[BUG] Self-hosted runner: add_repo instructs cloning https://github.com/... but sessions have no credentials or insteadOf rewrite for github.com

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

In a self-hosted runner session (environment_kind: byoc), the add_repo tool result instructs the agent to clone the newly attached repo with:

Run git clone --depth 1 https://github.com/<owner>/<repo> ./<repo>

That command cannot succeed. A session has no credential helper and no insteadOf rewrite for github.com — its git credentials are scoped to https://api.anthropic.com, the session-ingress git proxy. So the documented command fails immediately:

fatal: could not read Username for 'https://github.com': No such device or address

The clone only works against the proxy URL, which has to be reconstructed by hand:

https://api.anthropic.com/v1/session_ingress/session/<session-id>/git_proxy/<owner>/<repo>.git

Substituting that succeeds (exit 0, including LFS smudge for LFS-tracked paths).

The URL shape is discoverable — the session's initial-set repos already have exactly that form as their origin — but the instruction text doesn't mention it, and an agent following the instruction literally hits a hard failure first.

That first failure is more costly than it looks, because the same add_repo message also says (correctly) not to retry in a loop, not to spawn more workers, and not to rm -rf a directory that might be a live clone. So an agent that follows the clone instruction verbatim, fails, and then follows the recovery guidance conservatively can burn a fair amount of a turn before working out that the URL itself was the problem.

What Should Happen?

Either:

1. add_repo's guidance should give the session-ingress git_proxy URL (it already knows the session id — it renders it elsewhere in the same message), or
2. the session should configure url.https://api.anthropic.com/v1/session_ingress/session/<id>/git_proxy/.insteadOf = https://github.com/, so the documented github.com command works as written.

Option 2 seems preferable: it also fixes any tooling, script, or CLAUDE.md instruction that hardcodes a github.com remote.

Error Messages/Logs

$ cd /workspace/_sessions/cse_<redacted>
$ git clone --depth 1 https://github.com/<org>/<repo> ./<repo>
Cloning into './<repo>'...
fatal: could not read Username for 'https://github.com': No such device or address

# substituting the session-ingress proxy URL instead:
$ git clone --depth 1 https://api.anthropic.com/v1/session_ingress/session/cse_<redacted>/git_proxy/<org>/<repo>.git ./<repo>
Cloning into './<repo>'...
# exit 0

Steps to Reproduce

1. Start a session in a self-hosted runner environment.
2. Attach any repository with add_repo.
3. Follow the returned instruction verbatim: cd to the session base working directory and run git clone --depth 1 https://github.com/<owner>/<repo> ./<repo>.
4. The clone fails with could not read Username for 'https://github.com'.
5. Re-run with https://api.anthropic.com/v1/session_ingress/session/<session-id>/git_proxy/<owner>/<repo>.git — this succeeds.

Diagnostic detail

git config --list inside a session pod shows credentials scoped only to the proxy host, and no url.*.insteadOf entries at all:

credential.https://api.anthropic.com.helper=!'/workspace/.runner/git-proxy-cred'
credential.https://api.anthropic.com.usehttppath=false
http.https://api.anthropic.com/.proactiveauth=basic
remote.origin.url=https://api.anthropic.com/v1/session_ingress/session/<id>/git_proxy/<owner>/<repo>.git

Related: anthropics/claude-code#90161, a different bug on the same self-hosted-runner git-proxy path (resume-time clones of add_repo'd repos fail their LFS smudge for lack of credentials). This report is only about the advertised clone URL.

Claude Model

Opus

Is this a regression?

I don't know

Claude Code Version

A custom self-hosted runner image (Ubuntu 26.04 arm64, git 2.53.0) tracking Anthropic's apt latest channel. 2.1.247 (Claude Code) on the local executor.

Platform

Anthropic API

Operating System

Other Linux

[!NOTE] Repository, path, and pool names in this report are redacted placeholders (<org>/<repo>, path/to/...); the specifics are not relevant to the mechanism and can be shared privately if they would help triage.

---

Investigated and drafted by Claude Code; filed by the repository owner.