refactor(config): simplify credential passing — eliminate cache, use env vars directly#480
Merged
zbigniewsobiecki merged 1 commit intodevfrom Feb 22, 2026
Merged
Conversation
…env vars directly Credentials are immutable during a worker run. The previous three-mechanism approach (JSON blob env var → parse + spread to process.env → populate cache module → credential functions check env + cache + DB guards) is replaced by a single mechanism: router sets individual env vars, credential functions read from process.env. - Router sets individual env vars + CASCADE_CREDENTIAL_KEYS sentinel - Delete loadRouterCredentials() from worker-entry (env vars set by Docker) - Credential functions use CASCADE_CREDENTIAL_KEYS as worker-context guard - getAllProjectCredentials reconstructs map from env var key list - Remove legacy GITHUB_TOKEN fallback in resolveGitHubToken - Remove dead CASCADE_CREDENTIALS/CASCADE_CREDENTIALS_PROJECT_ID from scrub list Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CASCADE_CREDENTIALS), plusCASCADE_CREDENTIAL_KEYSas a comma-separated key list sentinelloadRouterCredentials()from worker-entry — env vars are already set by Docker, no parsing neededCASCADE_CREDENTIAL_KEYSas the worker-context guard (replaces cache-based guard)GITHUB_TOKENfallback inresolveGitHubToken— all projects use dual-persona tokens, let errors propagateCASCADE_CREDENTIALS,CASCADE_CREDENTIALS_PROJECT_ID)Before: Router → JSON blob env var → Worker parses JSON → spreads to
process.env→ populates cache module → credential functions checkprocess.env+ cache + DB fallback guards. Three mechanisms.After: Router sets individual env vars → credential functions read from
process.env→ done. One mechanism.Test plan
npm run typecheck— cleannpm run lint— cleannpm test— all 2515 tests pass (156 files)CASCADE_CREDENTIAL_KEYSenv var🤖 Generated with Claude Code