From c317d948b164ffe42efc61afc9d4fa4e03f5ec5f Mon Sep 17 00:00:00 2001
From: daniel <daniel@ness.family>
Date: Sat, 9 May 2026 14:20:24 -0500
Subject: [PATCH] Migrate primary to labeled path, remove all flat-path
 fallback logic

---
 agentclaw/app/agent_claw_main/main.py                  |  9 ---------
 .../app/agent_claw_main/tools/google_workspace.py      | 10 ++--------
 2 files changed, 2 insertions(+), 17 deletions(-)

diff --git a/agentclaw/app/agent_claw_main/main.py b/agentclaw/app/agent_claw_main/main.py
index c3f7689..93168e4 100644
--- a/agentclaw/app/agent_claw_main/main.py
+++ b/agentclaw/app/agent_claw_main/main.py
@@ -127,15 +127,6 @@ def list_google_accounts() -> str:
                         accounts[label] = val.get('email', s['Name'])
                     except Exception:
                         accounts[label] = s['Name']
-            # Also check flat path as 'primary' if not already in labeled list
-            if 'primary' not in accounts:
-                flat = f'agent-claw/google-credentials/{safe_actor_id}'
-                try:
-                    import json as _json2
-                    val = _json2.loads(sm.get_secret_value(SecretId=flat)['SecretString'])
-                    accounts['primary'] = val.get('email', flat)
-                except Exception:
-                    pass
             if accounts:
                 parts = [f'{label} ({email})' for label, email in accounts.items()]
                 return 'Connected Google accounts: ' + ', '.join(parts)
diff --git a/agentclaw/app/agent_claw_main/tools/google_workspace.py b/agentclaw/app/agent_claw_main/tools/google_workspace.py
index 847be1e..401268c 100644
--- a/agentclaw/app/agent_claw_main/tools/google_workspace.py
+++ b/agentclaw/app/agent_claw_main/tools/google_workspace.py
@@ -98,14 +98,8 @@ def _load_all_creds(actor_id: str) -> dict[str, Credentials]:
     except Exception as e:
         print(f'[google] list_secrets failed: {e}')
 
-    # Always include flat secret as 'primary' if not already in result
-    if 'primary' not in result:
-        flat = f'agent-claw/google-credentials/{safe}'
-        try:
-            result['primary'] = _load_creds_from_secret(flat)
-            print(f'[google] loaded creds from flat path actor={actor_id}')
-        except Exception:
-            pass
+    # Note: all accounts now stored at agent-claw/google-credentials/{actor_id}/{label}
+    # flat path (no label) is legacy and no longer needed
 
     _creds_cache[actor_id] = (now, result)
     return result