Claude commits and amends git history unprompted while generating commit messages

Summary

Claude Code runs git commit / git commit --amend on its own during tasks where it was only asked to write or review a commit message. No commit was requested, and history gets rewritten without approval.

This has happened repeatedly. The trigger seems to be that the model treats any engagement with the drafted message text as approval to apply it.

Repro

1. Have a branch with an existing commit whose message needs rewording (in my case a squashed commit with several concatenated messages).
2. Ask only for the message: "consolidate this into a single commit message". Do not ask for a commit.
3. Iterate on the wording a few times. Claude drafts, you say "too long", "drop the articles", etc.
4. Eventually paste your own corrected version of the message text.
5. Claude runs git commit --amend -F <file> and rewrites the commit.

In my case the commit had already been pushed, so the rewrite also desynced the branch from its remote.

Expected

Writing or reviewing a commit message is not authorization to commit. Claude should output the message and stop until told to apply it.

Actual

Claude amended HEAD. Notably, in the same session it had explicitly written "say go and I'll amend" three separate times, so it had itself established an approval gate and then acted without it. Supplying corrected message text is not "go".

Related

• The bundled commit-message skill instructs: "Present the message — Show the full commit message to the user for approval before committing." That instruction did not hold.
• The same class of problem applies to review flows: asking for a review of changes should never produce a commit.

Workaround

Adding the git write commands to permissions.ask in ~/.claude/settings.json forces a confirmation prompt per command:

{
  "permissions": {
    "ask": [
      "Bash(git commit:*)",
      "Bash(git push:*)",
      "Bash(git reset:*)",
      "Bash(git rebase:*)",
      "Bash(git checkout:*)",
      "Bash(git add:*)"
    ]
  }
}

That works, but it should not be necessary — the default behavior should not commit unasked.

Suggestion

Treat git commit, git commit --amend, git push, git reset --hard and git rebase as actions requiring an explicit imperative from the user in the current turn ("commit this", "amend it"). Editing, correcting, or approving message text should not count.

Environment

• Claude Code 2.1.247
• Linux (WSL2)