Module identity 

Identity injection at agent CLI spawn time.

When an agent instance is launched, the launch modal records an identity_id on the db_agent_instances row (v7 schema). Right before the CLI subprocess starts, this module:

1. Looks up the active instance for the spawning block.
2. Reads its identity_id (a legacy filter value; credentials come from the links in step 3, not from this).
3. Reads the direct db_agent_identity_links rows for the instance’s definition.
4. For each link: looks up the Account row, resolves its SecretRef to a plaintext value, looks up the provider → env-var matrix, and merges those env vars into the spawn env_vars HashMap.

Failure modes differ by provider class. An api-key-class failure (missing account, unresolvable secret, unknown provider) is logged and skipped. An oauth-class provider with no resolvable bound account blocks the spawn (resolver::inject’s gate_oauth_failure); there is no fallback to the user’s global CLI login.

Closes Phase 2 of issue #678 (the per-instance injection layer). Phase 1 (Account registry + UI) and the v7 schema reshape (Bundle entity) were prerequisites; Phase 3 (encrypted vault, OAuth flows) is deferred.

Re-exports

pub use resolver::inject_identity_env;

Modules

account_email

The login email of an OAuth provider account, read from the account’s own config dir — SPEC_ACCOUNT_EMAIL_IN_ARMORY_2026_09_23.md §4.

auth_diag

Credential-state diagnostics for login/logout robustness runs.

auth_patterns

Per-provider stdout/stderr pattern matchers for the pre-launch OAuth flow. The auth login subprocess of each CLI provider emits an OAuth URL (or device code) to stdout/stderr in a slightly different shape. This module knows how to extract them.

auth_session

In-memory manager for pre-launch OAuth sessions.

browser_credential_store

OS-keychain-backed storage for browser-pane HTTP Basic-Auth credentials, scoped per identity so one agent’s saved site credential is never reachable through another identity’s browsing session.

cleanup

On-disk / keychain credential cleanup for a deleted identity account.

key_validator

Live API-key validation for Connectors → Accounts.

oauth_client

Service-account OAuth 2.0 client for Connectors → Accounts.

resolver

Identity → env-var resolver.

secret_store

srv’s secret storage: account API keys, OAuth accounts, MuxBus credentials, browser-pane logins.