[BUG] "Co-authored-by" trailer leaks the human user's account email even when git author.email is a noreply (since ~2026-06-05 / v2.1.165)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Since ~2026-06-05 (Claude Code ~v2.1.165), generated commits include a second Co-authored-by: trailer for the human user, using the user's Anthropic account email — in addition to the Co-Authored-By: Claude … trailer.

The leaked email is not taken from git config user.email: it appears even when the commit's git author.email is a GitHub noreply. So it exposes a personal email the user deliberately kept out of git.

Footer shape (from a real public commit):

• git author.email = <id>+<user>@users.noreply.github.com ← noreply (correct)
• yet the message has Co-authored-by: <Name> <personal email> ← leaked account email
• plus Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Why it matters:

• Leaks a personal email the user intentionally hid (their user.email is a noreply).
• On public repos it permanently exposes that email, and may misattribute it if registered to another account (cf. #58479).
• attribution.commit / includeCoAuthoredBy do not control the human co-author, and per #65657 the system-prompt trailer overrides settings anyway. No documented way to disable or change the human co-author email.

What Should Happen?

• Do not add a human Co-authored-by: using the Anthropic-account email; OR
• if a human co-author is intended, use git config user.email (respecting the user's noreply choice), never the account email; AND
• provide a setting to disable it.

Error Messages/Logs

Steps to Reproduce

1. Set git config user.email to a GitHub noreply (so your personal email is NOT exposed).
2. Have Claude Code (>= ~v2.1.165) generate a commit.
3. The commit message contains Co-authored-by: <Your Name> <your account email> — your personal email, not the noreply.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

pre ~2.1.165 (before 2026-06-05)

Claude Code Version

2.1.168

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Other

Additional Information

When it started:

• Absent before ~2026-05-31 (Claude-only trailer).
• Present from ~2026-06-05 (around v2.1.165). The changelog mentions no commit-attribution change in this window.

Evidence across public repos (not isolated to one setup): in a sample of 100 recent public commits containing the Claude trailer, several show the human author self-credited as Co-authored-by: with a personal email. Example (git author email is a noreply, but a personal email leaks as co-author):
https://github.com/dnf0/eider/commit/b20411be33883da96657720d4283bf944a8358f3

Workaround: settings do not fix it; the only reliable fix is a local commit-msg hook that rewrites/strips the leaked email before the commit is finalized.

Related: #65657, #64704, #18715, #58479