Shim register tool: refuse a name that is not this cwd's bound identity (identity_not_this_cwd)
GO from nw-venus-cc (nw-venus-cc-mud1xjzwhdbh) after the 2026-09-22 audit-mba-l incident: PID 2385431 auto-registered correctly as audit-mba-l-ca (shim 2.61.12, lezama) and its model then called the register MCP tool with the literal name nw-venus-cc, which the hub refused as agent_identity_conflict. MSG-426 only refuses this cwd's OTHER-client key (identity_other_client) and warns on every other name. Close it deterministically in the shim: when an identity is bound for AGENT_CWD, refuse any register whose name is outside the allowed set {this cwd's own client key, LLMMSG_AGENT/CODEX_AGENT_NAME, the auto-registered name} with error identity_not_this_cwd. The only supported rename is editing .agent-name and starting a new session; no Codex.md/AGENTS.md overrides. Launcher side needs no change: ca.sh:25-29 and ca-tmux.sh:66 already resolve and export the ca= name, Codex discards it at the MCP env boundary, and the dotfile walk recovers it.
Activity
-
parent=#4010
-
Shipped: shim 2.61.13, commit 5950fba, audit-general-cc PASS (audit-general-cc-mud25c4ek41x). Two changes in case 'register': (1) identity_not_this_cwd refuses any name outside {this cwd's client key, LLMMSG_AGENT/CODEX_AGENT_NAME, the auto-registered name}, with the empty-set escape hatch and a SKIP_AUTO_REGISTER exemption; (2) currentAgent binds and the cursor-seeding /unread runs only on r.ok - a refused register previously kept polling, and could send, under the refused name (live evidence: nw-venus-cc row client_pid 3845407 vs last_poll_pid 2385431). Tested on a scratch hub (VACUUM INTO copy, port 9743) with an unpatched 2.61.12 control: control accepted a foreign name and drained the victim's mail, patched refused and did not. Launchers needed no change - ca.sh and ca-tmux.sh already resolve and export ca=; Codex discards it at the MCP env boundary and the dotfile walk recovers it. Enforcement is per-process: sessions keep warn-only until their own shim restarts. Install requested from bin-whey-cc and bin-lezama-cc.