pub fn resolve_account_for_spawn(
id_store: &Arc<Store>,
account_id: &str,
) -> Result<Option<(IdentityAccount, Arc<Store>)>, StoreError>Expand description
SPAWN-PATH account lookup — current channel’s id_store only, never the
global mirror.
Deliberately NOT resolve_account: that function’s global fallback is
correct for read-only/display callers (the Connectors → Accounts list, link
summaries — they should still describe an account that exists elsewhere),
but using it to satisfy a spawn lets an agent in a fresh channel launch
against a credential authenticated in a DIFFERENT channel. That is exactly
the per-channel-isolation bypass the operator asked to close:
“we want per-channel isolation. a user needs a login anytime in the channel. the problem is agents are able to login in a channel without a claude auth.”
This intentionally reverses part of reagentx’s P0 on PR #2632. That
review added the fallback to preserve binding continuity across a
version/channel switch, which was the right call under the then-current
requirement. The requirement has since changed: per-channel isolation is a
wanted feature, and re-login-per-channel is the accepted cost. The fallback
is retained for display paths precisely so that continuity fix isn’t lost
where it was actually about describing an account rather than launching
with one. See
docs/analysis/ANALYSIS_PER_CHANNEL_AUTH_BYPASSES_2026_08_31.md §2 (#1).
No dangling-link deadlock results from the stricter lookup:
db_agent_identity_links is PRIMARY KEY (agent_id, provider), so a
re-login in the new channel REPLACES the link rather than leaving a stale
one that would block every future spawn.