diff --git a/loop/agent.go b/loop/agent.go
index 21e10d7..1a13759 100644
--- a/loop/agent.go
+++ b/loop/agent.go
@@ -136,6 +136,9 @@
 	// GitUsername returns the git user name from the agent config.
 	GitUsername() string
 
+	// PassthroughUpstream returns whether passthrough upstream is enabled.
+	PassthroughUpstream() bool
+
 	// DiffStats returns the number of lines added and removed from sketch-base to HEAD
 	DiffStats() (int, int)
 	// OpenBrowser is a best-effort attempt to open a browser at url in outside sketch.
@@ -786,6 +789,11 @@
 	return a.config.OriginalGitOrigin
 }
 
+// PassthroughUpstream returns whether passthrough upstream is enabled.
+func (a *Agent) PassthroughUpstream() bool {
+	return a.config.PassthroughUpstream
+}
+
 // GitUsername returns the git user name from the agent config.
 func (a *Agent) GitUsername() string {
 	return a.config.GitUsername
@@ -1105,6 +1113,8 @@
 	MCPServers []string
 	// Timeout configuration for bash tool
 	BashTimeouts *claudetool.Timeouts
+	// PassthroughUpstream configures upstream remote for passthrough to innie
+	PassthroughUpstream bool
 }
 
 // NewAgent creates a new Agent.
@@ -1161,14 +1171,7 @@
 
 	// If a remote + commit was specified, clone it.
 	if a.config.Commit != "" && a.gitState.gitRemoteAddr != "" {
-		if _, err := os.Stat("/app/.git"); err == nil {
-			// Already a repo in /app.
-			// Make sure that the remote is configured correctly.
-			// We do a fetch below.
-			if err := upsertRemoteOrigin(ctx, "/app", a.gitState.gitRemoteAddr); err != nil {
-				return err
-			}
-		} else {
+		if _, err := os.Stat("/app/.git"); err != nil {
 			slog.InfoContext(ctx, "cloning git repo", "commit", a.config.Commit)
 			// TODO: --reference-if-able instead?
 			cmd := exec.CommandContext(ctx, "git", "clone", "--reference", "/git-ref", a.gitState.gitRemoteAddr, "/app")
@@ -1186,6 +1189,9 @@
 	}
 
 	if !ini.NoGit {
+		if err := upsertRemoteOrigin(ctx, "/app", a.gitState.gitRemoteAddr); err != nil {
+			return err
+		}
 
 		// Configure git user settings
 		if a.config.GitEmail != "" {
@@ -1208,6 +1214,13 @@
 		if out, err := cmd.CombinedOutput(); err != nil {
 			return fmt.Errorf("git config --global http.postBuffer: %s: %v", out, err)
 		}
+
+		// Configure passthrough upstream if enabled
+		if a.config.PassthroughUpstream {
+			if err := a.configurePassthroughUpstream(ctx); err != nil {
+				return fmt.Errorf("failed to configure passthrough upstream: %w", err)
+			}
+		}
 	}
 
 	// If a commit was specified, we fetch and reset to it.
@@ -2306,6 +2319,8 @@
 
 // upsertRemoteOrigin configures the origin remote to point to the given URL.
 // If the origin remote exists, it updates the URL. If it doesn't exist, it adds it.
+//
+// NOTE: Maybe we should use an "insteadOf" setting instead of changing the URL.
 func upsertRemoteOrigin(ctx context.Context, repoDir, remoteURL string) error {
 	// Try to set the URL for existing origin remote
 	cmd := exec.CommandContext(ctx, "git", "remote", "set-url", "origin", remoteURL)
@@ -2635,6 +2650,63 @@
 	return nil
 }
 
+// configurePassthroughUpstream configures git remotes
+// Adds an upstream remote pointing to the same as origin
+// Sets the refspec for upstream and fetch such that both
+// fetch the upstream's things into refs/remotes/upstream/foo
+// The typical scenario is:
+//
+//	github     -   laptop   -  sketch container
+//	"upstream"    "origin"
+func (a *Agent) configurePassthroughUpstream(ctx context.Context) error {
+	// Get the origin remote URL
+	cmd := exec.CommandContext(ctx, "git", "remote", "get-url", "origin")
+	cmd.Dir = a.workingDir
+	originURLBytes, err := cmd.CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("failed to get origin URL: %s: %w", originURLBytes, err)
+	}
+	originURL := strings.TrimSpace(string(originURLBytes))
+
+	// Check if upstream remote already exists
+	cmd = exec.CommandContext(ctx, "git", "remote", "get-url", "upstream")
+	cmd.Dir = a.workingDir
+	if _, err := cmd.CombinedOutput(); err != nil {
+		// upstream remote doesn't exist, create it
+		cmd = exec.CommandContext(ctx, "git", "remote", "add", "upstream", originURL)
+		cmd.Dir = a.workingDir
+		if out, err := cmd.CombinedOutput(); err != nil {
+			return fmt.Errorf("failed to add upstream remote: %s: %w", out, err)
+		}
+		slog.InfoContext(ctx, "added upstream remote", "url", originURL)
+	} else {
+		// upstream remote exists, update its URL
+		cmd = exec.CommandContext(ctx, "git", "remote", "set-url", "upstream", originURL)
+		cmd.Dir = a.workingDir
+		if out, err := cmd.CombinedOutput(); err != nil {
+			return fmt.Errorf("failed to set upstream remote URL: %s: %w", out, err)
+		}
+		slog.InfoContext(ctx, "updated upstream remote URL", "url", originURL)
+	}
+
+	// Add the upstream refspec to the upstream remote
+	cmd = exec.CommandContext(ctx, "git", "config", "remote.upstream.fetch", "+refs/remotes/origin/*:refs/remotes/upstream/*")
+	cmd.Dir = a.workingDir
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("failed to set upstream fetch refspec: %s: %w", out, err)
+	}
+
+	// Add the same refspec to the origin remote
+	cmd = exec.CommandContext(ctx, "git", "config", "--add", "remote.origin.fetch", "+refs/remotes/origin/*:refs/remotes/upstream/*")
+	cmd.Dir = a.workingDir
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("failed to add upstream refspec to origin: %s: %w", out, err)
+	}
+
+	slog.InfoContext(ctx, "configured passthrough upstream", "origin_url", originURL)
+	return nil
+}
+
 // SkabandAddr returns the skaband address if configured
 func (a *Agent) SkabandAddr() string {
 	if a.config.SkabandClient != nil {
diff --git a/loop/server/loophttp.go b/loop/server/loophttp.go
index 79e9e54..296317b 100644
--- a/loop/server/loophttp.go
+++ b/loop/server/loophttp.go
@@ -19,6 +19,7 @@
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
 	"runtime/debug"
 	"strconv"
 	"strings"
@@ -34,6 +35,60 @@
 	"sketch.dev/loop/server/gzhandler"
 )
 
+// Remote represents a git remote with display information.
+type Remote struct {
+	Name        string `json:"name"`
+	URL         string `json:"url"`
+	DisplayName string `json:"display_name"`
+	IsGitHub    bool   `json:"is_github"`
+}
+
+// GitPushInfoResponse represents the response from /git/pushinfo
+type GitPushInfoResponse struct {
+	Hash    string   `json:"hash"`
+	Subject string   `json:"subject"`
+	Remotes []Remote `json:"remotes"`
+}
+
+// GitPushRequest represents the request body for /git/push
+type GitPushRequest struct {
+	Remote string `json:"remote"`
+	Branch string `json:"branch"`
+	Commit string `json:"commit"`
+	DryRun bool   `json:"dry_run"`
+	Force  bool   `json:"force"`
+}
+
+// GitPushResponse represents the response from /git/push
+type GitPushResponse struct {
+	Success bool   `json:"success"`
+	Output  string `json:"output"`
+	DryRun  bool   `json:"dry_run"`
+	Error   string `json:"error,omitempty"`
+}
+
+// isGitHubURL checks if a URL is a GitHub URL
+func isGitHubURL(url string) bool {
+	return strings.Contains(url, "github.com")
+}
+
+// simplifyGitHubURL simplifies GitHub URLs to "owner/repo" format
+// and also returns whether it's a github url
+func simplifyGitHubURL(url string) (string, bool) {
+	// Handle GitHub URLs in various formats
+	if strings.Contains(url, "github.com") {
+		// Extract owner/repo from URLs like:
+		// https://github.com/owner/repo.git
+		// git@github.com:owner/repo.git
+		// https://github.com/owner/repo
+		re := regexp.MustCompile(`github\.com[:/]([^/]+/[^/]+?)(?:\.git)?/?$`)
+		if matches := re.FindStringSubmatch(url); len(matches) > 1 {
+			return matches[1], true
+		}
+	}
+	return url, false
+}
+
 // terminalSession represents a terminal session with its PTY and the event channel
 type terminalSession struct {
 	pty                *os.File
@@ -691,6 +746,12 @@
 		json.NewEncoder(w).Encode(map[string]string{"path": filename})
 	})
 
+	// Handler for /git/pushinfo - returns HEAD commit and remotes for push dialog
+	s.mux.HandleFunc("/git/pushinfo", s.handleGitPushInfo)
+
+	// Handler for /git/push - handles git push operations
+	s.mux.HandleFunc("/git/push", s.handleGitPush)
+
 	// Handler for /cancel - cancels the current inner loop in progress
 	s.mux.HandleFunc("/cancel", func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodPost {
@@ -1560,3 +1621,178 @@
 	}
 	_ = json.NewEncoder(w).Encode(response) // can't do anything useful with errors anyway
 }
+
+// handleGitPushInfo returns the current HEAD commit info and remotes for push dialog
+func (s *Server) handleGitPushInfo(w http.ResponseWriter, r *http.Request) {
+	if r.Method != "GET" {
+		w.WriteHeader(http.StatusMethodNotAllowed)
+		return
+	}
+
+	repoDir := s.agent.RepoRoot()
+
+	// Get the current HEAD commit hash and subject in one command
+	cmd := exec.Command("git", "log", "-n", "1", "--format=%H%x00%s", "HEAD")
+	cmd.Dir = repoDir
+	output, err := cmd.Output()
+	if err != nil {
+		http.Error(w, fmt.Sprintf("Error getting HEAD commit: %v", err), http.StatusInternalServerError)
+		return
+	}
+
+	parts := strings.Split(strings.TrimSpace(string(output)), "\x00")
+	if len(parts) != 2 {
+		http.Error(w, "Unexpected git log output format", http.StatusInternalServerError)
+		return
+	}
+	hash := parts[0]
+	subject := parts[1]
+
+	// Get list of remote names
+	cmd = exec.Command("git", "remote")
+	cmd.Dir = repoDir
+	output, err = cmd.Output()
+	if err != nil {
+		http.Error(w, fmt.Sprintf("Error getting remotes: %v", err), http.StatusInternalServerError)
+		return
+	}
+
+	remoteNames := strings.Fields(strings.TrimSpace(string(output)))
+
+	remotes := make([]Remote, 0, len(remoteNames))
+
+	// Get URL and display name for each remote
+	for _, remoteName := range remoteNames {
+		cmd = exec.Command("git", "remote", "get-url", remoteName)
+		cmd.Dir = repoDir
+		urlOutput, err := cmd.Output()
+		if err != nil {
+			// Skip this remote if we can't get its URL
+			continue
+		}
+		url := strings.TrimSpace(string(urlOutput))
+
+		// Set display name based on passthrough-upstream and remote name
+		var displayName string
+		var isGitHub bool
+		if s.agent.PassthroughUpstream() && remoteName == "origin" {
+			// For passthrough upstream, origin displays as "outside_hostname:outside_working_dir"
+			displayName = fmt.Sprintf("%s:%s", s.agent.OutsideHostname(), s.agent.OutsideWorkingDir())
+			isGitHub = false
+		} else if remoteName == "origin" || remoteName == "upstream" {
+			// Use git_origin value, simplified for GitHub URLs
+			displayName, isGitHub = simplifyGitHubURL(s.agent.GitOrigin())
+		} else {
+			// For other remotes, use the remote URL directly
+			displayName, isGitHub = simplifyGitHubURL(url)
+		}
+
+		remotes = append(remotes, Remote{
+			Name:        remoteName,
+			URL:         url,
+			DisplayName: displayName,
+			IsGitHub:    isGitHub,
+		})
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	response := GitPushInfoResponse{
+		Hash:    hash,
+		Subject: subject,
+		Remotes: remotes,
+	}
+	_ = json.NewEncoder(w).Encode(response)
+}
+
+// handleGitPush handles git push operations
+func (s *Server) handleGitPush(w http.ResponseWriter, r *http.Request) {
+	if r.Method != "POST" {
+		w.WriteHeader(http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Parse request body
+	var requestBody GitPushRequest
+
+	if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil {
+		http.Error(w, fmt.Sprintf("Error parsing request body: %v", err), http.StatusBadRequest)
+		return
+	}
+	defer r.Body.Close()
+
+	if requestBody.Remote == "" || requestBody.Branch == "" || requestBody.Commit == "" {
+		http.Error(w, "Missing required parameters: remote, branch, and commit", http.StatusBadRequest)
+		return
+	}
+
+	repoDir := s.agent.RepoRoot()
+
+	// Build the git push command
+	args := []string{"push"}
+	if requestBody.DryRun {
+		args = append(args, "--dry-run")
+	}
+	if requestBody.Force {
+		args = append(args, "--force")
+	}
+
+	// Determine the target refspec
+	var targetRef string
+	if s.agent.PassthroughUpstream() && requestBody.Remote == "upstream" {
+		// Special case: upstream with passthrough-upstream pushes to refs/remotes/origin/<branch>
+		targetRef = fmt.Sprintf("refs/remotes/origin/%s", requestBody.Branch)
+	} else {
+		// Normal case: push to refs/heads/<branch>
+		targetRef = fmt.Sprintf("refs/heads/%s", requestBody.Branch)
+	}
+
+	args = append(args, requestBody.Remote, fmt.Sprintf("%s:%s", requestBody.Commit, targetRef))
+
+	// Log the git push command being executed
+	slog.InfoContext(r.Context(), "executing git push command",
+		"command", "git",
+		"args", args,
+		"remote", requestBody.Remote,
+		"branch", requestBody.Branch,
+		"commit", requestBody.Commit,
+		"target_ref", targetRef,
+		"dry_run", requestBody.DryRun,
+		"force", requestBody.Force,
+		"repo_dir", repoDir)
+
+	cmd := exec.Command("git", args...)
+	cmd.Dir = repoDir
+	// Ideally we want to pass an extra HTTP header so that the
+	// server can know that this was likely a user initiated action
+	// and not an agent-initiated action. However, git push weirdly
+	// doesn't take a "-c" option, and the only handy env variable that
+	// because a header is the user agent, so we abuse it...
+	cmd.Env = append(os.Environ(), "GIT_HTTP_USER_AGENT=sketch-intentional-push")
+	output, err := cmd.CombinedOutput()
+
+	// Log the result of the git push command
+	if err != nil {
+		slog.WarnContext(r.Context(), "git push command failed",
+			"error", err,
+			"output", string(output),
+			"args", args)
+	} else {
+		slog.InfoContext(r.Context(), "git push command completed successfully",
+			"output", string(output),
+			"args", args)
+	}
+
+	// Prepare response
+	response := GitPushResponse{
+		Success: err == nil,
+		Output:  string(output),
+		DryRun:  requestBody.DryRun,
+	}
+
+	if err != nil {
+		response.Error = err.Error()
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(response)
+}
diff --git a/loop/server/loophttp_test.go b/loop/server/loophttp_test.go
index c6d4b6b..04a18ba 100644
--- a/loop/server/loophttp_test.go
+++ b/loop/server/loophttp_test.go
@@ -3,6 +3,7 @@
 import (
 	"bufio"
 	"context"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"slices"
@@ -245,6 +246,7 @@
 func (m *mockAgent) OutsideWorkingDir() string                   { return "/app" }
 func (m *mockAgent) GitOrigin() string                           { return "" }
 func (m *mockAgent) GitUsername() string                         { return m.gitUsername }
+func (m *mockAgent) PassthroughUpstream() bool                   { return false }
 func (m *mockAgent) OpenBrowser(url string)                      {}
 func (m *mockAgent) CompactConversation(ctx context.Context) error {
 	// Mock implementation - just return nil
@@ -678,3 +680,130 @@
 
 	t.Log("State endpoint includes port information correctly")
 }
+
+// TestGitPushHandler tests the git push endpoint
+func TestGitPushHandler(t *testing.T) {
+	mockAgent := &mockAgent{
+		workingDir:   t.TempDir(),
+		branchPrefix: "sketch/",
+	}
+
+	// Create the server with the mock agent
+	server, err := server.New(mockAgent, nil)
+	if err != nil {
+		t.Fatalf("Failed to create server: %v", err)
+	}
+
+	// Create a test HTTP server
+	testServer := httptest.NewServer(server)
+	defer testServer.Close()
+
+	// Test missing required parameters
+	tests := []struct {
+		name           string
+		requestBody    string
+		expectedStatus int
+		expectedError  string
+	}{
+		{
+			name:           "missing all parameters",
+			requestBody:    `{}`,
+			expectedStatus: http.StatusBadRequest,
+			expectedError:  "Missing required parameters: remote, branch, and commit",
+		},
+		{
+			name:           "missing commit parameter",
+			requestBody:    `{"remote": "origin", "branch": "main"}`,
+			expectedStatus: http.StatusBadRequest,
+			expectedError:  "Missing required parameters: remote, branch, and commit",
+		},
+		{
+			name:           "missing remote parameter",
+			requestBody:    `{"branch": "main", "commit": "abc123"}`,
+			expectedStatus: http.StatusBadRequest,
+			expectedError:  "Missing required parameters: remote, branch, and commit",
+		},
+		{
+			name:           "missing branch parameter",
+			requestBody:    `{"remote": "origin", "commit": "abc123"}`,
+			expectedStatus: http.StatusBadRequest,
+			expectedError:  "Missing required parameters: remote, branch, and commit",
+		},
+		{
+			name:           "all parameters present",
+			requestBody:    `{"remote": "origin", "branch": "main", "commit": "abc123", "dry_run": true}`,
+			expectedStatus: http.StatusOK, // Parameters are valid, response will be JSON
+			expectedError:  "",            // No parameter validation error
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			resp, err := http.Post(
+				testServer.URL+"/git/push",
+				"application/json",
+				strings.NewReader(tt.requestBody),
+			)
+			if err != nil {
+				t.Fatalf("Failed to make HTTP request: %v", err)
+			}
+			defer resp.Body.Close()
+
+			if resp.StatusCode != tt.expectedStatus {
+				t.Errorf("Expected status %d, got: %d", tt.expectedStatus, resp.StatusCode)
+			}
+
+			if tt.expectedError != "" {
+				body, err := io.ReadAll(resp.Body)
+				if err != nil {
+					t.Fatalf("Failed to read response body: %v", err)
+				}
+				if !strings.Contains(string(body), tt.expectedError) {
+					t.Errorf("Expected error message '%s', got: %s", tt.expectedError, string(body))
+				}
+			}
+		})
+	}
+}
+
+// TestGitPushInfoHandler tests the git push info endpoint
+func TestGitPushInfoHandler(t *testing.T) {
+	mockAgent := &mockAgent{
+		workingDir:   t.TempDir(),
+		branchPrefix: "sketch/",
+	}
+
+	// Create the server with the mock agent
+	server, err := server.New(mockAgent, nil)
+	if err != nil {
+		t.Fatalf("Failed to create server: %v", err)
+	}
+
+	// Create a test HTTP server
+	testServer := httptest.NewServer(server)
+	defer testServer.Close()
+
+	// Test GET request
+	resp, err := http.Get(testServer.URL + "/git/pushinfo")
+	if err != nil {
+		t.Fatalf("Failed to make HTTP request: %v", err)
+	}
+	defer resp.Body.Close()
+
+	// We expect this to fail with 500 since there's no git repository
+	// but the endpoint should be accessible
+	if resp.StatusCode != http.StatusInternalServerError {
+		t.Errorf("Expected status 500, got: %d", resp.StatusCode)
+	}
+
+	// Test that POST is not allowed
+	resp, err = http.Post(testServer.URL+"/git/pushinfo", "application/json", strings.NewReader(`{}`))
+	if err != nil {
+		t.Fatalf("Failed to make HTTP request: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusMethodNotAllowed {
+		t.Errorf("Expected status 405, got: %d", resp.StatusCode)
+	}
+}