What
Instead of each subsystem reaching for a process-global credential store, callers now pass a credentials value down. It affects API request builders, MCP connect paths, artifact and frame relay calls, model validation, token counting, feedback drafts, plugin and marketplace fetches, and device registration.
Details
- React call sites that previously pulled only the storage handle off the app-context hook now take both it and credentials together.
- The handle exists only when a pinned storage-mode check passes and a storage handle is present; otherwise callers get nothing and the old paths apply.
- Occurrences of the field rise from 151 in 2.1.238 to 599 here.
- Groundwork for per-session and per-account credential isolation; nothing changes for a single-account session.
Evidence
credentials: t.credentials, CredentialsStoreHandle
Strings lifted out of the shipped bundle, so the claim above can be checked against them.