🤖 feat: devcontainer git parity for worktrees on managed hosts

[ethanndickson]

Summary

Devcontainer workspaces running inside Coder now automatically receive the host's credential environment — git authentication, SSH proxying, git identity, and the /.coder-agent/coder binary — without any manual devcontainer.json workarounds.

Closes #2767

Background

When Mux runs inside a Coder workspace and uses devcontainers, the Coder agent sets up critical environment variables (GIT_ASKPASS, GIT_SSH_COMMAND, CODER_*, git identity) and mounts /.coder-agent/coder on the host. These were not being forwarded into the devcontainer, breaking OIDC git auth, SSH-based git operations, and commit identity for both agent commands and terminal sessions.

Additionally, worktree-based workspaces broke inside the container because git's .git file references a gitdir path outside the mounted workspace — the parent .git/ directory was not bind-mounted.

Users had to manually configure mounts and containerEnv in devcontainer.json as workarounds.

Implementation

Credential forwarding (credentialForwarding.ts)

New pure utility module (no runtime imports) with structured resolvers:

• resolveHostCredentialEnv() — scans process.env for an allowlist of credential-related vars (GIT_ASKPASS, GIT_SSH_COMMAND, CODER_* prefix, git identity vars) and returns them as a record.
• resolveCoderAgentMount() — returns a BindMount for /.coder-agent/ if the directory exists on the host.
• resolveGitdirMount(workspacePath) — follows .git files (worktree indicator) to resolve the parent .git/ directory and returns a BindMount for it.
• resolveSshAgentForwarding() — returns structured SSH socket paths when SSH_AUTH_SOCK exists.

Type-safe bind mounts (BindMount)

BindMount = { source, target } is defined alongside the producers. The single formatting point (type=bind,source=...,target=...) lives in devcontainerCli.ts where --mount args are serialized. This makes it type-impossible to add Docker-only options (like readonly) that the devcontainer CLI rejects.

Deterministic env hydration (DevcontainerRuntime.ts)

Container requirements (mounts + env) are derived runtime state, hydrated at every entry boundary:

• setCurrentWorkspacePath() now calls refreshContainerRequirements() immediately — this is the terminal creation path.
• getContainerEnv() self-heals with a lazy refresh if workspace path exists but cache is empty.
• postCreateSetup() and ensureReady() both use the same refreshContainerRequirements() wrapper.

This ensures terminal sessions get identical credential env as agent exec() commands, regardless of lifecycle ordering.

PTY integration (ptyService.ts)

The devcontainer terminal branch reads runtime.getContainerEnv() and forwards each entry as --remote-env flags to devcontainer exec. No changes needed here — the relay was already correct; the fix was upstream in the runtime.

Validation

• Tested manually in a real Coder workspace (dev.pog2.me.coder):
  • Terminal: env | grep -E '^(GIT_|CODER_)' shows all expected vars
  • Terminal: git fetch origin succeeds with OIDC auth
  • Terminal: /.coder-agent/coder is mounted and executable
  • Agent exec: all vars present, git operations work
• 44 unit tests pass across touched files (8 credentialForwarding + 33 DevcontainerRuntime + 3 devcontainerCli)

Risks

• Low: setCurrentWorkspacePath() now does I/O (checking /.coder-agent existence, reading .git files). These are synchronous fs calls on local paths — fast and already present in the ensureReady() path.
• None for non-Coder environments: all resolvers gracefully return null/{} when Coder env vars and paths don't exist. Non-Coder devcontainer workflows are unaffected.

---

Generated with mux • Model: anthropic:claude-opus-4-6 • Thinking: xhigh • Cost: $37.33

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fdb143473c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ethanndickson]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".