fix(identity): bind identities per session

[andrei-hasna]

Summary

• Add session-keyed identity bindings so separate CLI sessions keep distinct agents.
• Make conversations agents register persist the calling session binding and report its source.
• Preserve explicit and environment identities above the new session rung, with the opted-in machine file as the final compatibility fallback.
• Migrate a matching session binding during self-rename so later processes cannot resurrect the old agent.
• Document the full precedence and migration path.

Test-first evidence

• Before the fix, the distinct-session regression failed because both session processes resolved the shared machine identity.
• Independent review then reproduced a stale session binding after self-rename; its added regression failed before remediation and now proves fresh whoami and heartbeat processes use the renamed agent.
• After the fix, two live session IDs retain distinct identities, rebinding or renaming one leaves the other unchanged, and the machine fallback is not clobbered.

Verification

• bun run typecheck
• bun run build
• focused identity tests: 59 pass, 0 fail
• bun test: 1551 pass, 0 fail, 5043 expectations across 95 files; no skipped or todo count
• git diff --cached --check
• gitleaks staged and exact commit-range scans: no leaks

Task: 0a2639c7-4133-4b0d-8b4b-62085daf5836

Agent: Augustus

[andrei-hasna]

[REVIEW] NO_GO — #82 @ 0ab34bc — lens: correctness+security+gates, reviewer unresolved-account005 (1 of 1)

What I ran

• bun install — exit 0; setup only, 166 packages installed; no pass/fail count.
• bun run typecheck — exit 0; pass; the gate emits no test counts.
• bun run test — exit 0; 1,550 pass, 0 fail, 5,036 assertions across 95 files.
• Runtime reproduction in an isolated worktree-local HOME/database: session-bound agents register exit 0; agents rename review-old review-new --json exit 0; fresh session-bound whoami --json exit 0 but returned review-old; explicit whoami --from review-new --json exit 0 and showed review-new online.
• git diff --check origin/main...HEAD — exit 0.

What I read

• Full diff for all five changed files: README.md, src/cli/commands/agents.ts, src/cli/identity-persistence.e2e.test.ts, src/lib/identity.test.ts, and src/lib/identity.ts.
• Surrounding identity precedence, CLI register/rename/whoami paths, data-directory resolution, presence registration/rename behavior, store routing, MCP identity resolution, and existing rename/session regression coverage.

Blocking P0/P1 findings

1. [P1, high confidence] A session-bound self-rename leaves the higher-precedence session identity on the deleted old name (src/cli/commands/agents.ts, rename path). Source: a real caller sets CONVERSATIONS_SESSION_ID and successfully registers. Flow: agents register persists the new session record, then agents rename updates presence and only the machine-wide identity. Sink/invariant violation: the next process resolves the unchanged session record before the machine fallback and attributes work to the old name, which no longer has presence. The reproduction above returned exactly that state. This violates the PR's session-attribution goal and is material to session/data integrity. Fix: when the current session binding names the renamed agent, atomically rebind that same session to the normalized new name, report write failure, and add a cross-process regression test proving register -> rename -> whoami stays on the new name without touching another session.

Non-blocking follow-ups

• None.

The PR head moved to ab7c558187a38daac9170199115726889517298e while this review was running. This verdict is exact to 0ab34bcc7c1a913719cc74cac7e2c69f30a618bd and is therefore stale for merge; the named P1 and its direct regressions are the focused re-review scope for the new head.

[andrei-hasna]

[REVIEW] GO — #82 @ ab7c558 — lens: correctness+security+gates, reviewer unresolved-account005 (1 of 1)

Focused verification of the prior exact-head P1

• Read the complete 0ab34bcc7c1a913719cc74cac7e2c69f30a618bd..ab7c558187a38daac9170199115726889517298e remediation diff and the directly affected CLI rename/session-binding path and regression test.
• The fix reads the current session binding, rebinds only when that binding names the renamed agent, preserves the separate machine-identity behavior, and reports session-binding persistence failure.
• The new cross-process regression proves register -> rename -> whoami -> heartbeat stays on the renamed agent.

What I ran at ab7c558187a38daac9170199115726889517298e

• bun install — exit 0; setup only; 168 installs checked across 167 packages with no changes; no pass/fail count.
• bun run typecheck — exit 0; pass; the gate emits no test counts.
• bun run test — exit 0; 1,551 pass, 0 fail, 5,044 assertions across 95 files. The named session-bound rename regression passed.

Blocking P0/P1 findings

• None. The prior session-integrity P1 is fixed and its direct regression coverage passes.

Non-blocking follow-ups

• None.