[BUG] Claude Code on the web: GitHub App has read-only access even though the same account has full write access from local Claude Code

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary

In a Claude Code on the web (remote execution / cloud) session, the GitHub integration has read-only access to a repo the user's local Claude Code can both read and write. All write operations against the repo — raw git push and every GitHub MCP write tool — fail with 403, while the exact same GitHub account works fine for pushes from the user's local Claude Code.

Environment

• Surface: Claude Code on the web (remote execution environment), session working directory /home/user/<repo>
• Repo: a private/public GitHub repo owned by the authenticated user's own account (not an org)
• GitHub identity resolved via get_me: matches the user's real GitHub account (confirmed working for local Claude Code pushes to the same repo under the same account)
• Local git author identity in the container: Claude <noreply@anthropic.com> (unrelated to the GitHub App identity, just the commit author config)

What works

• git fetch / git pull against the repo — succeeds with no credentials needed (repo is public, so this may just be anonymous read)
• GitHub MCP tool pull_request_read (get, presumably other read methods) — succeeds
• GitHub MCP tool get_me — succeeds, returns the correct account

What fails

• git push origin <branch> — fails immediately with a bare 403 Forbidden from github.com. GIT_CURL_VERBOSE=1 trace shows no Authorization header was ever sent on the git-receive-pack request — i.e. the environment's git credential injection (documented as automatic via the outbound proxy, gitConfigInjection: true in /root/.ccr/__agentproxy/status) did not attach a token for this request.
• GitHub MCP tool create_branch → POST .../git/refs → 403 Resource not accessible by integration
• GitHub MCP tool push_files → same underlying branch-creation call → 403 Resource not accessible by integration
• GitHub MCP tool create_or_update_file (tested against an existing branch, avoiding ref creation entirely) → 403 Resource not accessible by integration

The Resource not accessible by integration message is GitHub's standard error for a GitHub App token that lacks the required permission scope (here, contents: write) — but this is surprising because:

1. The same GitHub account pushes successfully from local Claude Code against the same repo.
2. Read access (PR reads, git fetch) works fine in this same cloud session, which implies some valid credential/App installation is active — just without write scope.

Repro steps

1. Start a Claude Code on the web session against a repo you own and can normally push to from local Claude Code.
2. Make a commit on a feature branch.
3. Run git push -u origin <branch> → observe bare 403.
4. As a fallback, try the GitHub MCP tools create_branch / push_files / create_or_update_file against the same repo → observe 403 Resource not accessible by integration.
5. Compare: the same repo/account pushes fine from local Claude Code.

Expected behavior

A Claude Code on the web session's GitHub integration should have write access (or clearly surface why it doesn't, e.g. "this environment was created with read-only GitHub scope") when the underlying GitHub account/App installation has full read-write access elsewhere.

Impact

Cannot push commits or open PRs from the cloud session at all — had to fall back to exporting a git bundle + git format-patch files to apply and push manually from a local machine, defeating the point of doing the work in the cloud session.

Diagnostics already ruled out

• Not a TLS/CA/proxy trust issue — checked /root/.ccr/README.md runbook and /__agentproxy/status; no relevant relay failures for github.com, and the TLS handshake to github.com completes fine.
• Not a stale local git remote config — git remote -v, insteadOf rewrites, and env vars (GIT_CONFIG_*, GH_TOKEN, GITHUB_TOKEN) all look as documented for this environment; GITHUB_TOKEN/GH_TOKEN are the literal sentinel string proxy-injected, presumably meant to be swapped in transparently by the proxy — but the outbound git push request shows no Authorization header at all.

---
Reported by: Sarveshwar Singh (@sunveda)

What Should Happen?

A Claude Code on the web session's GitHub integration should have write access (or clearly surface why it doesn't, e.g. "this environment was created with read-only GitHub scope") when the underlying GitHub account/App installation has full read-write access elsewhere.

Error Messages/Logs

### 1. git push — bare 403, no auth header ever sent

$ git push -u origin agent/mobile-nav-menu-vz8p4l
fatal: unable to access 'https://github.com/sunveda/sunveda.tech/': The requested URL returned error: 403

Verbose trace (GIT_CURL_VERBOSE=1) of the underlying request:

=> Send header: GET /sunveda/sunveda.tech/info/refs?service=git-receive-pack HTTP/1.1
=> Send header: Host: github.com
=> Send header: User-Agent: git/2.43.0
=> Send header: Accept: */*
=> Send header: Accept-Encoding: deflate, gzip, br, zstd
=> Send header: Pragma: no-cache
=> Send header: [blank — no Authorization header sent]

<= Recv header: HTTP/1.1 403 Forbidden
<= Recv header: X-Github-Request-Id: B403:3E0FA2:B521DDF:E9224E0:6A798242
<= Recv header: Content-Type: application/x-git-receive-pack-advertisement
<= Recv header: X-Content-Type-Options: nosniff
<= Recv header: Transfer-Encoding: chunked
<= Recv header: Connection: close

---

### 2. GitHub MCP tool — create_branch

failed to create branch: POST https://api.github.com/repos/sunveda/sunveda.tech/git/refs: 403 Resource not accessible by integration []

---

### 3. GitHub MCP tool — push_files

failed to create branch from default: failed to create new branch reference: POST https://api.github.com/repos/sunveda/sunveda.tech/git/refs: 403 Resource not accessible by integration []

---

### 4. GitHub MCP tool — create_or_update_file (tested against an existing branch, to rule out ref-creation specifically)

failed to create/update file: PUT https://api.github.com/repos/sunveda/sunveda.tech/contents/test-binary-check.png: 403 Resource not accessible by integration []

---

### 5. Direct GitHub REST API call using the session's injected GITHUB_TOKEN env var
   (curl https://api.github.com/repos/sunveda/sunveda.tech -H "Authorization: token $GITHUB_TOKEN")

{
  "message": "GitHub access is not enabled for this session. An org admin must connect the Claude GitHub App for this organization.",
  "documentation_url": "https://docs.anthropic.com/en/docs/claude-code/github-actions"
}

Note: the same token DID work for a lower-privilege call:
curl https://api.github.com/user -H "Authorization: token $GITHUB_TOKEN"
→ 200 OK, correctly returns the authenticated user (login: sunveda)

---

### 6. Attempting to attach the repo with explicit push scope (mid-session, after the above failures)

Tool: add_repo(owner="sunveda", repo="sunveda.tech", access="push")
Result: MCP error -32003: MCP tool call requires approval
(the approval prompt did not resolve/complete)

---

### Environment
- Claude Code on the web (remote execution session)
- git version 2.43.0
- Proxy status confirmed healthy for github.com (no relayed 403/407 from the egress proxy itself — this 403 comes directly from github.com's own edge, per the X-Github-Request-Id header)

Steps to Reproduce

Steps to Reproduce

1. Start a Claude Code on the web (remote execution) session against a repo you

own and have full read/write GitHub access to (confirmed working from local
Claude Code under the same account).

1. In the session, make a local commit on a feature branch:

git checkout -b <branch-name>
<make a change>
git add <file>
git commit -m "test commit"

1. Attempt to push it:

git push -u origin <branch-name>

Observed: immediate bare "403" with no retries/prompts —
fatal: unable to access 'https://github.com/<owner>/<repo>/': The requested URL returned error: 403

Re-run with GIT_CURL_VERBOSE=1 git push ... and inspect the outgoing
request headers — no Authorization header is attached to the
git-receive-pack request at all.

1. Fall back to the GitHub MCP server's write tools instead of raw git,

against the same repo/branch:

• create_branch(owner, repo, branch, from_branch="main")

→ 403 Resource not accessible by integration

• push_files(owner, repo, branch, files=[...], message="...")

→ same underlying error (fails at branch-creation step)

• create_or_update_file(owner, repo, path, content, message, branch)

tried against an existing remote branch, specifically to rule out
the failure being about creating a new ref
→ still 403 Resource not accessible by integration

1. Confirm read access works fine in the same session, to rule out a fully

dead integration:

• git fetch origin <branch> → succeeds
• GitHub MCP pull_request_read (method="get") on an existing PR → succeeds
• GitHub MCP get_me → succeeds, returns the correct authenticated user

1. Directly query the GitHub REST API using the session's own injected

credential, to isolate whether this is a git-specific vs. API-wide issue:
curl https://api.github.com/user \
-H "Authorization: token $GITHUB_TOKEN"
→ 200 OK, correctly identifies the account

curl https://api.github.com/repos/<owner>/<repo> \
-H "Authorization: token $GITHUB_TOKEN"
→ 403, body:
{"message":"GitHub access is not enabled for this session. An org admin
must connect the Claude GitHub App for this organization.", ...}

1. Try re-attaching the repo mid-session with explicit push scope via the

session's add_repo tool (access="push") to see if it re-provisions
credentials.
→ MCP error -32003: MCP tool call requires approval, and the approval
never resolves/completes within the session.

Result

Every write path (raw git, GitHub MCP write tools, direct REST API) fails
with a 403 tied to missing write scope, while every read path succeeds —
and the identical GitHub account has full push access from local Claude
Code against the same repo. This points to the cloud session's GitHub App
installation/token being provisioned read-only (or stuck mid-installation),
not an actual permissions gap on the GitHub side.

Expected Result

git push (or the GitHub MCP write tools) should succeed, matching the
access level the same account has from local Claude Code — or the session
should surface a clear, actionable error up front (e.g. "this session's
GitHub App has read-only access — reconnect at <link>") instead of a bare
403 with no explanation.

Claude Model

_No response_

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.226 (Claude Code) @anthropic-ai/claude-code@2.1.42

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_