[BUG] Git proxy returns 403 Forbidden on git-receive-pack

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

In the Claude Code web sandbox, every git push to origin fails with HTTP 403 Forbidden from the local git proxy. Fetches work normally; only pushes are rejected. The 403 comes from Cloudflare (Server: cloudflare in response headers), suggesting a WAF rule blocking POST traffic to /git-receive-pack endpoints. Issue persists across retries with backoff. No way to push code changes from within the sandbox.

Server: cloudflare
Cf-Ray: 9f9974502d707e38-ORD

What Should Happen?

git push from the Claude Code sandbox should successfully reach GitHub and update the remote branch. Currently, every push returns HTTP 403 from the local proxy, blocking all code transfer from sandbox to repo.

Error Messages/Logs

$ git push origin main
error: RPC failed; HTTP 403 curl 22 The requested URL returned error: 403
send-pack: unexpected disconnect while reading sideband packet
fatal: the remote end hung up unexpectedly

$ curl -sI -X POST http://127.0.0.1:<port>/git/<owner>/<repo>/git-receive-pack
HTTP/1.1 403 Forbidden
Server: cloudflare
Cf-Ray: 9f9974502d707e38-ORD
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'

Steps to Reproduce

1. Open a Claude Code web sandbox session attached to a GitHub repo via the local_proxy git remote
2. Make any change to a tracked file
3. git add, git commit, git push origin main
4. Observe consistent 403 regardless of file size, repo, or session

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

4.7 [1M]

Platform

Anthropic API

Operating System

Other

Terminal/Shell

Other

Additional Information

_No response_