chore(cloud): drop the legacy ~/.agent-relay auth fallback

[willwashburn]

What

Removes the last .agent-relay reference in the cloud auth store. The canonical credential file already moved to ~/.agentworkforce/relay/cloud-auth.json; .agent-relay only lingered as LEGACY_AUTH_FILE_PATH + a migrate-on-read shim. This deletes both so the CLI never reads/writes a ~/.agent-relay directory for auth.

Changes (packages/cloud)

• types.ts — delete LEGACY_AUTH_FILE_PATH.
• auth.ts — drop the legacy import and the legacy read/migrate-on-read branch. readStoredAuth now = env auth → canonical file → null.
• index.ts — stop re-exporting LEGACY_AUTH_FILE_PATH.
• auth.test.ts — replace the "migrates legacy auth" test with one asserting the .agent-relay path is never read and no write/rename happens.

Scope

Auth store only, by request. The other, unrelated ~/.agent-relay directories — sandbox runtime state (cloud), telemetry (relay-broker, relay-tui), binary cache (relayfile), workflow run-db (relayflows) — are separate concepts and tracked as a follow-up phase.

agent-relay update/uninstall still removes the old .agent-relay install dir (core-maintenance.ts keeps it in INSTALL_DIR_NAMES on purpose — that helps eliminate it from machines).

⚠️ Behavior change (minor)

A machine whose creds exist only at ~/.agent-relay/cloud-auth.json (never re-authed since the canonical move) will no longer be auto-migrated and must re-run agentworkforce login. Current 4.x users already have creds at ~/.agentworkforce/relay/ and are unaffected. If you'd rather keep the migrate-on-read shim for one more release before deleting, say so and I'll restore just the read (without the .agent-relay constant lingering elsewhere).

Verified

• npm --prefix packages/cloud run build (tsc) clean.
• vitest run packages/cloud/src/auth.test.ts → 25/25 pass.
• No residual LEGACY_AUTH_FILE_PATH references in source.

Follow-ups (not in this PR)

• Stale doc comments in pear/pear-mobile src/main/auth.ts still mention the ~/.agent-relay fallback (separate repos, comment-only).
• Phase 2: the 4 non-auth .agent-relay dirs across cloud/relay-broker/relay-tui/relayfile/relayflows.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 374485a9-93ae-4e60-adbe-683cbf09f130

📥 Commits

Reviewing files that changed from the base of the PR and between fed9174 and 7af677c.

📒 Files selected for processing (4)

• packages/cloud/src/auth.test.ts
• packages/cloud/src/auth.ts
• packages/cloud/src/index.ts
• packages/cloud/src/types.ts

💤 Files with no reviewable changes (2)

• packages/cloud/src/types.ts
• packages/cloud/src/index.ts

---

📝 Walkthrough

Walkthrough

Removes LEGACY_AUTH_FILE_PATH from types.ts, replacing it with AUTH_FILE_PATH under ~/.agentworkforce. The readStoredAuth function in auth.ts drops the legacy .agent-relay file read/migrate fallback and returns readCanonicalStoredAuth() directly. The package entrypoint and tests are updated to match.

Changes

Legacy Auth Path Removal

Layer / File(s)	Summary
AUTH_FILE_PATH replaces LEGACY_AUTH_FILE_PATH in types and exports packages/cloud/src/types.ts, packages/cloud/src/index.ts	LEGACY_AUTH_FILE_PATH constant is removed and AUTH_FILE_PATH pointing to ~/.agentworkforce/relay/cloud-auth.json is added; the package entrypoint drops the LEGACY_AUTH_FILE_PATH re-export.
readStoredAuth drops legacy migration fallback packages/cloud/src/auth.ts	LEGACY_AUTH_FILE_PATH is removed from imports; the legacy-file read/validate/migrate block (including writeStoredAuth() call and try/catch) is replaced with a direct return readCanonicalStoredAuth().
Tests updated for null-return behavior packages/cloud/src/auth.test.ts	Import updated to reference only AUTH_FILE_PATH; the legacy-migration test is replaced with an assertion that absent canonical auth resolves to null with no .agent-relay reads or write/rename side effects.

Possibly related issues

• factory-sdk: delegate cloud creds to the shared cloud#2108 session module (retire factory-local read+persist) pear#324: This PR removes legacy auth path support and consolidates readStoredAuth to use only the canonical auth location, which directly supports the infrastructure expected by that issue for shared cloud credential handling.

Possibly related PRs

• AgentWorkforce/relay#1128: Both PRs modify readStoredAuth in packages/cloud/src/auth.ts and auth.test.ts — this PR removes the legacy .agent-relay migration fallback while #1128 refactors the read/refresh/write flow with atomic writes and locks, making the migration logic directly overlapping.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🐇 No more .agent-relay to roam,
The canonical path leads us home.
AUTH_FILE_PATH shines bright and new,
No migration, no fallback to do.
The null returns clean — hip hip hooray! 🎉

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and concisely describes the main change: removing legacy auth fallback support, which is the primary focus of all file modifications.
Description check	✅ Passed	The description comprehensively covers the PR changes, testing, and behavior implications, but lacks explicit test plan checkboxes from the template.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/cloud-auth-drop-agent-relay-legacy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request removes the legacy migrate-on-read shim for authentication files. Specifically, it deletes the LEGACY_AUTH_FILE_PATH constant, removes the fallback logic in readStoredAuth that migrated legacy .agent-relay authentication files to the canonical .agentworkforce/relay path, and updates the corresponding unit tests to verify that legacy paths are no longer read or written. There are no review comments, so I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.