docs(agent): Update agent documentation

Update agent.md with latest implementation details.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

docs/agent.md

@@ -94,6 +94,23 @@ The `OutputHandler` processes JSONL streams from Claude CLI:
 
 For providers without structured output, the generic line parser accumulates raw text.
 
+## Credential Management
+
+`AccountCredentialManager` in `credentials/` handles OAuth token lifecycle:
+- `read()` — extracts `claudeAiOauth` from `.credentials.json`. Only `accessToken` is required; `refreshToken` and `expiresAt` may be null (setup tokens).
+- `isExpired()` — returns false when `expiresAt` is null (setup tokens never "expire" from our perspective).
+- `ensureValid()` — if expired and `refreshToken` exists, refreshes. If expired with no `refreshToken`, returns invalid with error.
+
+### Setup Tokens
+
+Setup tokens (from `claude setup-token`) are long-lived OAuth access tokens with no refresh token or expiry. Register via:
+
+```sh
+cw account add --token <token> --email user@example.com
+```
+
+Stored as `credentials: {"claudeAiOauth":{"accessToken":"<token>"}}` and `configJson: {"hasCompletedOnboarding":true}`.
+
 ## Log Chunks
 
 Agent output is persisted to `agent_log_chunks` table: