Git was designed for one person per machine. Your name is in a config file, your credentials are in a keychain, and everything that leaves the box carries both. That assumption held for thirty years. It breaks the moment several people prompt the same agent in the same environment, which is exactly what a Coshell drive is.
Here is the failure we kept seeing. A team shares a drive. The agent finishes a feature and, because every coding agent has been trained to run gh pr create, it tries to. There is no gh on the box, so someone pastes a personal access token into the environment to unblock it. From that moment every push and every pull request from that drive, no matter who asked for it, is made by that one person. The commit says Maya. The push says Theo. The PR says Theo. Two weeks later nobody can tell who actually did what, and Theo's token is sitting in a shell history on a machine he shares with six people.
We wanted three things instead. Attribution should follow the prompt, not the machine. No personal secret should ever live on a shared machine. And when the platform does something on your behalf, it should say so, in a place you can check later.
Commits: the person who prompted
On a drive, every prompt carries the identity of the person who sent it. When the agent runs git commit during that turn, the author and committer are the prompter, not a drive-wide identity. If you queue a prompt behind a teammate's, your commit still carries your name when it runs. The email is the one on your Coshell account, so GitHub links the commit to your profile the same way it would from your laptop.
Nothing to configure. There is no git config user.name step for a shared drive because there is no single user.
Pushes: the drive never holds your token
The drive does not push with anyone's personal credentials. Your organization installs the Coshell Drives GitHub App once. When git needs to authenticate, a credential helper baked into the drive asks Coshell for a token, and Coshell mints one that is scoped to that one repository and expires in about an hour. The drive gets that and nothing else.
So a push shows the app as the pusher, and the commits inside it show the people who wrote them. This is the same shape GitHub uses for its own bots, and it means a compromised or careless drive can reach one repo for one hour, not your whole GitHub life.
Pull requests: opened as you, without a token on the drive
gh pr create now works on every drive with no login step. When the agent runs it, the drive sends the request to Coshell along with who asked. Coshell opens the pull request. If you have connected your GitHub account in Settings, the PR is opened as you: your avatar, your name, your notifications. If you have not, it is opened by the Coshell Drives app with a line at the bottom that says who asked for it.
Connecting is one click, once, per person: Settings, then Account, then Connect next to GitHub account. GitHub asks you to authorize the Coshell Drives app for your account and sends you back to Coshell. Disconnect revokes that authorization at GitHub, not only in Coshell, so it is a real off switch.
Either way, the token that opens the PR never leaves Coshell's edge. The drive gets back a URL and one line on stderr telling you which identity was used. And every PR creation writes a row to your organization's audit log: the drive, the person, the repository, and whether it went out as them or as the app.
We also taught gh auth status to tell the agent the truth: it reports that GitHub is handled through Coshell and that no token is stored on the drive. That one change removes the reason agents went looking for a personal token in the first place.
The thing we chose not to do
We could have made pushes show up as you too. We built it, reviewed it, and took it out.
A GitHub user token lasts eight hours and covers every repository you can reach, across every organization that has the app installed. Handing that to a drive means handing it to everyone with write access on that drive. Anyone there could read it. That is a strictly worse position than the one-repo, one-hour token the app already uses, and no amount of attribution polish is worth it.
So pushes stay with the app and commits stay with you. The identity that matters for review, blame, and history is the commit author, and that one is right. Pull requests are the surface where the person's name carries real weight, so that is where your account is used, and it is used from a place your teammates cannot reach.
The trust model, in one paragraph
A drive is a shared machine. Everyone with write access on it is trusted the way you trust a teammate at your desk: they can run commands, read files, and see the environment. Coshell's edge only honors an identity that actually has write access on that drive, so a request claiming to be someone who is not on the drive falls back to the app. Within a drive, a teammate who wanted to open a PR under your name could, and the audit log would show the drive and the request, which is more than a shared laptop ever gave you. If that boundary is not enough for your team, use separate drives; they are priced per environment, not per seat.
Why this is the foundation, not a feature
Attribution is the thing everything else on a shared drive is built on. Overlap detection needs to know whose change is whose. Session history needs a name on every turn. Review needs to know who to ask. Once every prompt, commit, and pull request carries the right person, the shared session stops being an anonymous pile of agent output and becomes a record of a team working.
It works the same on every drive, since the pieces live in the drive binary and at the edge rather than in anyone's dotfiles.