Unclear It is not confirmed that git remotes now actually behave the way the new warning says.
What
These changes affect how Claude Code sets up git, the version-control tool, in a repository it prepares for a session.
- Setup now adds the
originremote usingoriginURLinstead ofauthURL, so the URL that contains credentials is no longer written into the repository's git config. A neworiginURLfield sits next toauthURL. - For a governed git setup with a direct-upstreams list, the warning now says every source keeps its upstream URL as origin and no in-session fetches are routed through the git mount. Before, it said every source was reset to its upstream URL after preparation.
- Git commands that Claude Code runs no longer inherit
GIT_CONFIGfrom your environment. Any variable matchingGIT_CONFIG, in any letter case, is removed. This joins the existingGIT_CONFIG_GLOBAL=/dev/nulland the removal ofCLAUDE_CODE_SESSION_ACCESS_TOKEN. - Separately, a new check looks at whether
ANTHROPIC_CUSTOM_HEADERSholds a non-empty header and whether it matches a value from another source. What that check controls was not shown.
Why
The credentialed URL is no longer stored in the repository's git config, and an inherited GIT_CONFIG can no longer change how Claude Code's git commands behave. Admins of governed git setups should expect sources to keep their upstream URL as origin rather than being reset after preparation.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
It is not confirmed that git remotes now actually behave the way the new warning says.