Redirect direct backend git global config to an isolated per-task file by jasonkeung · Pull Request #77 · warpdotdev/oz-agent-worker

jasonkeung · 2026-05-28T21:27:22Z

Problem

When oz-local is run locally by developers, an insteadOf entry gets written to the user's gitconfig, redirecting ssh urls to https. This is not desirable for developers because we generally prefer ssh auth and we get errors when trying to push to git.

Description

The direct backend runs the oz CLI directly on the host, so git config --global writes from the agent (notably the url.<host>.insteadOf rewrites configured by the warp driver) persisted into the real ~/.gitconfig when running locally (oz-local). Docker and Kubernetes backends are unaffected because their home is ephemeral.

This sets GIT_CONFIG_GLOBAL to a per-task .gitconfig for the direct backend (inside the per-task workspace, or a temporary directory in shared --target-dir mode), applied to the agent invocation and the setup/teardown commands. Those global writes now stay isolated and are cleaned up with the task. The agent git operations during the run still work because they inherit GIT_CONFIG_GLOBAL.

Intentionally out of scope

HOME is left unchanged, so the plaintext credential files the driver writes (~/.git-credentials, ~/.config/gh/hosts.yml) still go to the real home. That is deliberate for this change. Source-side hardening is tracked in warpdotdev/warp#11886.

Testing

ran oz-local and did not get a git config entry. ran an agent run that used git with no problems.
go vet ./internal/worker
go test ./... includes a new regression test that runs git config --global insteadOf and asserts it lands in the per-task config, not the real ~/.gitconfig.

warpdotdev/warp-agent-docker#109 — removes the duplicate git-auth setup from the container entrypoint.sh, consolidating to the driver. Complementary, container-only; does not run on the direct/local path, so it does not address this bug.
REMOTE-1370 phases 4/5 (warp-server) — migrate token delivery from env vars to the taskGitCredentials query and clean up; orthogonal to where git config is written, so they do not fix the home pollution.
Harden Oz git credential setup: avoid persistent --global writes and plaintext credential files warp#11886 — the REMOTE-1370 "git credential helper mode" follow-up; the durable source-side fix that would eliminate persistent --global writes and plaintext credential files across all backends.

Oz

Conversation: https://staging.warp.dev/conversation/370f424c-2dc3-4fe1-b4a6-c3c39dcc70fe

Co-Authored-By: Oz oz-agent@warp.dev

The direct backend runs the oz CLI directly on the host, so git config --global writes from the agent (notably the url.<host>.insteadOf rewrites set up by the warp driver) persisted into the real ~/.gitconfig. Set GIT_CONFIG_GLOBAL to a per-task .gitconfig (inside the per-task workspace, or a temp dir in shared --target-dir mode) for the agent invocation and the setup/teardown commands, so those global writes stay isolated and are removed with the task. HOME is left unchanged, so the plaintext credential files the driver writes (~/.git-credentials, ~/.config/gh/hosts.yml) are intentionally untouched. Docker and Kubernetes backends are unaffected. Add a regression test that runs git config --global insteadOf and asserts it lands in the per-task config rather than the real ~/.gitconfig. Co-Authored-By: Oz <oz-agent@warp.dev>

The direct backend joins the server-provided task ID with the workspace root and uses it as a temp-dir name component. A task ID that is absolute or contains ".." could escape the intended directory (CodeQL go/path-injection). Reject non-local task IDs via filepath.IsLocal before any path is constructed, and add a regression test. Co-Authored-By: Oz <oz-agent@warp.dev>

Co-Authored-By: Oz <oz-agent@warp.dev>

harryalbert

nice! Just had one question about gating

harryalbert · 2026-05-29T20:33:57Z

+// global config keeps writes like `git config --global url.<x>.insteadOf` out of
+// the developer's real ~/.gitconfig (and $XDG_CONFIG_HOME/git/config) without
+// repointing HOME for every tool the agent runs.
+func prepareTaskGitConfig(workspaceDir string, usingTargetDir bool) (string, func(), error) {


it seems like we're not gating this on the oz-local script — OOC is there a reason to do this across the board instead of limiting to only when debugging (maybe self hosted)?

We should definitely use a per-task config file for any run with the direct backend. There may be multiple concurrent runs on the same host, and while we can't fully isolate them, we should do so as much as possible.

I also dont think its as straight forward to differentiate between selfhosted workers (used by real clients) and local, and ideally our oz-local is as similar to real production behavior as possible too

bnavetta · 2026-06-01T07:50:12Z

+// global config keeps writes like `git config --global url.<x>.insteadOf` out of
+// the developer's real ~/.gitconfig (and $XDG_CONFIG_HOME/git/config) without
+// repointing HOME for every tool the agent runs.
+func prepareTaskGitConfig(workspaceDir string, usingTargetDir bool) (string, func(), error) {


We should definitely use a per-task config file for any run with the direct backend. There may be multiple concurrent runs on the same host, and while we can't fully isolate them, we should do so as much as possible.

bnavetta · 2026-06-01T07:51:22Z

+		return err
+	}
+	defer cleanupGitConfig()
+	gitConfigEnv := []string{fmt.Sprintf("GIT_CONFIG_GLOBAL=%s", gitConfigPath)}


We may need to escape the path, in case the workspace dir is set to something with spaces

added testing for a workspace path with spaces. Since we are using exec.Cmd.Env, it shouldnt need escaping

github-advanced-security AI found potential problems May 28, 2026

View reviewed changes

Comment thread internal/worker/direct.go Fixed

Comment thread internal/worker/direct.go Fixed

jasonkeung force-pushed the jason/isolate-direct-backend-home branch from 9045d9d to 2fc5a48 Compare May 29, 2026 17:04

jasonkeung mentioned this pull request May 29, 2026

Harden Oz git credential setup: avoid persistent --global writes and plaintext credential files warpdotdev/warp#11886

Open

jasonkeung changed the title ~~Isolate direct backend task home~~ Redirect direct backend git global config to an isolated per-task file May 29, 2026

github-advanced-security AI found potential problems May 29, 2026

View reviewed changes

Comment thread internal/worker/direct.go Fixed

jasonkeung force-pushed the jason/isolate-direct-backend-home branch from ea226ea to ac86713 Compare May 29, 2026 17:53

jasonkeung force-pushed the jason/isolate-direct-backend-home branch from ac86713 to 12c79c2 Compare May 29, 2026 18:14

jasonkeung marked this pull request as ready for review May 29, 2026 18:20

Add direct backend git config setup tests

fceda8d

Co-Authored-By: Oz <oz-agent@warp.dev>

jasonkeung requested review from bnavetta and harryalbert May 29, 2026 19:58

harryalbert approved these changes May 29, 2026

View reviewed changes

bnavetta approved these changes Jun 1, 2026

View reviewed changes

jasonkeung merged commit b0cac0e into main Jun 1, 2026
8 checks passed

jasonkeung deleted the jason/isolate-direct-backend-home branch June 1, 2026 17:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Redirect direct backend git global config to an isolated per-task file#77

Redirect direct backend git global config to an isolated per-task file#77
jasonkeung merged 3 commits into
mainfrom
jason/isolate-direct-backend-home

jasonkeung commented May 28, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

harryalbert left a comment

Uh oh!

harryalbert May 29, 2026

Uh oh!

bnavetta Jun 1, 2026

Uh oh!

jasonkeung Jun 1, 2026

Uh oh!

bnavetta Jun 1, 2026

Uh oh!

bnavetta Jun 1, 2026

Uh oh!

jasonkeung Jun 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

jasonkeung commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Description

Intentionally out of scope

Testing

Related

Oz

Uh oh!

Uh oh!

Uh oh!

Uh oh!

harryalbert left a comment

Choose a reason for hiding this comment

Uh oh!

harryalbert May 29, 2026

Choose a reason for hiding this comment

Uh oh!

bnavetta Jun 1, 2026

Choose a reason for hiding this comment

Uh oh!

jasonkeung Jun 1, 2026

Choose a reason for hiding this comment

Uh oh!

bnavetta Jun 1, 2026

Choose a reason for hiding this comment

Uh oh!

bnavetta Jun 1, 2026

Choose a reason for hiding this comment

Uh oh!

jasonkeung Jun 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jasonkeung commented May 28, 2026 •

edited

Loading