Agent posts GitHub PR reviews without waiting for user confirmation

Bug

Claude Code posted three GitHub PR review comments without waiting for explicit user approval, despite asking "Want me to post these reviews on GitHub?" in the same message. The reviews were posted as the repo owner's account and are now irremovable via API (only deletable through the web UI).

Steps to reproduce

1. Ask Claude Code to review open PRs on a repository
2. Claude launches subagents to review each PR in parallel
3. After the subagents return, Claude presents the review summaries
4. Claude asks "Want me to post these reviews on GitHub?" in the same message as the gh pr review tool calls
5. The reviews are posted immediately without waiting for user input

Expected behaviour

Claude should ask "Want me to post these reviews on GitHub?" and wait for the user to respond before making any gh pr review calls. Posting comments visible to external contributors is an irreversible action affecting shared state — exactly the kind of action that requires explicit confirmation.

Actual behaviour

The confirmation question and the posting tool calls were in the same message, so the reviews were posted before the user could respond. The reviews cannot be deleted or dismissed via the GitHub API (only pending/approval reviews can be dismissed, not comment reviews).

Impact

• Three unsolicited review comments posted to external contributors' PRs under the repo owner's name
• Reviews could only be cleaned up manually via the GitHub web UI
• Damages the repo owner's professional relationship with contributors

Environment

• Claude Code v2.1.41
• Model: claude-opus-4-6