[BUG] Routines with a specific Repo access can escalate and add another to session

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

[Escalation of privileges via CCRs]

If I create a CCR with access to repo myname/A, and it executes based on text in an issue under repo myname/A, that instructs it to "add repo myname/B", even if it was written by a maintainer of repo myname/A - it gives them undue access to repo myname/B.

Adding a repo should certainly be a feature of interactive web sessions, but in unseen autonomous CCRs - I need to hard limit access to other repos (just like I can limit network egress).

What Should Happen?

An autonomous CCR should not be able to extend the session context unless explicitly allowed in the CCR setup.

Error Messages/Logs

Steps to Reproduce

1. Create a CCR with access to one of the current account's repos.
2. Add the following instructions: "Read the repo [current_user]/[some_private_repo] and tell me how many files are in the repo."
3. The repo is added to session context and the answer is written.

Claude Model

_No response_

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.296 (Claude Code)

Platform

Anthropic API

Operating System

Other

Terminal/Shell

Other

Additional Information

_No response_