Remove deprecated `container.credentials_host_path` backwards-compat in favor of `credentials_host_dir` #77

New issue

Closed

opened 2026-04-19 00:36:10 +00:00 by claude-desktop · 0 comments

claude-desktop commented

2026-04-19 00:36:10 +00:00

Collaborator

User story

As a maintainer, I want the backwards-compat path that accepts
container.credentials_host_path (a file) in agents.json removed,
so that the config surface has exactly one way to name the credentials
bind source and the compat code doesn't outlive the migration window
it was written for.

Context

Issue #57 added directory-mount support for the credentials bind, with
an explicit migration window:

New path (preferred): container.credentials_host_dir — the
bind-source directory. Survives claude login inode refreshes.
Old path (deprecated): container.credentials_host_path — a
file path. The code resolves dirname(…) as the directory.

Every agents.json entry on main today uses the new key. No
production config still relies on the old one. The compat branch in
the loader has done its job and can come out.

Removal keeps the config schema simpler and deletes a @deprecated
function that's become dead-code on the happy path.

Scope — concrete

Code

src/container.ts: remove the @deprecated
defaultHostCredentialsPath() function. Its only remaining
callers are tests that lock the legacy path.
src/webhook-config.ts: remove the
dirname(credentials_host_path) fallback in loadWebhookConfig.
Keep the credentials_host_dir branch + the default-path
branch.
Operators who still had credentials_host_path in their
agents.json would now see a undefined credentials dir →
service defaults to defaultHostCredentialsDirPath(). That's
a deliberate break — the config was wrong anyway; fix the
config.

Tests

Remove tests in src/webhook-config.test.ts and
src/container.test.ts that specifically exercise the
credentials_host_path → dirname branch and the
defaultHostCredentialsPath() function.
Keep (and update if needed) every test that covers the
credentials_host_dir branch and the default fallback.

Docs

CLAUDE.md: grep for any mention of credentials_host_path
and remove.
justfile containers-rebuild recipe: the compat-resolution
block (creds_file=$(jq -r … credentials_host_path …)) can go
— leaves only the credentials_host_dir lookup and the
default fallback.

Out of scope

Renaming credentials_host_dir. The key name stays as-is.
Removing defaultHostCredentialsDirPath(). That's the default
used when no per-agent override is set; it stays.
Changing per-agent credentials_host_dir values. Every agent
on main already uses the new key; nothing needs edits in
agents.json.

References

Issue #57 — original migration that introduced the directory
mount and the compat path.
PR #67 — container-mode enablement that first populated the new
key per agent.
PR #75 — per-agent plugin enablement that made every agent opt
into the new key.

Dependencies

Blocked by: nothing.
Blocks: nothing user-facing.
Branch off: main.

Validation note

This ticket doubles as the first container-mode dispatch for dev
(see #76's AC). Successful end-to-end completion — worktree in
container, git auth via the shim, just qa green inside the
container, PR opened — is itself the signal that dev's
container-mode migration works for the implement / PR flow.

## User story As a **maintainer**, I want the backwards-compat path that accepts `container.credentials_host_path` (a file) in `agents.json` removed, so that the config surface has exactly one way to name the credentials bind source and the compat code doesn't outlive the migration window it was written for. ## Context Issue #57 added directory-mount support for the credentials bind, with an explicit migration window: - **New path** (preferred): `container.credentials_host_dir` — the bind-source directory. Survives `claude login` inode refreshes. - **Old path** (deprecated): `container.credentials_host_path` — a file path. The code resolves `dirname(…)` as the directory. Every `agents.json` entry on `main` today uses the new key. No production config still relies on the old one. The compat branch in the loader has done its job and can come out. Removal keeps the config schema simpler and deletes a `@deprecated` function that's become dead-code on the happy path. ## Scope — concrete ### Code - [ ] `src/container.ts`: remove the `@deprecated` `defaultHostCredentialsPath()` function. Its only remaining callers are tests that lock the legacy path. - [ ] `src/webhook-config.ts`: remove the `dirname(credentials_host_path)` fallback in `loadWebhookConfig`. Keep the `credentials_host_dir` branch + the default-path branch. - [ ] Operators who still had `credentials_host_path` in their `agents.json` would now see a `undefined` credentials dir → service defaults to `defaultHostCredentialsDirPath()`. That's a deliberate break — the config was wrong anyway; fix the config. ### Tests - [ ] Remove tests in `src/webhook-config.test.ts` and `src/container.test.ts` that specifically exercise the `credentials_host_path` → `dirname` branch and the `defaultHostCredentialsPath()` function. - [ ] Keep (and update if needed) every test that covers the `credentials_host_dir` branch and the default fallback. ### Docs - [ ] `CLAUDE.md`: grep for any mention of `credentials_host_path` and remove. - [ ] `justfile` `containers-rebuild` recipe: the compat-resolution block (`creds_file=$(jq -r … credentials_host_path …)`) can go — leaves only the `credentials_host_dir` lookup and the default fallback. ## Out of scope - **Renaming `credentials_host_dir`**. The key name stays as-is. - **Removing `defaultHostCredentialsDirPath()`**. That's the default used when no per-agent override is set; it stays. - **Changing per-agent `credentials_host_dir` values.** Every agent on `main` already uses the new key; nothing needs edits in `agents.json`. ## References - Issue #57 — original migration that introduced the directory mount and the compat path. - PR #67 — container-mode enablement that first populated the new key per agent. - PR #75 — per-agent plugin enablement that made every agent opt into the new key. ## Dependencies - **Blocked by:** nothing. - **Blocks:** nothing user-facing. - **Branch off:** `main`. ## Validation note This ticket doubles as the first container-mode dispatch for `dev` (see #76's AC). Successful end-to-end completion — worktree in container, git auth via the shim, `just qa` green inside the container, PR opened — is itself the signal that dev's container-mode migration works for the `implement` / PR flow.

claude-desktop added the

area:infra

type:user-story

labels

2026-04-19 00:36:32 +00:00