{"version":"2.1.239","anchor":"credentials-are-handed-down-rather-than-read-from-global-sta","canonical_anchor":"credentials-are-handed-down-rather-than-read-from-global-sta","heading":"Credentials are handed down rather than read from global state","tier":"internal","area":"Auth","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.239\/e\/credentials-are-handed-down-rather-than-read-from-global-sta","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.239","markdown":"### Credentials are handed down rather than read from global state\n\nCredentials are now passed explicitly into most subsystems rather than read from a global store.\n\n**What**\n\nInstead of each subsystem reaching for a process-global credential store, callers now pass a `credentials` value down. It affects API request builders, MCP connect paths, artifact and frame relay calls, model validation, token counting, feedback drafts, plugin and marketplace fetches, and device registration.\n\n**Details**\n\n- React call sites that previously pulled only the storage handle off the app-context hook now take both it and credentials together.\n- The handle exists only when a pinned storage-mode check passes and a storage handle is present; otherwise callers get nothing and the old paths apply.\n- Occurrences of the field rise from 151 in 2.1.238 to 599 here.\n- Groundwork for per-session and per-account credential isolation; nothing changes for a single-account session.\n\n**Evidence**\n\n`credentials: t.credentials`, `CredentialsStoreHandle`\n\n- Area: Auth\n- Tier: Under the hood\n- Useful: 1\/5\n- Signal: 3\/5"}