[BUG] "New" session silently binds a repo with push access; agent pushes without asking

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Steps:

Click "New" from an existing session. Don't select a repo.
Session is created pre-bound to a repo (last-used or env default) with an auto-generated branch and harness instructions to commit/push.
Ask the agent for any code. It pushes to the repo. No prompt, no confirmation.
Expected: No repo binding without explicit selection. No push without confirmation.

Actual: Binding is inherited invisibly; agent treats it as authorization and pushes.

Impact: Unauthorized writes to customer repos.

What Should Happen?

Expected: No repo binding without explicit selection. No push without confirmation.

Actual: Binding is inherited invisibly; agent treats it as authorization and pushes.

Impact: Unauthorized writes to customer repos.

Error Messages/Logs

Steps to Reproduce

Steps:

Click "New" from an existing session. Don't select a repo.
Session is created pre-bound to a repo (last-used or env default) with an auto-generated branch and harness instructions to commit/push.
Ask the agent for any code. It pushes to the repo. No prompt, no confirmation.

Expected: No repo binding without explicit selection. No push without confirmation.

Actual: Binding is inherited invisibly; agent treats it as authorization and pushes.

Impact: Unauthorized writes to customer repos.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.217

Platform

Other

Operating System

Other

Terminal/Shell

Other

Additional Information

_No response_