[BUG] Routine push to main returns HTTP 403 from git proxy despite "Allow unrestricted branch pushes" being enabled

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

A routine configured with "Allow unrestricted branch pushes" enabled cannot push to main. The Anthropic git proxy returns HTTP 403 on git push origin main, even though the setting that should permit this is on.

This appears related to #24535 (proxy restricts pushes to claude/* only) and #44949 (inconsistent enforcement of the "Allow unrestricted branch pushes" setting), but is a clean minimal repro of the inverse case: setting is ON, push to main is still blocked.

What Should Happen?

With "Allow unrestricted branch pushes" enabled for the repository, git push origin main should succeed and the commit should land on origin/main.

Error Messages/Logs

The push fails with HTTP 403 from the proxy. Full trace below.
Trace log (/tmp/push-trace.log)
++ git fetch origin main
From http://127.0.0.1:44229/git/<branch>
 * branch            main       -> FETCH_HEAD
++ git checkout main
Switched to branch 'main'
Your branch is up to date with 'origin/main'.
++ git pull --ff-only origin main
From http://127.0.0.1:44229/git/<branch>
 * branch            main       -> FETCH_HEAD
Already up to date.
++ git add drafts/
++ git commit -m 'Push test 2026-05-11T20:13:41Z'
[main 3d56787] Push test 2026-05-11T20:13:41Z
 1 file changed, 3 insertions(+)
 create mode 100644 drafts/push-test-20260511-201332.md
++ git push origin main
error: RPC failed; HTTP 403 curl 22 The requested URL returned error: 403
send-pack: unexpected disconnect while reading sideband packet
fatal: the remote end hung up unexpectedly
Everything up-to-date
++ echo PUSH_EXIT_CODE:1
PUSH_EXIT_CODE:1

Steps to Reproduce

Steps to reproduce

Create a routine with "Allow unrestricted git push — Let the agent push to any branch on this repo, including the default branch." set to True.

Give these instructions to the routine:

You are running a push test. Do exactly the steps below.

Step 1 — Write a test file

Create drafts/push-test-<timestamp>.md with a short test message.

Step 2 — Commit and attempt to push to main

Run these commands exactly:

set -x
exec > >(tee -a /tmp/push-trace.log) 2>&1

git fetch origin main
git checkout main
git pull --ff-only origin main
git add drafts/
git commit -m "Push test"
git push origin main

Step 3 — Report exit code and trace log

Hard rules

• The push command is exactly git push origin main.
• Do not add flags, do not use a refspec mapping, do not retry on failure,

do not fall back to a claude/* branch.

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.138

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_