pub(crate) fn carry_agent_uid_env(
env_vars: &mut HashMap<String, String>,
identity: Option<&PersistedAgentIdentity>,
)Expand description
Identity M1 — spec §9.1: carry the UID and the token into the process.
AGENTMUX_AGENT_UID and AGENTMUX_AGENT_TOKEN are RESERVED,
server-controlled values in exactly the sense AGENTMUX_AUTH_KEY and
AGENTMUX_BLOCKID are at the top of build_persistent_spawn_env:
unconditional insert, never entry().or_insert(). A persisted
cmd:env carrying a stale value for either — a pane reused for a
different agent, a copied block — must not survive into this spawn, and
for the token specifically a stale value would be another agent’s
credential. So when the server knows the identity it overwrites, and
when it does not (no row: quick-launch pane, or a lookup failure) it
removes both rather than leaving whatever was there.
Spec §4.1: identity is asserted by whoever minted it. The frontend is
not consulted (its agentInstanceId is documented as going stale on
pane reuse), and the agent is not asked. The row is the source.
Descendant inheritance is real and not claimed otherwise (spec §6.4):
the agent’s own subprocesses — its shell tool, its MCP servers, build
scripts — inherit the token. That is a smaller blast radius than the
instance-wide AGENTMUX_AUTH_KEY they already inherit, not zero. The
.mcp.json agent_config.rs writes into the working directory carries
neither variable (it copies only AGENTMUX_AGENT_ID/_BUS_ID), so the
token never lands in a file a human may commit.