What
Git operations Claude Code runs now rewrite inherited environment variables before invoking git: GIT_SSH_COMMAND and GIT_SSH are forced into batch mode with strict host-key checking, and GIT_ALLOW_PROTOCOL is rebuilt as explicit -c protocol.X.allow=never flags. Git also refuses to run when the working directory path cannot be expressed in git's path-separated discovery ceiling.
Details
- Applies to every git invocation built through this helper; there is no setting to opt out.
- The refusal message explains that git's discovery ceiling is a separator-delimited list that cannot express the path.
Evidence
git's discovery ceiling (a "${l}"-separated list) cannot express
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundleGIT_SSH_COMMANDGIT_ALLOW_PROTOCOL
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up GIT_ALLOW_PROTOCOL, on Claude Code changelog.
* Self-hosted runner: Changed git in lifecycle hooks to ignore hook folders and programs named in the runner's shared git files; local-path and `git://` remotes there now need `GIT_ALLOW_PROTOCOL`changelog see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up GIT_ALLOW_PROTOCOL, on Claude Code changelog.