[BUG] Unexpected SSH connection to GitHub on startup triggers FIDO key Touch ID prompt

(filed w/ Claude Code, but every step of the investigation and this issue was reviewed by me)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

On every new conversation, Claude Code makes an SSH connection to GitHub (140.82.116.3:22, confirmed as lb-140-82-116-3-sea.github.com) during startup, even though all git remotes are configured with HTTPS URLs. This triggers a Touch ID prompt via macOS CryptoTokenKit (ctkcardtoken) because my SSH config uses a FIDO2 security key (sk-ecdsa-sha2-nistp256) as the default identity.

The Touch ID prompt can be dismissed/rejected without breaking Claude Code functionality, so the SSH connection appears to be non-essential.

What Should Happen?

Claude Code should not initiate SSH connections to GitHub when all configured git remotes use HTTPS. If an SSH connection is needed for some reason, it should be opt-in or documented.

Error Messages/Logs

System log captured via log show shows the startup sequence:

ssh[24077] — TCP connect to 140.82.116.3:22 (github.com)
ssh-sk-helper[24078] — SecKeyCreateSignature (triggers Touch ID via CryptoTokenKit)
ctkcardtoken[24079] — LocalAuthentication prompt

lsof confirms the connection:

ssh  26354  sargunv  5u  IPv4  ...  TCP 192.168.50.252:59053->140.82.116.3:22 (ESTABLISHED)

Steps to Reproduce

1. Configure SSH with a FIDO2 security key as default identity:

``
# ~/.ssh/config
Host *
IdentityFile ~/.ssh/id_ecdsa_sk_rk
``

1. Configure git to use HTTPS remotes (no SSH remotes)
2. Start Claude Code in a git repository
3. Send the first message
4. A Touch ID / security key prompt appears from ctkcardtoken

Claude Model

• Opus

Is this a regression?

I don't know

Claude Code Version

2.1.77 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Ghostty / Zsh

Additional Information

• All git remotes (both the project repo and ~/.claude/plugins/marketplaces/claude-plugins-official) use HTTPS URLs
• No url.*.insteadOf git config rewrites are set
• No GIT_SSH or core.sshCommand overrides
• git config --global commit.gpgSign=true with gpg.format=ssh, but this should only matter for signing commits, not for startup
• git config --global log.showSignature=true is set, but signature verification uses public keys and does not trigger Touch ID
• MCP servers configured: mise, tilt (npx), linear (SSE) — tested each individually, none trigger the SSH connection
• git status, git log, git fetch all work without triggering Touch ID when run manually