[BUG] Sandbox proxy blocks branch deletion (git push --delete and DELETE /git/refs) while allowing force-push to the default branch

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

In a Claude Code on the web remote session the sandbox proxy allows git push,
including force-push to the default branch, and allows every GitHub API read,
but denies branch deletion through both the git protocol and the REST API.

The agent can create branches, merge them and rewrite history, but it cannot
delete the branches it created. Branch cleanup always needs a manual human step
outside the session.

Three independent paths to deletion are all closed:

1. git push origin --delete <branch> returns HTTP 403 from the proxy.
2. DELETE /repos/{owner}/{repo}/git/refs/heads/{branch} returns HTTP 403 with

the message Write access to this GitHub API path is not permitted through
this proxy.

1. The GitHub MCP server has create_branch but no delete_branch.

The inconsistency is the core of the report. Force-pushing a rewritten history
over the default branch is strictly more destructive than deleting a merged
feature branch, and it is permitted. Deleting that feature branch is routine,
low-risk cleanup, and it is denied. The policy blocks the safe operation while
allowing the dangerous one.

The repository is private, single-owner, with no branch protection.
GET /rulesets returns "Upgrade to GitHub Pro or make this repository public
to enable this feature", so rulesets are unavailable on this plan and nothing
on the GitHub side can be blocking the deletion.

Same shape as #65923 (missing write tool plus proxy 403), adjacent to #57356
and #76248.

What Should Happen?

Deleting a non-default, non-protected branch in a repository that is already in
the session scope should succeed, by any one of these routes:

• the proxy permits DELETE /repos/{owner}/{repo}/git/refs/heads/* for in-scope

repositories;

• the proxy permits ref-deletion updates in git-receive-pack for in-scope

repositories;

• the GitHub MCP server gains a delete_branch tool, so the operation goes

through the same permission checks as the other write tools.

Restricting this to non-default, non-protected branches would leave the risk
profile unchanged while removing the manual step.

Error Messages/Logs

$ git push origin --delete <branch>
error: RPC failed; HTTP 403 curl 22 The requested URL returned error: 403
send-pack: unexpected disconnect while reading sideband packet
fatal: the remote end hung up unexpectedly

$ git push origin ":refs/heads/<branch>"
error: RPC failed; HTTP 403 curl 22 The requested URL returned error: 403
send-pack: unexpected disconnect while reading sideband packet
fatal: the remote end hung up unexpectedly

$ curl -X DELETE -H "Accept: application/vnd.github+json" \
    https://api.github.com/repos/<owner>/<repo>/git/refs/heads/<branch>
HTTP 403
{"message":"Write access to this GitHub API path is not permitted through this proxy.",
 "documentation_url":"https://docs.anthropic.com/en/docs/claude-code/github-actions"}

For contrast, the force-push in the same session succeeded:
$ git push -f origin main
 + d2a7cc4...a9a9d9f main -> main (forced update)

Proxy status at the time of the failures:
{"enabled":true,"selective":false,"toolScoped":false,
 "gitConfigInjection":true,"recentRelayFailures":[]}

Steps to Reproduce

1. Start a Claude Code on the web session against a private repository that

has at least one feature branch besides the default branch.

1. Merge the feature branch into the default branch and push:

git merge origin/<branch> --no-edit
git push -u origin main
Push succeeds.

1. Rewrite history and force-push:

git filter-branch -f --msg-filter 'cat' -- --all
git push -f origin main
Force-push succeeds.

1. Delete the now-merged feature branch:

git push origin --delete <branch>
Fails with HTTP 403.

1. Try the REST API instead:

curl -X DELETE https://api.github.com/repos/<owner>/<repo>/git/refs/heads/<branch>
Fails with HTTP 403 and the proxy's own message.

1. Look for an MCP alternative: create_branch exists, delete_branch does not.

Result: the branch cannot be removed from inside the session. The user has to
open the GitHub web UI and delete it by hand.

Claude Model

Opus

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.226 (Claude Code)

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Non-interactive/CI environment

Additional Information

Terminal/Shell is reported as "Non-interactive/CI environment": the web session
runs headless in a sandbox with no interactive terminal attached. The shell
available to tool calls is bash 5.2.21.
https://claude.ai/code/session_01LSoK9Tdd928XtHRVmVukKP