fix: conditionally set --share team:edit based on task ownership#66
Merged
fix: conditionally set --share team:edit based on task ownership#66
Conversation
When "Team visible" is unchecked in the Oz web app, the task is created with user ownership and a user-scoped API key. The hardcoded --share team:edit flag caused the oz CLI to fail on startup because the user-scoped key cannot set up team-level session sharing. This change: - Adds a TaskOwner type to the worker's Task struct so the worker can see whether a task is team-owned or user-owned (the server already serializes this in the TaskAssignmentMessage). - Conditionally emits --share team:edit only for team-owned tasks. User-owned tasks skip team sharing, letting the session stay user-scoped. Co-Authored-By: Oz <oz-agent@warp.dev>
captainsafia
approved these changes
May 5, 2026
bnavetta
reviewed
May 6, 2026
| // Only share with the team when the task is team-owned. User-owned tasks | ||
| // (created with "Team visible" unchecked) use user-scoped API keys that | ||
| // cannot set up team-level session sharing. | ||
| if task.Owner.IsTeamOwned() { |
Collaborator
There was a problem hiding this comment.
The --share team:edit flag should add a team guest to the session - we hardcode this for Warp-hosted tasks as well.
I think this will result in the shared session links for user-owned runs being inaccessible to their teammates
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When "Team visible" is unchecked in the Oz web app, self-hosted worker agents
fail to start every time. This is a 100% repro on the K8s backend.
Root Cause
The
oz-agent-workerhardcodes--share team:editin the CLI args for everytask (
worker.go:395). When "Team visible" is unchecked:UserPermissionSubjectownershipGenerateAPIKeyForTaskproduces a user-scoped per-task API keyteam-level session sharing via
--share team:editSolution
TaskOwnertype to the worker'sTaskstruct to deserialize theownerfield the server already sends in theTaskAssignmentMessage--share team:editonly whenowner.Type == "TEAM"No server-side changes needed — the server already serializes
Task.Ownerin the WebSocket assignment payload.
Testing
go test ./...)Conversation: https://staging.warp.dev/conversation/5d0d24f7-28ac-4621-9f24-e337039d989a
Run: https://oz.staging.warp.dev/runs/019dfa3a-1ee9-7d99-8eb8-f1c1081a10a9
This PR was generated with Oz.