[BUG] Claude Code on the web (cloud/remote sessions) can read but not push to my GitHub repo

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

I'm using Claude Code on the web (claude.ai/code) with a cloud/remote session connected to my repo outandaboutmarin/out-and-about-marin. The session can read the repo fine (browse files, view commit history, fetch file contents), but every write operation fails with a 403:

git push to my working branch fails with: fatal: unable to access 'http://127.0.0.1:41729/git/outandaboutmarin/out-and-about-marin/': The requested URL returned error: 403
The GitHub API fallback (creating a branch via the built-in GitHub tool) fails with: 403 Resource not accessible by integration
I checked my GitHub account settings and:

Settings → Applications → Installed GitHub Apps: empty, nothing listed there.
Settings → Applications → Authorized OAuth Apps → Claude: shows Claude authorized, but says "Claude has not been installed on any accounts you have access to," and its description is about the PR/issue auto-response feature, not general repo write access.
So there's no GitHub App installation or OAuth grant on my account that I can find to enable write/push access for cloud sessions, even though read access clearly works somehow. My desktop/CLI Claude Code session pushes to this same repo just fine, so this seems specific to the cloud/remote environment's GitHub connection.

Could you help me figure out how to grant push access (branch creation + push) to Claude Code cloud sessions for this repo, or let me know if this is a known gap/bug?

Repo: outandaboutmarin/out-and-about-marin
Account: outandaboutmarin
Best, Alexandra
outandaboutmarin@gmail.com

What Should Happen?

A Claude Code cloud/remote session should be able to both read and write to a repo it's connected to, the same way a desktop/CLI session can. Specifically:

git push from a cloud session's working branch should succeed (create the remote branch if it doesn't exist yet, and push commits to it) — not return a 403.
The built-in GitHub tool's branch-creation/file-push actions should succeed for a repo I own and have already granted the session read access to — read and write should be governed by the same grant, not silently split with no visible way to upgrade one without the other.
If cloud sessions are intentionally read-only by default for security reasons, there should be a visible setting (either in claude.ai's Connectors/Claude Code settings, or in GitHub's Installed Apps page) where I can explicitly grant write/push access — currently neither location shows any such control for this repo.
Ideally, whatever is granting my session read access today (since that clearly works, even with no GitHub App showing as "Installed" in my account) should be documented, so it's clear why read works without an installed app but write doesn't.

Error Messages/Logs

Error 1 — git push (fails every time, same result across retries with backoff):

fatal: unable to access 'http://127.0.0.1:41729/git/outandaboutmarin/out-and-about-marin/': The requested URL returned error: 403
Error 2 — GitHub API branch creation (via the built-in GitHub tool, attempted as a fallback after the git push failed):

failed to create branch: POST https://api.github.com/repos/outandaboutmarin/out-and-about-marin/git/refs: 403 Resource not accessible by integration []
Error 3 — General outbound web fetches also blocked in this same cloud session (separate issue, but same session — included for completeness):

WebFetch to https://en.wikipedia.org/wiki/Test → "The server returned HTTP 403 Forbidden."
WebFetch to https://onetam.org/calendar → "The server returned HTTP 403 Forbidden."
WebFetch to https://marinmommies.com/calendar → "getaddrinfo ENOTFOUND marinmommies.com"
Proxy diagnostic (run via curl -sS http://127.0.0.1:34471/__agentproxy/status), showing the 403s are NOT transient relay failures:

{
  "enabled": true,
  "recentRelayFailures": []
}
(Empty recentRelayFailures indicates these are policy-level denials, not connection/relay errors — consistent with what the tool documentation says about 403s: "not allowed by your organization's egress policy... do not retry.")

Read access, for contrast — works fine, e.g.:

GET https://api.github.com/repos/outandaboutmarin/out-and-about-marin/contents/ → 200 OK (file listing returned successfully)

Steps to Reproduce

Open Claude Code on the web (claude.ai/code) and start a cloud/remote session connected to the GitHub repo outandaboutmarin/out-and-about-marin, on a feature branch (e.g. claude/push-events-marin-app-cz0p19).
Confirm read access works: ask Claude to read a file from the repo, or run git fetch origin — this succeeds normally.
Make a small change to a file in the repo and commit it locally (e.g. git add + git commit) — this succeeds normally, since it's local-only.
Attempt to push the commit: git push -u origin <branch-name>.
Result: fails with 403 (see Error 1 in the logs above).
As a fallback, attempt to create/push the branch via the built-in GitHub API tool instead of raw git (e.g. a "create branch" action).
Result: also fails with 403 Resource not accessible by integration (see Error 2).
Check GitHub account settings for anything that could explain the write restriction:
Settings → Applications → Installed GitHub Apps → empty, nothing listed.
Settings → Applications → Authorized OAuth Apps → Claude → shows authorized, but says "Claude has not been installed on any accounts you have access to," and its stated purpose is PR/issue auto-response, not general repo write access.
Result: no setting found that would explain or let me fix the read/write split.
For comparison, open a desktop or CLI Claude Code session against the same repo/branch and attempt the same git push.
Result: succeeds without issue, confirming this is specific to cloud/remote sessions, not the repo or account itself.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

Claude Code version 2.1.218.

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Other

Additional Information

_No response_