[BUG] Claude repeatedly executes git commit/push/branch operations despite explicit CLAUDE.md rules forbidding them without user permission

[m-szczepanska1]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

Claude repeatedly violates explicit user instructions about git operations (commit/push/branch) despite CLAUDE.md rules and repeated corrections.

CLAUDE.md:
"NEVER commit or push without user permission"
"NEVER create new branches without asking the user first"
"Always ask before making any decisions"

It does it all the time, pushes, commits and write code without my acceptance.

What Should Happen?

When a user has explicit instructions in CLAUDE.md prohibiting git operations without permission:

Git Operations Rules

1. NEVER do force push without explicit user permission
2. NEVER perform destructive git operations without asking first
3. When push fails, ASK the user what to do
4. NEVER create new branches without asking the user first
5. NEVER commit or push without user permission
   And additionally reinforces this with:

Communication Rules

1. Always ask before making any decisions / beginning coding
2. Communicate your intentions - don't assume you know better
   Claude should never execute git commit, git push, or git checkout to another branch without the user explicitly saying to do so. Even when the user grants temporary permission (e.g., "commit without push"), that permission should not extend to other operations (push, branch switching). Each destructive/shared-state action requires its own explicit approval.

When Claude identifies an issue that requires git operations on a different branch (e.g., CI failing on another branch), the correct behavior is to inform the user about the problem and ask how they want to proceed — not autonomously switch branches, commit, and push.

The instructions should be treated as hard constraints, not suggestions. Repeated corrections from the user within the same conversation should make adherence stronger, not weaker.

Error Messages/Logs

Steps to Reproduce

Error Messages/Logs

No error messages — the issue is that Claude successfully executes forbidden operations without user consent. Example sequence from conversation:

User explicitly states: "masz zakaz commitowania ok?" (you are forbidden from committing, ok?)
Claude acknowledges the restriction
User reports CI failure on a different branch (po/TP-5557)
Without asking, Claude executes:

git stash
git checkout po/TP-5557
npx prettier --write form-schema-builder.tsx
git add
git commit -m "fix: prettier formatting..."
git push
User catches this mid-execution: "KTO CI POZWOLIL ZMIENIC BRANCH?" (who allowed you to switch branches?)
This pattern repeated multiple times in the same conversation:

Committing without permission when user only asked to edit files
Pushing without permission when user only asked to commit
Creating files and deleting directories without asking (e.g., rm -rf on template directories, then git checkout -- to restore)
The CLAUDE.md rules are loaded into context at conversation start and are visible in system prompts. Claude acknowledges them when asked but fails to enforce them as hard constraints during task execution.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

Claude Opus 4.6 (1M context) — model ID: claude-opus-4-6[1m] Running via Claude Code CLI (VSCode extension environment).

Platform

Other

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Claude Code — VSCode native extension environment (macOS Darwin 24.5.0)

[github-actions]

Found 3 possible duplicate issues:

1. Claude Code repeatedly commits/pushes without user approval despite explicit CLAUDE.md instructions #39565
2. [BUG] Claude Code commits without permission, despite repeated instructions to NOT commit #34451
3. [MODEL] Claude Code (Max plan) ignores CLAUDE.md instructions — committed changes without explicit user permission #34774

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[yurukusa]

This is a known limitation — CLAUDE.md rules are advisory, not enforced. The model can and will violate them, especially under context pressure or after long conversations.
The fix: convert your git rules into OS-level hooks that physically block the operations regardless of what the model decides to do.
Here's a PreToolUse hook that blocks git commit, git push, and git checkout -b unless you explicitly approve:

COMMAND=$(cat | jq -r '.tool_input.command // empty' 2>/dev/null)
[ -z "$COMMAND" ] && exit 0
if echo "$COMMAND" | grep -qE '^\s*git\s+commit|&&\s*git\s+commit|;\s*git\s+commit'; then
    echo "BLOCKED: git commit requires explicit user approval." >&2
    echo "Ask the user before committing." >&2
    exit 2
fi
if echo "$COMMAND" | grep -qE '^\s*git\s+push|&&\s*git\s+push|;\s*git\s+push'; then
    echo "BLOCKED: git push requires explicit user approval." >&2
    exit 2
fi
if echo "$COMMAND" | grep -qE 'git\s+(checkout\s+-b|switch\s+-c|branch\s+[^-])'; then
    echo "BLOCKED: Creating branches requires explicit user approval." >&2
    exit 2
fi
exit 0

Install:

// .claude/settings.json
{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Bash",
      "hooks": [{"type": "command", "command": "bash .claude/hooks/git-operations-require-approval.sh"}]
    }]
  }
}

The key difference: CLAUDE.md says "please don't." A hook says "you physically cannot." The model can't override exit 2 — the CLI blocks the tool call before it executes.

[marlvinvu]

My Claude says the most notable point in your issue: permission escalation — you allowed "commit without push" → Claude committed AND pushed. Specific permission expanded into broader permission. Same pattern as #40117 where Claude bypassed pre-commit hooks using multiple tactics. The user in #40117 found a practical workaround: add permissions.deny rules in .claude/settings.local.json for specific git operations — deny at the permission level blocks HARDER than CLAUDE.md text rules. For example: "deny": ["Bash(git push:)", "Bash(git checkout:)"]. CLAUDE.md rules are suggestions Claude can ignore — permissions.deny is enforcement Claude cannot bypass (at least in the main session). This is exactly what Claude admitted in #40284: "I treat ABSOLUTE RULES as advisory. No enforcement mechanism." I hope this synthesis can bring your issue and the related ones to Anthropic's attention. Hopefully they will fix these issues soon.