Repo connection stuck read-only after delete+recreate — D4rkm3ch/service-sentinel

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

My Claude Code on the web session cannot push any commits to D4rkm3ch/service-sentinel, even though it can read from the repo fine (Actions runs, job logs, branches, issues). Every write attempt returns a 403:

• git push → remote: Permission to D4rkm3ch/service-sentinel.git denied to D4rkm3ch (403)
• GitHub MCP write tools (push_files, create_branch) → 403 Resource not accessible by integration

The session's own list_repos tool reports can_push: true for this repo, which contradicts the actual 403s — the backend's cached permission state for this repo is out of sync with what GitHub is actually authorizing.

What Should Happen?

Claude Code should be able to push commits to a repo it has read access to and reports can_push: true for, the same way it could before this repo was deleted and recreated.

Error Messages/Logs

git push -u origin claude/service-sentinel-access-bzpgle
remote: Permission to D4rkm3ch/service-sentinel.git denied to D4rkm3ch.
fatal: unable to access 'https://github.com/D4rkm3ch/service-sentinel/': The requested URL returned error: 403

MCP create_branch/push_files (identical failure):
failed to create branch: POST https://api.github.com/repos/D4rkm3ch/service-sentinel/git/refs: 403 Resource not accessible by integration []

Steps to Reproduce

1. Have a Claude Code on the web session with a repo already attached and working (read+write).
2. Delete that GitHub repo entirely, then recreate it under the exact same name (history restored via a manual push from a local machine, outside Claude Code).
3. In a Claude Code on the web session scoped to that repo, try git push, or the GitHub MCP server's write tools (push_files, create_branch).
4. Both fail with 403, despite list_repos reporting can_push: true and all read operations (Actions runs, job logs, branches, issues) working normally.
5. Checked account settings for anything revocable: no installed GitHub Apps, no fine-grained PATs, no Anthropic-related entry under Authorized OAuth Apps — nothing visible ties the working read access to a renewable grant.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

N/A — not a CLI version issue, it's a per-repo connection state

Claude Code Version

Claude Code on the web (hosted session, not local CLI)

Platform

Other

Operating System

Other

Terminal/Shell

Other

Additional Information

hosted Claude Code on the web environment

Repo D4rkm3ch/service-sentinel (public) was previously named release-radar. It was accidentally deleted in its entirety, then recreated under the same name with git history restored via a manual push from my own machine using a temporary PAT (since revoked). Since the recreation, this Claude Code session's write access to the repo is broken despite read access and can_push metadata both suggesting it should work.