Problem

In a shared workspace, Git uses the workspace owner's identity and credentials for every user who connects, including users with only the use role.
#31152 documents this behavior and the manual workarounds.

• Commit identity: templates commonly set GIT_AUTHOR_* and GIT_COMMITTER_* from data.coder_workspace_owner.me at build time.
• Git over SSH: coder gitssh fetches the owner's key (GetGitSSHKey(ctx, workspace.OwnerID) in coderd/gitsshkey.go).
• Git over HTTPS: workspaceAgentsExternalAuth in coderd/workspaceagents.go looks up the external auth link by workspace.OwnerID.

To work as themselves, shared users must export GIT_AUTHOR_* in every shell, forward their SSH agent, or sign in to a tool such as the GitHub CLI.
Every one of these overrides is visible to the other users of the workspace.

Proposal

Suggested by @matifali in #31152 (comment).

Coder knows which user connects to a shared workspace, so it could set the commit identity for that user's session automatically.
It could also resolve external auth tokens for the connecting user instead of the owner.

Constraints to investigate

1. The agent doesn't know who is connected over SSH.
   ReportConnection in coderd/agentapi/connectionlog.go leaves UserID unset with the comment "It's not possible to tell which user connected."
   feat: log tailnet tunnels to the connection log  #27423 records the user in coderd when the tailnet tunnel opens, but it doesn't pass that identity to the agent or to the SSH session.
2. Template env vars override per-session env.
   In updateCommandEnv in agent/agent.go, coder_agent env vars from the manifest override the session environment, so coder ssh -e GIT_AUTHOR_NAME=... has no effect when the template sets GIT_AUTHOR_*.
   A per-user identity must take precedence over template values, or templates must stop setting these variables.
3. External auth is requested with the shared agent token.
   coder gitaskpass and coder external-auth access-token call the agent API with the workspace's agent token, so coderd can't tell which user is asking.
4. All users share one OS user and home directory.
   A token injected into one user's session is readable by other users through the process environment, Git credential caches, or files in $HOME.
   Per-user external auth needs an isolation design, not only plumbing.
5. Some processes aren't tied to one connection.
   Long-running processes, such as code-server started once for the workspace, have no single connecting user.

Generated by Coder Agents on behalf of @nickvigilante.