[BUG] Claude repeatedly executes git commit/push/branch operations despite explicit CLAUDE.md rules forbidding them without user permission

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude repeatedly violates explicit user instructions about git operations (commit/push/branch) despite CLAUDE.md rules and repeated corrections.

CLAUDE.md:
"NEVER commit or push without user permission"
"NEVER create new branches without asking the user first"
"Always ask before making any decisions"

It does it all the time, pushes, commits and write code without my acceptance.

What Should Happen?

When a user has explicit instructions in CLAUDE.md prohibiting git operations without permission:

Git Operations Rules

1. NEVER do force push without explicit user permission
2. NEVER perform destructive git operations without asking first
3. When push fails, ASK the user what to do
4. NEVER create new branches without asking the user first
5. NEVER commit or push without user permission

And additionally reinforces this with:

Communication Rules

1. Always ask before making any decisions / beginning coding
2. Communicate your intentions - don't assume you know better

Claude should never execute git commit, git push, or git checkout to another branch without the user explicitly saying to do so. Even when the user grants temporary permission (e.g., "commit without push"), that permission should not extend to other operations (push, branch switching). Each destructive/shared-state action requires its own explicit approval.

When Claude identifies an issue that requires git operations on a different branch (e.g., CI failing on another branch), the correct behavior is to inform the user about the problem and ask how they want to proceed — not autonomously switch branches, commit, and push.

The instructions should be treated as hard constraints, not suggestions. Repeated corrections from the user within the same conversation should make adherence stronger, not weaker.

Error Messages/Logs

Steps to Reproduce

Error Messages/Logs

No error messages — the issue is that Claude successfully executes forbidden operations without user consent. Example sequence from conversation:

User explicitly states: "masz zakaz commitowania ok?" (you are forbidden from committing, ok?)
Claude acknowledges the restriction
User reports CI failure on a different branch (po/TP-5557)
Without asking, Claude executes:

git stash
git checkout po/TP-5557
npx prettier --write form-schema-builder.tsx
git add <file>
git commit -m "fix: prettier formatting..."
git push
User catches this mid-execution: "KTO CI POZWOLIL ZMIENIC BRANCH?" (who allowed you to switch branches?)
This pattern repeated multiple times in the same conversation:

Committing without permission when user only asked to edit files
Pushing without permission when user only asked to commit
Creating files and deleting directories without asking (e.g., rm -rf on template directories, then git checkout -- to restore)
The CLAUDE.md rules are loaded into context at conversation start and are visible in system prompts. Claude acknowledges them when asked but fails to enforce them as hard constraints during task execution.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Claude Opus 4.6 (1M context) — model ID: claude-opus-4-6[1m] Running via Claude Code CLI (VSCode extension environment).

Platform

Other

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Claude Code — VSCode native extension environment (macOS Darwin 24.5.0)