feat(compat): keep v0 credential provider names

[notgitika]

Description

v0 projects keep v0's credential provider names. v0 named Identity providers after the bare credential name (my-api-key), and the agent code it deployed looks them up by that name. v1 uses <project>_<target>_<credential>, so using it on a v0 project would create a second set of providers beside the ones in use.

• For project.legacy projects, provisioning, update, reuse, the recorded ARN, rollback and removal all use the bare name. v1 projects are unchanged.
• Teardown and orphan removal never delete API-key or OAuth providers for v0 projects, because v0 credentials can be shared between projects. Payment providers are still deleted, as in v0.
• The runtime _NAME env var, harness permissions, gateway auth and status already take the name from the recorded ARN, so they follow automatically.

The assertV1Project gate from #2575 stays in place; this is a prerequisite for lifting it on deploy.

Builds on #2575, which is now merged.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

• I ran bun test
• End-to-end tests are not applicable: v0 deploy is still gated; covered by unit tests (4125 passed)
• I ran bun run typecheck
• I ran bun run lint:check
• I ran bun run format:check

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

The core change is small and well-scoped: providerName returns the bare credential name when project.legacy is set, and createCredentialRemover short-circuits the delete for v0 API-key/OAuth providers while still removing payment providers (matching v0's own teardown).

Things I checked that look correct:

• providerName is only called from the two sites in this file (createCredentialProvisioner and createCredentialRemover); no other callers rely on the old (projectName, targetName, credentialName) signature.
• rollback only deletes providers added to created on this run, so a reused existing v0 provider ({ reuse: ... } branch in resolveApiKey/resolveOauth2) is never touched by rollback — matching the "reuses the provider v0 created when no secret is available locally" test.
• orphanedCredentials keys are spec names, which flow into providerName(project, ...) in the remover and resolve to the bare name for v0, consistent with how the provisioner records them.
• The teardown path in cdk.ts (providers: [...orphaned, ...project.spec.credentials]) also goes through createCredentialRemover, so v0 API-key/OAuth providers are correctly preserved on teardown too; only payment providers get removed.
• Tests use real temp dirs + a fake Identity client as an in-memory account — appropriate boundary, no excessive mocking.
• No telemetry gap: this is a provisioning-level compat tweak, not a new user-facing surface.

One behavior worth flagging in the PR description (not a code change): with the bare-name scheme, two v0 projects that declare the same payment credential name in the same account/region will fight over that provider on deploy, and either project's teardown will delete it out from under the other. The code comment acknowledges this is intentional parity with v0, but it's a sharp edge worth calling out to reviewers/users.

No blocking issues.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.32%. Comparing base (c901a82) to head (953439f).

Additional details and impacted files

@@            Coverage Diff            @@
##           refactor    #2579   +/-   ##
=========================================
  Coverage     96.32%   96.32%           
=========================================
  Files           670      670           
  Lines         51173    51181    +8     
=========================================
+ Hits          49290    49298    +8     
  Misses         1883     1883           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)