pub fn credentials_dir_if_file_backed(
claude_config_host_dir: &str,
) -> Option<String>Expand description
The account config dir to hand to ContainerMountSpec::claude_config_host_dir,
or None when this account has no file-backed credential to mount.
The existence check is load-bearing, not defensive tidiness (codex P1 on PR
#2933). On macOS Claude Code keeps OAuth credentials in the encrypted
Keychain and never writes this file at all — see
identity/resolver/oauth_probe.rs and
docs/retro/retro-macos-keychain-credential-isolation-gap-2026-08-17.md.
Binding a source that does not exist makes Docker reject create_container
outright, so an unguarded bind would turn “container agents cannot
authenticate on macOS” into “container agents cannot START on macOS” — a
strictly worse failure than the one this fix exists to remove.
Returning None degrades to exactly the previous behavior (an empty per-agent
volume) instead, and logs why. Keychain-backed provisioning is a separate
piece of work; this only guarantees we do not regress it.