[GitHub integration] **Title:** Cloud (Cowork) session: git proxy and GitHub API refuse a repository that is not in the "session's authorized repository set"; no `add_repo` tool exposed; connector reconnect does not fix it

Screenshot

_No response_

What were you trying to do?

From a Claude cloud/Cowork session, work on my own private repository tanj68/conviction-model-validation: read and post GitHub issue/PR comments via the REST API and push a branch, using a fine-grained PAT (Contents + Issues + Pull requests read/write on that repo).

Concretely:

1. GET https://api.github.com/repos/tanj68/conviction-model-validation/issues/24 with Authorization: Bearer <PAT>
2. POST a comment to the same issue
3. git push origin <sha>:refs/heads/vega/_probe (remote URL contains the PAT as x-access-token)

What happened instead?

All credentialed operations on the repository are refused by the session's proxy, not by GitHub, on every retry over ~45 minutes:

1. API read (and metadata, and POST /graphql) → HTTP 403 with a proxy-generated body:{"message":"GitHub access to this repository is not enabled for this session. Use add_repo to request access. If add_repo answers that read access is already available and you need GitHub API or write access, call add_repo again with access:"push" to attach the repository with credentials.","documentation_url":"https://docs.anthropic.com/en/docs/claude-code/github-actions"}
2. git push --dry-run → 403: remote: access denied by the git proxy: tanj68/conviction-model-validation is not in this session's authorized repository set, so the proxy will not inject a credential for it. To fix, add the repository to the session's sources.

fatal: unable to access 'https://github.com/tanj68/conviction-model-validation.git/': The requested URL returned error: 403

1. The add_repo tool the message points to is not available in the session: ToolSearch for add_repo / mcp__github__add_repo / enable__mcp__github returns "No matching deferred tools found".

Meanwhile, in the same session:

• git clone and git ls-remote of the same repo with the same PAT succeed (read-only git works).
• GET https://api.github.com/user with the PAT → 200, login: tanj68 — so the PAT is valid and reaches GitHub for non-repo endpoints.
• curl $HTTPS_PROXY/__agentproxy/status → enabled: true, selective: false, standalone: false, toolScoped: false, gitConfigInjection: true, gitSshRewrite: true, recentRelayFailures: [] — no egress-policy denial recorded; the block is the per-session repository set.

Expected behavior

Either the repository is authorized for the session (it is my own repository and the GitHub connector is linked), or add_repo is exposed so the session can request access, as the proxy's own error text instructs.

Steps to reproduce

1. Link the GitHub connector in claude.ai settings; start a cloud/Cowork session (mine is bound to a Project and linked to a Mac via the desktop app).
2. In the session, git clone a private repo you own using a valid fine-grained PAT (succeeds).
3. From the same session, run any credentialed API call under /repos/<owner>/<repo>/… or git push (fails as above).
4. ToolSearch for add_repo (not found).

What I already tried

• Generated a new fine-grained PAT (old one revoked): /user → 200, repo endpoints → same 403. Not the token.
• Viewed the same session from the desktop app instead of the browser → no change.
• Disconnected and reconnected the GitHub connector in claude.ai settings, selecting the repository in the picker (per #78122 / #95832) → no change in the running session; add_repo still absent.
• This session was itself a new session, started after a previous session on the same day lost push/API access to the same repository mid-session (that earlier session had been posting to GitHub successfully before it stopped).

Environment

• Claude cloud/Cowork session started from the web app; later viewed from the macOS desktop app 2.2553.1.
• Session started 2026-09-22 ~12:49 CEST; bound to a claude.ai Project; linked Mac (device tools present).
• Container: /home/claude, Python 3.11.15; outbound HTTPS via the agent proxy at http://127.0.0.1:45779 (HTTPS_PROXY), CA bundle /root/.ccr/ca-bundle.crt.
• GitHub user: tanj68 (repository owner). Fine-grained PAT, scoped to the repo.
• [previous session id / task link, if available]

Impact

Cloud sessions cannot post issue/PR comments or push branches to the user's own repository even with a valid PAT and a linked connector; all GitHub output has to be pasted manually.

Diagnostics