[BUG] Claude Code Web sandbox can't pull Git LFS

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Session: cse_01UGsAxmjFGiRpmCNJbgKUjp
Env runner: release-b5ac58d65-ext
Claude Code: 2.1.42

The Claude Code Web sandbox's git proxy forwards the plain Git smart protocol but does not implement the Git LFS HTTP API, and no LFS credentials are exposed to the session by any other means. Any private repo that uses Git LFS is unusable — every LFS pointer in the working tree stays unresolved, so any task that touches an LFS-backed file (binary plugins, large assets, etc.) fails.

What Should Happen?

git lfs pull (or transparent smudge during checkout) should fetch LFS blobs using the same upstream credentials the sandbox already uses to forward git protocol traffic to GitHub. After cloning, the working tree should contain real file contents, not 131-byte pointer stubs.

Error Messages/Logs

LFS batch request through the proxy:
POST /git/<org>/<repo>.git/info/lfs/objects/batch
 → HTTP 502 — Proxy error: invalid git path
git lfs pull:
batch response: Fatal error: Server error … from HTTP 502
Failed to fetch some objects from 'http://local_proxy@127.0.0.1:<port>/git/<org>/<repo>.git/info/lfs'
GitHub MCP for an LFS-backed file:
mcp__github__get_file_contents → "version https://git-lfs.github.com/spec/v1\noid sha256:...\nsize ..."
(returns the 131-byte pointer instead of the blob — GitHub Contents API never inlines LFS).
Plain git (control — works fine):
GET /git/<org>/<repo>.git/info/refs?service=git-upload-pack → 200 OK
Full traces: /<repo>/.git/lfs/logs/*.log.

Steps to Reproduce

Start a Claude Code Web session on any private repo that uses Git LFS (reproduced on strangers-dev/trailblazers).
In the session:
apt-get install -y git-lfs
git lfs install --local
git lfs pull
Observe HTTP 502 — Proxy error: invalid git path on every batch request; no objects fetched.
(Optional) Confirm via MCP: call mcp__github__get_file_contents on any LFS-backed path and observe the LFS pointer text is returned instead of the binary.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.150 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

Tried URL variants — all rejected by the proxy with 502 Proxy error: invalid git path or 400 Invalid path format:
/lfs/<org>/<repo>/objects/<oid>
/<org>/<repo>.git/info/lfs/objects/batch (no /git/ prefix)
/git-lfs/<org>/<repo>.git/info/lfs/objects/batch
/git/<org>/<repo>.git/info/lfs/locks
Tried with and without basic auth (local_proxy:) — same result.
Env vars: no GITHUB_TOKEN / GH_TOKEN (only CODESIGN_MCP_TOKEN, CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR, CLAUDE_SESSION_INGRESS_TOKEN_FILE). The "set GITHUB_TOKEN yourself" workaround documented for self-hosted setups doesn't apply on the web product, and users on company repos generally can't mint a PAT for their org.
Public-source substitution doesn't work for repos that ship custom builds (e.g. one of the affected DLLs has identical size on NuGet but a different SHA-256).
Suggested fixes (priority order):
Make the sandbox git proxy LFS-aware — proxy /info/lfs/objects/batch and the resulting object URLs to GitHub LFS using the same upstream credentials it already uses for the git protocol.
Pre-stage LFS objects in the container via a SessionStart-style step that runs git lfs pull with a service-account token before Claude starts (same delivery mechanism as other repo-bound secrets).
Expose a session-scoped GitHub token so git lfs can be pointed at GitHub directly.