Ensure agent ID collisions respect token boundaries (Related to #658)

internal/monitoring/monitor.go

@@ -1344,7 +1344,12 @@ func findMatchingDockerHost(hosts []models.DockerHost, report agentsdocker.Repor
 
 	if agentID != "" {
 		for _, host := range hosts {
-			if strings.TrimSpace(host.AgentID) == agentID {
+			if strings.TrimSpace(host.AgentID) != agentID {
+				continue
+			}
+
+			existingToken := strings.TrimSpace(host.TokenID)
+			if tokenID == "" || existingToken == tokenID {
 				return host, true
 			}
 		}

internal/monitoring/monitor_docker_test.go

@@ -114,6 +114,82 @@ func TestApplyDockerReportGeneratesUniqueIDsForCollidingHosts(t *testing.T) {
 	}
 }
 
+func TestApplyDockerReportUsesTokenToDisambiguateAgentIDCollisions(t *testing.T) {
+	monitor := newTestMonitor(t)
+
+	baseReport := agentsdocker.Report{
+		Agent: agentsdocker.AgentInfo{
+			ID:              "duplicate-agent",
+			Version:         "1.0.0",
+			IntervalSeconds: 30,
+		},
+		Host: agentsdocker.HostInfo{
+			Hostname:         "docker-one",
+			Name:             "Docker One",
+			MachineID:        "machine-A",
+			DockerVersion:    "26.0.0",
+			TotalCPU:         4,
+			TotalMemoryBytes: 16 << 30,
+			UptimeSeconds:    120,
+		},
+		Containers: []agentsdocker.Container{
+			{ID: "container-a", Name: "api"},
+		},
+		Timestamp: time.Now().UTC(),
+	}
+
+	tokenOne := &config.APITokenRecord{ID: "token-one", Name: "Token One"}
+	hostOne, err := monitor.ApplyDockerReport(baseReport, tokenOne)
+	if err != nil {
+		t.Fatalf("ApplyDockerReport hostOne: %v", err)
+	}
+	if hostOne.ID == "" {
+		t.Fatal("expected hostOne to receive an identifier")
+	}
+
+	secondReport := baseReport
+	secondReport.Host.Hostname = "docker-two"
+	secondReport.Host.Name = "Docker Two"
+	secondReport.Host.MachineID = "machine-B"
+	secondReport.Containers = []agentsdocker.Container{
+		{ID: "container-b", Name: "db"},
+	}
+	secondReport.Timestamp = baseReport.Timestamp.Add(30 * time.Second)
+
+	tokenTwo := &config.APITokenRecord{ID: "token-two", Name: "Token Two"}
+	hostTwo, err := monitor.ApplyDockerReport(secondReport, tokenTwo)
+	if err != nil {
+		t.Fatalf("ApplyDockerReport hostTwo: %v", err)
+	}
+
+	if hostTwo.ID == "" {
+		t.Fatal("expected hostTwo to receive an identifier")
+	}
+	if hostOne.ID == hostTwo.ID {
+		t.Fatalf("expected different identifiers for hosts sharing an agent ID, got %q", hostOne.ID)
+	}
+
+	hosts := monitor.state.GetDockerHosts()
+	if len(hosts) != 2 {
+		t.Fatalf("expected 2 hosts after two reports, got %d", len(hosts))
+	}
+
+	updatedReport := baseReport
+	updatedReport.Timestamp = baseReport.Timestamp.Add(60 * time.Second)
+	updatedReport.Containers = append(updatedReport.Containers, agentsdocker.Container{
+		ID:   "container-c",
+		Name: "cache",
+	})
+
+	updatedHostOne, err := monitor.ApplyDockerReport(updatedReport, tokenOne)
+	if err != nil {
+		t.Fatalf("ApplyDockerReport hostOne update: %v", err)
+	}
+	if updatedHostOne.ID != hostOne.ID {
+		t.Fatalf("expected hostOne to retain identifier %q, got %q", hostOne.ID, updatedHostOne.ID)
+	}
+}
+
 func TestApplyDockerReportIncludesContainerDiskDetails(t *testing.T) {
 	timestamp := time.Now().UTC()
 	report := agentsdocker.Report{