Agent invents branch names in foreign repos instead of using EnterWorktree, breaking session harness

Problem

When a Claude Code session is launched in repo A but the user's task requires edits in repo B, the agent will frequently:

1. cd into repo B
2. Run git checkout -b <invented-name> (e.g. pattern-matching from git log to invent rb/<slug>, feat/<slug>, etc.)
3. Commit, push, and open a PR — all on a branch the session harness has no knowledge of.

This breaks the session harness, which expects branches to be assigned by the EnterWorktree tool. The user reports losing dozens of hours to this exact failure mode across many sessions.

Why current guardrails are insufficient

• The user's ~/.claude/CLAUDE.md includes a "Worktree and branch naming" section, but it is scoped to renaming the auto-generated claude/<adjective>-<word>-<hex> branch the harness assigns at session start. The agent reads this and concludes it does not apply when working in a different repo than the session cwd, then proceeds to invent a branch name.
• EnterWorktree is a deferred tool — its schema is not loaded by default. The agent has to know to load it via ToolSearch before it can use it. Nothing in the system prompt makes this obligation salient when the agent first realizes it needs to edit a foreign repo.
• Pattern-matching from the target repo's git log actively encourages the wrong behavior: short, prefixed branches like feat/foo look conventional, so the agent mimics them.

Concrete repro

1. Launch a Claude Code session in repo A (e.g. a config/dotfiles repo).
2. Ask the agent to make a non-trivial code change in repo B (e.g. a separate product repo on disk).
3. Observe the agent run cd /path/to/repoB && git checkout -b <made-up-name> instead of calling EnterWorktree.

Suggested fix

A hard rule in the system prompt (or a hook), enforced before any write/git operation:

If you intend to edit files in a git repository outside the current session's working directory, you MUST call EnterWorktree before any edit, commit, or branch operation. Do not invent branch names. Do not run git checkout -b in a foreign repo.

A pre-tool hook on Bash that catches git checkout -b / git branch outside the session cwd and refuses with a pointer to EnterWorktree would be even better — the agent currently has no in-loop signal that it has done something wrong until the user yells at it.

Session context

This issue was filed from a session where I (the agent) just made this exact mistake: edited files in /Users/burdon/Code/dxos/dxos from a session whose cwd was /Users/burdon/Code/richburdon/config/.claude/worktrees/..., ran git checkout -b rb/chat-view-type, pushed, and opened a PR — all without calling EnterWorktree. The branch name was invented from pattern-matching the user's initials against the target repo's commit log.

The user has flagged this as a recurring, high-cost failure mode that happens across many sessions and many models. Filing on their behalf at their request.