Commit `Claude-Session:` attribution trailer ignores `attribution: {commit: ""}` setting

[rustyrazorblade]

Summary

With commit attribution disabled via settings (attribution: { "commit": "", "pr": "" }), Claude Code still appends a Claude-Session: https://claude.ai/code/session_<id> trailer to git commit messages. The trailer is injected into the model's Bash tool description (a # Git section instructing the model to "End git commit messages with: Claude-Session: "), and it does not honor the local attribution config.

The legacy Co-Authored-By / "Generated with Claude Code" footer is correctly suppressed by the setting — only this newer Claude-Session: header ignores it.

Environment

• Claude Code: 2.1.210
• OS: macOS 15.6.1 (24G90)

Steps to reproduce

1. In ~/.claude/settings.json, disable attribution:

   "attribution": { "commit": "", "pr": "" }

2. Have Claude Code (or a subagent) create a git commit.
3. Inspect the commit message.

Expected

With attribution.commit set to empty, no attribution trailer is added to commit messages (no Co-Authored-By, and no Claude-Session:).

Actual

The commit message ends with:

Claude-Session: https://claude.ai/code/session_<session-id>

and PR bodies get the same URL appended. Confirmed across both the main session and spawned subagents (each subagent's Bash tool carries the same directive).

Root cause (as far as I can tell)

No local settings layer enables attribution — all are empty/absent:

Layer	attribution
~/.claude/settings.json (user)	{"commit":"","pr":""}
project .claude/settings.json	absent
project .claude/settings.local.json	absent
~/.claude.json	null

However ~/.claude.json shows a cached server-side gate:

cachedStatsigGates.tengu_ant_attribution_header_new = true

This "new attribution header" feature appears to be what injects the Claude-Session: trailer into the Bash-tool git guidance, and it bypasses the user's attribution setting.

Impact

Users who deliberately disable commit attribution (clean history, org policy, contributing to upstream repos where Claude attribution is unwanted) get Claude attribution on commits anyway, and must strip it manually after every commit. The attribution setting reads as honored (no Co-Authored-By) but silently isn't for the new header.

Request

Have the tengu_ant_attribution_header_new attribution-header feature respect the local attribution: { "commit": "", "pr": "" } configuration (and/or provide a documented way to disable the Claude-Session: trailer).

[xdannyrobertsx]

i'm running into this as well

[elidickinson]

CLAUDE_CODE_SUPPRESS_SESSION_ATTRIBUTION=1 env var or "attribution": { "sessionUrl": false } in ~/.claude/settings.json should stop it. Annoying.

[mannewalis]

Can whoever is in charge of whatever please ensure this doesn't happen again. This is the second such attribution that has happened which has caused history rewrites and subsequent friction. Nobody wants this!!!!!

[dergachoff]

Hit this today with attribution: {"commit": "", "pr": ""} set since months back — the Claude-Session: trailer still landed in 273 commits (found via commit search), including one merged PR to a third-party repo I can't rewrite. Confirming the workaround for anyone else: adding "sessionUrl": false to the attribution object stops it on the next session. Would be good if the existing commit: "" opt-out covered new attribution channels by default.

[bcherny]

Reproduced on v2.1.233 (macOS).

The Claude-Session: trailer is only added when Claude Code runs as a cloud (claude.ai/code) session or a Remote Control session, and it is controlled by a separate setting from the Co-Authored-By footer.

Steps:

1. In ~/.claude/settings.json (or the project's .claude/settings.json) set "attribution": { "commit": "", "pr": "" }.
2. Run Claude Code as a cloud or Remote Control session and ask it to commit a change.
3. git log -1 --format=%B

Observed:

Add line 3

Claude-Session: https://claude.ai/code/session_...

Expected (per the reporter): no attribution trailer at all, since commit attribution is disabled.

For comparison, the same steps in a plain local terminal session produce just Add line 3 (no trailer), and the Co-Authored-By / "Generated with Claude Code" footer is correctly suppressed in both cases. Adding "sessionUrl": false to the attribution object stops the trailer on the next session, as does the CLAUDE_CODE_SUPPRESS_SESSION_ATTRIBUTION=1 environment variable.

Assessment: This is working as currently designed, but the expectation is reasonable and we should make it clearer. attribution.commit and attribution.pr govern the model attribution (Co-Authored-By / "Generated with"), while the session link has its own switch, attribution.sessionUrl (available since v2.1.182). The settings reference documents this and says "To hide all attribution, set commit and pr to empty strings and sessionUrl to false" (https://code.claude.com/docs/en/settings#attribution-settings, and https://code.claude.com/docs/en/cloud-environments). That said, the same page describes commit as covering "any trailers", Claude-Session: is a trailer, and the session link only appears in cloud/Remote Control sessions, so people who opted out months earlier had no signal that a new channel needed a new opt-out. The cleaner behavior would be for an explicit commit: "" / pr: "" to also drop the session link (with sessionUrl still available to turn just that part off), or at minimum for the docs to say plainly that commit: "" does not affect the session trailer. The Statsig gate mentioned in the report is unrelated; the trailer comes from the cloud/Remote Control session context, not that flag.

🤖 Generated with Claude Code

[shbernal]

Still present in 2.1.231 (Linux, Arch claude-code package), with attribution: { "commit": "" } and includeCoAuthoredBy: false set in ~/.claude/settings.json for months. A Remote Control session put Claude-Session: https://claude.ai/code/session_… into the initial commit of a public repo, where it was the only trailer.

That last part looks like the actual defect, and it is a bit worse than "the setting is ignored". From the 2.1.231 bundle:

function T4b() {
  // …
  if (i !== undefined && pps(i)) return { commit: i.commit ?? n, pr: i.pr ?? r };
  if (o.includeCoAuthoredBy === false) return { commit: "", pr: "" };
  return { commit: n, pr: r };
}

function H4b(e, t, r) {
  let n = r ?? t;
  return {
    commit: e.commit ? `${e.commit}\nClaude-Session: ${t}` : `Claude-Session: ${t}`,
    pr: e.pr ? `${e.pr}\n\n${n}` : n
  };
}

attribution.commit: "" makes T4b return an empty string, which is falsy, so H4b takes the else branch and emits a bare Claude-Session: trailer. Opting out of attribution doesn't suppress the session URL — it promotes it from a line appended after Co-Authored-By to the sole piece of attribution in the commit. The same shape applies to pr.

The suppression that does work is the separate check earlier in the chain:

if (Q.CLAUDE_CODE_SUPPRESS_SESSION_ATTRIBUTION) return null;
if (Fo().attribution?.sessionUrl === false) return null;

So the workaround in the comments above ("attribution": { "sessionUrl": false }) is confirmed on 2.1.231 too.

Two suggestions, in case they are useful when this is fixed:

1. Treat an explicitly-empty attribution.commit / attribution.pr as "no attribution of any kind", rather than as "no text to prepend". An empty string set deliberately and an unset field are different intents, and the current code collapses them.
2. Whatever the default becomes, new attribution channels should default to whatever the user's existing opt-out already expressed. This is the second trailer to reach histories that had attribution turned off (see also Attribution opt-out does not survive new attribution features (attribution.sessionUrl re-enables Claude-Session trailer despite commit/pr set to "") #82690, Session link is written into git history by default with no reliable opt-out #83226), which suggests the opt-out is being re-derived per channel instead of read once.