Pay Claude/OpenAI directly per token
+- **Example**: 1M tokens ≈ $3-15 depending on model
+- **Best for**: Occasional use, testing
+
+### Subscription Method (Claude Pro / ChatGPT Plus)
+- **Cost**: $20/month (Claude Pro) or $20/month (ChatGPT Plus)
+- **Benefit**: Unlimited usage within allowances
+- **Best for**: Regular/heavy usage
+
+**For ML workflows, subscription usually cheaper!**
+
+---
+
+**Choose your auth method and start using ml-agent! 🚀**

src/ml_agent/auth/manager.py

@@ -5,13 +5,17 @@
     AuthStrategy, EnvVarStrategy, FileStrategy,
     CLIArgStrategy, InteractiveStrategy
 )
+from ml_agent.auth.oauth import OAuthManager, SubscriptionAuthStrategy
 from ml_agent.core.exceptions import AuthenticationError
 
 class AuthManager:
-    """Manages authentication across providers."""
+    """Manages authentication across providers (API keys + OAuth subscriptions)."""
 
     def __init__(self, auth_file: Path = None, cli_api_key: Optional[str] = None):
         self.auth_file = auth_file or Path.home() / ".ml-agent" / "auth.json"
+        self.oauth_manager = OAuthManager()
+        self.subscription_strategy = SubscriptionAuthStrategy()
+
         self.strategies = [
             CLIArgStrategy(cli_api_key),
             FileStrategy(self.auth_file),
@@ -20,16 +24,50 @@ def __init__(self, auth_file: Path = None, cli_api_key: Optional[str] = None):
         ]
 
     def get_api_key(self, provider: str) -> str:
-        """Get API key for provider using resolution order."""
+        """Get API key for provider using resolution order.
+
+        Priority:
+        1. CLI argument
+        2. OAuth subscription (Claude Pro, ChatGPT Plus)
+        3. auth.json file
+        4. Environment variables
+        5. Interactive prompt
+        """
+        # Check for OAuth subscription first
+        if self.subscription_strategy.is_subscribed(provider):
+            if key := self.subscription_strategy.get_api_key(provider):
+                return key
+
+        # Fall back to traditional API key resolution
         for strategy in self.strategies:
             if key := strategy.get_credentials(provider):
                 return key
 
         raise AuthenticationError(
             f"No credentials found for provider '{provider}'. "
-            f"Please provide via CLI, env var, or auth.json"
+            f"Options:\n"
+            f"  1. Login: ml-agent login {provider}\n"
+            f"  2. API Key: ANTHROPIC_API_KEY=... or --api-key\n"
+            f"  3. auth.json: {self.auth_file}"
         )
 
     def validate_provider_auth(self, provider_instance) -> bool:
         """Validate provider credentials."""
         return provider_instance.validate_credentials()
+
+    def get_subscription_status(self, provider: str) -> dict:
+        """Get subscription status for provider."""
+        if self.subscription_strategy.is_subscribed(provider):
+            return self.subscription_strategy.get_subscription_info(provider)
+
+        return {"provider": provider, "authenticated": False, "type": "api_key"}
+
+    def list_subscriptions(self) -> list:
+        """List all active subscriptions."""
+        subscriptions = []
+        for provider in ["claude", "openai", "google", "xai"]:
+            if self.subscription_strategy.is_subscribed(provider):
+                info = self.subscription_strategy.get_subscription_info(provider)
+                subscriptions.append(info)
+
+        return subscriptions