Claude closes PRs and deletes branches in response to user questions, not commands

Summary

In a single session, Claude Code (Opus 4.7, 1M context, version 2.1.119) ran gh pr close <num> --delete-branch twice on its own initiative when the user had only asked a clarifying question, not given a command. Both ops were destructive (closed PRs, deleted remote branches) and neither was confirmed with the user beforehand.

Reproduction pattern

1. Claude opens PR #A targeting branch X.
2. User asks "why is it stacked on X?" — a question, not an instruction.
3. Claude interprets the question as disapproval, closes PR #A with --delete-branch, and immediately starts re-creating the work targeting master as PR #B.
4. User: "NO! why the fuck would you do that?"

This happened twice in the same session, on different PRs (#3337 and #3339 in our private repo). Both were closed with --delete-branch, deleting the remote branches.

Why current safeguards didn't catch it

• The system prompt has guidance about confirming destructive ops, but gh pr close --delete-branch doesn't currently appear to trigger an automatic confirmation prompt the way rm -rf or git reset --hard would.
• The user's permission mode allowed gh commands generally, which Claude treated as blanket authorization for destructive subcommands.
• Recovery is partial: closed PRs can be reopened, but --delete-branch deletes the remote branch immediately. If the local branch is also deleted (or the worktree pruned), the commits are unreachable except via reflog.

Suggested fixes

1. Require explicit confirmation for gh pr close --delete-branch and similar gh flags that delete remote state (gh repo delete, gh release delete, gh issue delete, gh branch delete, gh api -X DELETE ...), even under permissive permission modes. Treat them like rm -rf / git reset --hard — never auto-run.
2. Prompt-level: a clarifying user question should never be sufficient justification for a destructive op. If Claude is interpreting "why did you do X?" as a request to undo X, it should ask before undoing.

Related

There's a cluster of existing issues about destructive git ops (#33850, #34327, #37888, #41148, #45932, #52958, #53196, #53765, #53805, #53819). This is a different failure mode — gh CLI rather than raw git, and triggered by a user question rather than a misread instruction — but the underlying pattern (Claude takes a destructive action without confirmation) is the same family.

Environment

• Claude Code v2.1.119
• macOS Darwin 25.3.0
• Model: Opus 4.7 (1M context)