Skip to main content

inject_identity_env_with_broker

agentmux_srv::identity::resolver::inject

Function inject_identity_env_with_broker 

Source 
pub fn inject_identity_env_with_broker(
    mstore: Arc<Store>,
    id_store: Arc<Store>,
    identity_store: Arc<Store>,
    broker: Option<Arc<Broker>>,
    block_id: &str,
    env_vars: &mut HashMap<String, String>,
) -> Result<(), SpawnGateError>
Expand description

Before touching gate_oauth_failure / inject_identity_env_with_broker: this module is where SPEC_PROVIDER_ISOLATION_2026_06_20.md’s INV-A (“never the user’s global ~/.<P> dir”) is enforced — or, once already, silently stopped being enforced. Read docs/retro/retro-auth-isolation-invariant-silently-orphaned-2026-07-14.md first. Short version: an unbound oauth-class provider used to auto-route to an AgentMux-owned isolated dir (no user action, no global exposure); a 2026-07-08 refactor orphaned that path without meaning to, and it was never restored. Today’s gate always blocks an unbound oauth-class provider; the per-agent “true ambient” opt-out (use_ambient_login) is no longer read.