Group of 3 You'll notice
Git commands Claude Code runs internally are now locked down against unexpected network access and interactive prompts
What
- New, frozen sets of environment variables are applied to internal git invocations:
GIT_ALLOW_PROTOCOL="none",GIT_NO_LAZY_FETCH="1",GIT_NO_REPLACE_OBJECTS="1",GIT_TERMINAL_PROMPT="0", and, unless SSH is explicitly allowed,GIT_SSH_COMMAND="false". - The internal git command-construction helper gained a new
allowGitTerminalPromptoption; unless a call explicitly allows it,GIT_TERMINAL_PROMPTis stripped from the environment passed to the git subprocess, whereas before it could pass through unfiltered. - Git push calls used internally (for worktree operations and plugin tag creation) now explicitly set
allowGitTerminalPrompt: disabled for background worktree pushes, enabled for interactive plugin tag pushes.
Why
This reduces the risk of internal git commands silently reaching the network, replacing objects, or hanging on an interactive credential prompt, while still allowing prompts in the specific cases where a human is present to answer them.