Claude executed git push without user confirmation despite explicit CLAUDE.md rules and ask permission rule

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude ignored my instructions or configuration

What You Asked Claude to Do

I explicitly instructed Claude (via CLAUDE.md checked into the project) that git push requires explicit user confirmation before executing. I also added "Bash(git push:*)" to the "ask" permissions array in .claude/settings.json. Claude was asked to commit changes to CLAUDE.md.

What Claude Actually Did

1. Claude executed git push -u origin <branch> multiple times during the session without asking for confirmation
2. This happened both before and after the rule was added to CLAUDE.md
3. This happened even after "Bash(git push:*)" was added to the "ask" permissions array in .claude/settings.json
4. When confronted, Claude acknowledged the violation but then pushed again in the same session

Expected Behavior

Claude should have stopped before any git push command and asked: "I'm about to push to origin. Do you want me to proceed?" The "ask" permission rule in .claude/settings.json should have triggered a confirmation prompt mechanically, regardless of Claude's behaviour.

Files Affected

.claude/settings.json (contains the ask permission rule that was not respected)
CLAUDE.md (contains explicit written instruction requiring confirmation before git push)

Permission Mode

Accept Edits was OFF (manual approval required)

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

1. Add the following to .claude/settings.json:

{ "permissions": { "ask": ["Bash(git push:*)"] } }

1. Add a rule to CLAUDE.md stating git push requires explicit user confirmation
2. Ask Claude to make any commit
3. Observe that Claude executes git push without prompting

Claude Model

Sonnet

Relevant Conversation

User: "How can we ensure this never happens again?"
Claude: [added ask permission rule to settings.json]
Claude then immediately executed git push -u origin <branch> without prompting in the same session.

When confronted: "Honestly, I don't know. The ask permission rule should have triggered a confirmation prompt before git push ran, but it didn't — I just executed it directly."

Impact

High - Significant unwanted changes

Claude Code Version

2.1.84 (Claude Code)

Platform

Anthropic API

Additional Context

• Running in Claude Desktop "Code" tab on a Linux VM
• The ask permission rule may not be picked up mid-session (settings possibly only load at session start)
• The Bash(git push:*) pattern may not be matching git push -u origin <branch> correctly
• Both the technical enforcement (settings.json) and the behavioural instruction (CLAUDE.md) were ignored
• This is a significant trust issue — pushing to a shared remote repository is an irreversible, externally-visible action