Background git access to the working repo's remote (SSH git-upload-pack) with no user-issued remote command, and no setting to disable it

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

On Linux, a process running inside the Claude Desktop application cgroup scope performs an SSH git-upload-pack (i.e. a git fetch / git ls-remote) against the working repository's own origin remote, without me — or the assistant via any tool call — ever issuing a remote git command.

Because origin is an SSH remote with a passphrase-protected key, every such background access pops a gcr-ssh-askpass passphrase dialog. Beyond the nuisance, an agentic tool contacting the network for a private repository with no explicit request is a trust/privacy concern.

I have found no documented setting to disable this background remote access.

This appears related to #21108 (origin access on startup) and #32482 (remote git on first prompt). It is not #37886 (plugin-marketplace auto-update): the captured access targets my own repo (<owner>/<repo>), not the Anthropic plugins marketplace, and DISABLE_AUTOUPDATER=1 is already set in my environment yet the access still happens.

What Should Happen?

Claude Code / Claude Desktop should perform only local git operations (status, log, diff, commit) by default. Any network access to a repository's remote (fetch / ls-remote / pull / push) should happen only when I explicitly request it.

Concretely:

A documented way to disable all automatic/background remote git operations — a settings.json option (e.g. disableBackgroundGitOperations: true) and/or an environment variable.

Documentation of exactly which features perform remote git access and when (startup, first prompt, worktree/branch detection, etc.).

Ideally, "local-only git" as the default, with remote access gated behind an explicit user action.

Error Messages/Logs

  While the passphrase dialog was open, the relevant processes were:

13103 /bin/sh -c ssh -o BatchMode=yes "$@" ssh -o BatchMode=yes -o SendEnv=GIT_PROTOCOL git@github.com git-upload-pack '<owner>/<repo>'
13104 ssh -o BatchMode=yes -o SendEnv=GIT_PROTOCOL git@github.com git-upload-pack '<owner>/<repo>'
13109 /usr/bin/ssh-add /home/<user>/.ssh/id_ecdsa
13111 /usr/libexec/gcr-ssh-askpass Enter passphrase for /home/<user>/.ssh/id_ecdsa:

  git-upload-pack is the server-side command for reading refs/objects — consistent with git fetch / git ls-remote, not a push.

  Cgroup of the launching process (definitive attribution, not timing correlation):

$ cat /proc/13103/cgroup
0::/user.slice/user-1000.slice/user@1000.service/app.slice/app-com.anthropic.Claude-6275.scope

  That scope contained Claude Desktop, its Cowork helper, and Claude Code:

6275  /usr/lib/claude-desktop/claude-desktop
6476  /usr/lib/claude-desktop/resources/cowork-linux-helper ...
9228  ~/.config/Claude/claude-code/2.1.222/claude ...
13103 /bin/sh -c "ssh -o BatchMode=yes ..."
13104 ssh ... git@github.com "git-upload-pack '<owner>/<repo>'"

  Environment of PID 13103 (characteristic of a programmatic, non-interactive git call from the app):

CHROME_DESKTOP=com.anthropic.Claude.desktop
CLAUDE_AGENT_SDK_VERSION=0.3.222
GIO_LAUNCHED_DESKTOP_FILE=/usr/share/applications/com.anthropic.Claude.desktop
GIT_SSH_COMMAND=ssh -o BatchMode=yes
GIT_TERMINAL_PROMPT=0
GIT_OPTIONAL_LOCKS=0
GIT_PROTOCOL=version=2

  Working directory = the repo in use:

$ readlink -f /proc/13103/cwd
/home/<user>/<repo-dir>

  SSH used the GNOME agent (/run/user/1000/keyring/ssh), which launched ssh-add ~/.ssh/id_ecdsa → gcr-ssh-askpass (the passphrase dialog).

Steps to Reproduce

1. Have a git repo whose origin is an SSH remote (git@github.com:<owner>/<repo>) with a passphrase-protected key, and the key not currently cached in the ssh-agent.
2. Open/use that repo in Claude Desktop on Linux (a Claude Code session with its working directory inside the repo).
3. Observe: an ssh-agent passphrase dialog (gcr-ssh-askpass) appears without issuing any git remote command — on startup / first prompt, and recurring during the session.
4. To attribute the source, while the dialog is open run:

ps -eo pid,cmd | grep -E 'git-upload-pack|ssh .*git@'
cat /proc/<ssh_pid>/cgroup          # → app-com.anthropic.Claude-*.scope
readlink -f /proc/<ssh_pid>/cwd     # → your repo directory

The ssh … git-upload-pack process belongs to the Claude Desktop application cgroup scope.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Claude Desktop: 1.28929.0; Claude Code CLI: 2.1.222; Claude Agent SDK: 0.3.222

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Xterm

Additional Information

On "latest version": 2.1.222 is the newest CLI obtainable through the official Linux desktop channel — a newer standalone CLI (e.g. 2.1.231) is not reachable via the desktop install. The reported behavior originates from the desktop application scope, so a standalone CLI run outside the desktop app would not exercise the same code path; this report is specifically about the desktop-bundled configuration.

Attribution limitation: the git/ssh subprocess had been reparented to the user systemd instance (PPid: 3341), so the process tree alone does not identify which Claude component/feature initiated the git command. Cgroup membership and the environment attribute it to the Claude Desktop application scope; the specific initiating feature and the original high-level command (git fetch vs git ls-remote) were not captured — only the SSH transport stage (git-upload-pack).