[BUG] Scheduled cloud routines (CCR) consistently fail to `git push`

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary

Scheduled cloud routines (CCR) consistently fail to git push with a 403 from the session's local git credential-injection proxy (127.0.0.1:<port>), even though the Claude GitHub App has confirmed read/write access to the target repo and the repo is explicitly selected in the App's installation config.

Environment

• Repo: emorghub/agent-roi (private, org-owned)
• Routine environment: env_01MNnP6S5Mv6uZPp2y2DriQr ("Default")
• Model: claude-sonnet-5
• Trigger type: one-time (run_once_at), created via the RemoteTrigger API (ccr job_config)
• Routine IDs affected: trig_01L3TvVmPSs5hFhkKp6KyEzX, trig_011iTcuMWaKSjgMBYfJ5T8DU

Steps to reproduce

1. Confirm the Claude GitHub App is installed on the org (emorghub) with "Only select repositories" scope including agent-roi, and permissions show "Read and write access to actions, checks, code, discussions, issues, pull requests, repository hooks, and workflows."
2. Create a one-time routine via RemoteTrigger action: create, job_config.ccr.session_context.sources pointing at https://github.com/emorghub/agent-roi.
3. Give it a prompt that: creates a branch, makes a small file change, runs tests, and on success commits + git push -u origin <branch>.
4. Let the routine fire.

Observed behavior

• Repo clone/read access inside the session works fine.
• Branch creation, file edits, commit all succeed locally inside the sandbox.
• git push fails with:

``
fatal: unable to access 'http://127.0.0.1:41729/git/emorghub/agent-roi/': The requested URL returned error: 403
``

• Retried once after a 5s delay per instructions — identical 403 both times.
• Checked in-sandbox diagnostics (/root/.ccr/README.md, proxy status endpoint) — no relay/egress failures logged; the 403 originates from the local git credential-injection proxy itself, not a general network/egress proxy.
• Reproduced identically across two separate routine runs (different trigger IDs), same repo, same environment.

What Should Happen?

Expected behavior

Given the GitHub App has confirmed write access to the repo, git push from within a scheduled routine session should succeed the same way it would from an interactive Claude Code cloud session using the same GitHub App grant.

Additional notes

• This appears specific to scheduled/routine (CCR) sessions' git-push credential path, as opposed to interactive sessions, which are believed to push fine under the same GitHub App permissions (not independently verified in this instance, but worth checking as a comparison point).
• Happy to provide the full session transcripts for trig_01L3TvVmPSs5hFhkKp6KyEzX and trig_011iTcuMWaKSjgMBYfJ5T8DU if useful for debugging.

Error Messages/Logs

Steps to Reproduce

1. Confirm the Claude GitHub App is installed on the org with "Only select repositories" scope including the target repo, and permissions show "Read and write access to actions, checks, code, discussions, issues, pull requests, repository hooks, and workflows."
2. Create a one-time routine via the Claude Code routines feature (claude.ai/code/routines), pointing at the target GitHub repo.
3. Give it a prompt that: creates a branch, makes a small file change, runs tests, and on success commits + git push -u origin <branch>.
4. Let the routine fire at its scheduled time.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.76

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

VS Code integrated terminal

Additional Information

_No response_