Claude Code Session Links and Git Attribution: Audit and Control Each One

A Claude Code commit can carry three different kinds of identity-like information: Git's author and committer fields, an attribution trailer such as Co-Authored-By, and a Claude-Session link. They live in different places and answer different questions. Treating them as one setting leads to confusing audits and, sometimes, an unnecessary rewrite of shared history.

The current Claude Code reference gives each attribution surface its own control. attribution.commit controls text appended to commit messages, attribution.pr controls text in pull request descriptions, and attribution.sessionUrl controls the session link. As of August 31, 2026, the session-link setting defaults to true for commits and PRs created from Claude Code cloud or Remote Control sessions. Anthropic documents the exact behavior in its Git and attribution settings.

That scope matters. A normal local terminal conversation is not the same product surface as a cloud task or a local session exposed through Remote Control. Before changing configuration, inspect what your repository actually contains.

Identify the record before changing it

The following commit message contains two trailers:

text
Fix token refresh race

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_...

Neither trailer replaces the commit object's author or committer headers. A hosting interface may display trailers prominently, but Git still stores the primary identities separately. Inspect one commit directly:

bash
git show -s \
  --format='author: %an <%ae>%ncommitter: %cn <%ce>%n%n%B' \
  <commit>

The first two lines come from Git's author and committer headers. The remaining body is the commit message, including recognized trailers. Changing Claude Code attribution does not rewrite user.name, user.email, a signing key, or the identity already stored in older commit objects.

There is another URL with a different purpose: a claude-cli:// deep link can open a new local Claude Code session with a directory or prompt prefilled. It is not the https://claude.ai/code/session_... transcript link recorded by Claude-Session. The deep-link documentation describes that separate workflow.

Audit every branch without opening any session

Start with read-only Git commands. To find commit messages containing a session trailer across all local refs:

bash
git log --all --grep='^Claude-Session:' \
  --format='%h %ad %s%n%(trailers:key=Claude-Session,only)%n' \
  --date=short

To list only Co-Authored-By trailers:

bash
git log --all \
  --format='%h %ad %s%n%(trailers:key=Co-Authored-By,only)%n' \
  --date=short

Git documents the distinction directly: --author and --committer filter header identities, while --grep filters the commit message; %(trailers:...) formats recognized message trailers. See the git log reference for the exact format grammar.

No output from the first command means the refs in your local repository do not contain a matching trailer. It does not prove that a deleted remote branch, another clone, a fork, a cached web page, or an unreachable object never held one. For routine prevention, the local result is usually enough. For a confirmed incident, inventory the hosting service and collaborators too.

The link itself is a traceability pointer, not an access-control verdict. Anthropic's cloud-session sharing documentation describes different visibility choices for Team or Enterprise accounts and for Pro or Max accounts. Repository-access checks and recipient login can also matter. A link in a public commit is publicly visible as text; whether its target transcript is viewable is a separate fact to test with the intended account and sharing policy.

Change only the metadata you mean to change

If the session link is the only concern, keep the other defaults and set one Boolean:

json
{
  "attribution": {
    "sessionUrl": false
  }
}

If you want no Claude Code attribution in commits or PR descriptions, make all three choices explicit:

json
{
  "attribution": {
    "commit": "",
    "pr": "",
    "sessionUrl": false
  }
}

You can also replace commit or pr with your own disclosure text rather than hiding it. attribution.commit may include trailers; attribution.pr is plain PR-description text. Leaving either string unset keeps Claude Code's current standard text for that surface.

Do not rely on the older includeCoAuthoredBy key for a new configuration. Anthropic marks it deprecated since v2.0.62. It can still be read for compatibility, but once attribution.commit or attribution.pr is set, the new object determines those surfaces. In particular, an old includeCoAuthoredBy: false does not express the independent session-link choice as clearly as attribution.sessionUrl: false.

Put the policy in the right settings scope

The JSON is only half the decision. Its file location determines who inherits it:

Claude Code resolves ordinary settings from managed policy, command-line overrides, local project settings, shared project settings, and user settings in descending priority. Therefore a correct edit can appear ineffective when a higher layer wins. The settings and scopes guide documents the locations and precedence.

After editing, start a fresh relevant session and run:

text
/status

The status view lists the setting sources Claude Code loaded and reports invalid JSON or rejected values. It does not show per-key provenance, so if several listed files define attribution, inspect them from highest to lowest priority. For a cloud session, a committed .claude/settings.json is the reliable project-level input; a local-only file from your laptop is not part of a fresh cloud clone.

Verification should create disposable evidence, not a production commit. On a temporary branch or test repository, ask the same Claude Code surface you use in practice to create a harmless commit, then inspect it with git show -s --format=fuller. Test a cloud or Remote Control session if that is the path you are controlling; a local-only test cannot prove the cloud-session link behavior.

Decide whether existing history needs repair

Future prevention and past cleanup are separate operations.

If the latest commit has not been shared, edit it locally with git commit --amend, inspect the new object, and continue. If an older local-only commit must change, an interactive rebase can reword selected messages.

If the commit is already on a shared remote and the link does not expose a transcript or sensitive data, leaving history intact is often the lowest-risk decision. Disable the future behavior, document the policy, and avoid breaking commit IDs, open PRs, release references, signatures, or collaborators' branches merely for cosmetic consistency.

If policy requires removing the text from published history, coordinate first. Rewording creates new commit IDs and requires updated remote refs. GitHub's commit-message change guide warns that force-pushing can disrupt collaborators and that rewritten sensitive messages may remain retrievable by old object ID.

If opening the session actually exposed a credential, private key, customer data, or another secret, treat it as an incident rather than an attribution preference. Restrict session visibility where possible, revoke or rotate the secret first, preserve the facts needed for response, then coordinate repository cleanup and hosting-provider support. GitHub's sensitive-data removal guide explains why history rewriting alone is insufficient and why old clones can reintroduce removed data.

The practical rule is simple: inspect the exact surface, set the smallest independent control, verify it in the session type that produced the metadata, and rewrite shared history only when the risk or policy justifies the coordination cost.