[BUG] Sandbox proxy blocks branch deletion (git push --delete and DELETE /git/refs) while allowing force-push to the default branch

Summary

In a Claude Code on the web remote session the sandbox proxy allows git push, including force-push to the default branch, and allows every GitHub API read, but denies branch deletion through both the git protocol and the REST API. The agent can therefore create branches, merge them and rewrite history, but cannot delete the branches it created. Branch cleanup always needs a manual human step outside the session.

This is the same shape as #65923 (missing write tool plus proxy 403) and is adjacent to #57356 and #76248.

Environment

• Claude Code on the web, remote sandbox session
• Agent proxy on 127.0.0.1, enabled=true, selective=false, toolScoped=false, gitConfigInjection=true, recentRelayFailures=[]
• git 2.43.0, Linux 6.18.5
• Repository: private, single owner, no branch protection. GET /rulesets returns "Upgrade to GitHub Pro or make this repository public to enable this feature", so rulesets are unavailable on this plan and nothing on the GitHub side can be blocking the deletion.

What works

• git fetch, git clone
• git push -u origin main
• git push -f origin main after a full filter-branch history rewrite — succeeded, + d2a7cc4...a9a9d9f main -> main (forced update)
• every GitHub API GET, including reading the very branch that cannot be deleted

What fails

1. Deletion over the git protocol

$ git push origin --delete <branch>
error: RPC failed; HTTP 403 curl 22 The requested URL returned error: 403
send-pack: unexpected disconnect while reading sideband packet
fatal: the remote end hung up unexpectedly

Retried four times with exponential backoff, and also as an explicit refspec git push origin ":refs/heads/<branch>". Same result.

2. Deletion over the REST API

$ curl -X DELETE https://api.github.com/repos/<owner>/<repo>/git/refs/heads/<branch>
HTTP 403
{"message":"Write access to this GitHub API path is not permitted through this proxy.",
 "documentation_url":"https://docs.anthropic.com/en/docs/claude-code/github-actions"}

The second response states plainly that the denial comes from the proxy and not from GitHub.

3. Deletion through the GitHub MCP server

Not possible: create_branch exists, there is no delete_branch.

Why this is inconsistent

Force-pushing a rewritten history over the default branch is a strictly more destructive operation than deleting a merged feature branch, and it is permitted. Deleting that feature branch is routine, low-risk cleanup, and it is denied. The policy blocks the safe operation while allowing the dangerous one.

Impact

Any workflow that asks the agent to merge feature branches and remove them afterwards cannot finish inside the session. The agent reports the merge as done and then has to ask the user to open the GitHub web UI and press the delete button by hand. For a workflow that runs on a schedule this removes most of the value of automating it. It also leaves the deleted-in-intent branch alive on the remote, which in my case still carries the pre-rewrite commits that the rewrite was meant to remove.

Requested change

Allow ref deletion for repositories already in the session scope, by any one of:

• permitting DELETE /repos/{owner}/{repo}/git/refs/heads/* through the proxy for in-scope repositories;
• permitting ref-deletion updates in git-receive-pack for in-scope repositories;
• adding a delete_branch tool to the GitHub MCP server so the operation passes the same permission checks as the other write tools.

Restricting it to non-default, non-protected branches would leave the risk profile unchanged while removing the manual step.