What
Git commands now run under fixed environment maps rather than ones assembled per call. The restricted map sets GIT_ALLOW_PROTOCOL to none and GIT_TERMINAL_PROMPT to 0 so git cannot fetch over the network or prompt for credentials; a second map allows file:git:http:https:ssh where network access is intended.
Details
- Both maps point git's config graft at
/dev/null(or the platform equivalent) so repo-supplied config cannot take effect. - A separate set names git global flags that are rejected during command parsing, including
--exec-path,--git-dir,--attr-sourceand--shallow-file. - Invocations pass
safe.bareRepository=explicit, so git will not treat a stray directory as a bare repo.
Evidence
safe.bareRepository=explicit
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundleGIT_ALLOW_PROTOCOLGIT_TERMINAL_PROMPT
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up GIT_ALLOW_PROTOCOL, on Claude Code changelog.
* Self-hosted runner: Changed git in lifecycle hooks to ignore hook folders and programs named in the runner's shared git files; local-path and `git://` remotes there now need `GIT_ALLOW_PROTOCOL`changelog see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up GIT_ALLOW_PROTOCOL, on Claude Code changelog.