claude --cloud fails repository auth when a git url.insteadOf rule rewrites the GitHub remote

What happens

claude --cloud from a private repo fails during container setup:

Authentication failed while accessing the repository "owner/repo". Check that your GitHub token or credentials have read access to this repository. If using a private repo, verify the integration is authorized for it.

The setup script and "Start Claude Code" steps are then skipped, and the session ends with a generic API error ("Session couldn't start. This session hit an error it can't recover from.").

A session started from claude.ai/code, with the same account and the same repository, clones and runs fine.

Cause

A global insteadOf rule rewrites GitHub URLs to an SSH-over-443 alias host:

git config --global url."git@ssh.github.com:".insteadOf "git@github.com:"

The repository's stored remote is canonical, but the effective one is not:

$ git config --get remote.origin.url     # stored
git@github.com:owner/repo.git

$ git remote get-url origin              # what tools read
git@ssh.github.com:owner/repo.git

Repository identity appears to be derived from the second. The web UI works because it picks the repository from a list and never consults the local remote.

Reproduce

1. Add the insteadOf rule above.
2. In a private repo whose remote is an ordinary git@github.com: URL, run claude --cloud "...".
3. The session dies at "Set up a cloud container" with the authentication error.

Removing the rule fixes it. A remote that escapes the rewrite — for example https://<user>@github.com/owner/repo.git — also works, which isolates the variable.

Suggested fix

Prefer git config --get remote.origin.url over the rewritten URL when resolving repository identity, or normalise known GitHub SSH aliases (ssh.github.com) to github.com.

Why it matters

The error text points at token scope and integration authorisation, neither of which is involved. Diagnosing it took two days and included reinstalling the Claude GitHub App, granting it access to all repositories, and re-running /web-setup — while gh auth status had shown repo scope the entire time.

Rewriting GitHub URLs to ssh.github.com:443 is a common workaround where port 22 is blocked, and it is frequently redundant with an ~/.ssh/config entry doing the same job — so the rule can sit in a config for years before anything surfaces it.

Environment

• Windows 11, Git Bash / PowerShell
• Private repository on a personal account
• Claude GitHub App installed with access to all repositories; gh authenticated with repo scope