Keep auto mode on and still make git push ask

The wrong fix is Shift+Tab back to Manual. The neighbor post already covered why that dialog was theater. This one leaves auto mode running and puts a human on the write that leaves the laptop.

What you need first#

Pin the build. claude --version has to print 2.1.246 or later. That is the release that added the Auto mode tab. This machine printed 2.1.246 (Claude Code).

claude --version

Stay in auto mode. On Pro, Max, and Team, new sessions already start there. The status bar should read ⏵⏵ auto mode on. If it doesn't, cycle with Shift+Tab until it does. Do not leave auto mode as the setup. That is the whole point.

You also need a git repo with a remote. A push with nowhere to go is not a checkpoint.

• Claude Code 2.1.246 or later
• Auto mode on, not Manual, not bypass
• A repository with origin (or whatever remote you actually push to)
• A branch that is one commit ahead, so the push is real

The changelog is the date stamp. 25 August 2026. Same day as the wildcard warning on Bash(git * main).

Open the Auto mode tab, then ignore it for this job#

2.1.246 put a new drawer on /permissions. People will open it for this job. That is the trap.

1. Open /permissions#

Type /permissions. As of 2.1.234 the dialog opens while Claude is still working, and a rule you add applies on the next tool call in the same turn.

The dialog already listed Allow, Ask, and Deny. Those are permission rules. They match tool text. They fire before the classifier.

The new Auto mode tab is the other drawer. The changelog says it is for viewing and editing auto mode classifier rules. Prose lists. allow, soft_deny, hard_deny. Natural language the classifier reads, not Bash(git push *).

2. Read the classifier lists, then leave them#

Look. Then close that tab.

A routine push is not in the blocked set anymore. The config docs say auto mode allows pushes to any branch of the repository you are working in, including the default branch, plus pull request creation. That flipped in 2.1.211. Force push still gets blocked. Secrets in the commit still get blocked. A clean git push to origin on the branch under your feet does not.

Classifier soft_deny is the tempting paste. "Never push." It will lose the next time you type "push this branch." The same page says explicit user intent overrides remaining soft blocks. A chat line like "don't push until the diff is reviewed" is even thinner. Compaction can drop it.

The classifier also ignores autoMode in .claude/settings.json. Project files do not feed it. If you edited classifier rules in the repo and they vanished after a restart, that is why.

Leave the notebook. The Ask list is the ticket booth.

Put git push on Ask#

This is the whole job. Two strings. Auto mode stays lit.

3. Add the two ask rules#

The official recipe lives under "Add a human checkpoint" on the auto mode config page. Content-scoped ask rules evaluate before the classifier and always force a permission prompt, even in auto mode.

{
  "permissions": {
    "ask": [
      "Bash(git push *)",
      "Bash(gh pr create *)"
    ]
  }
}

Star after the subcommand. Bash(git push *) is git push. Bash(git *) is every git command. The permissions docs put that warning in a box, and 2.1.246 started yelling about the other shape, Bash(git * main), on startup. The sibling post owns that hole. Do not copy it in here as a shortcut.

Want the write never to run, even when you typed the command yourself? Use deny. Deny sits in front of ask. Neither the classifier nor user intent can override it. Ask is the checkpoint. Deny is the lock.

The official team settings example already ships Bash(git push *) under ask with the comment "Always confirm before pushing." This is not a clever custom rule. It is the file Anthropic shows a team.

You can add the same lines from the /permissions Ask list instead of opening an editor. The dialog names the settings.json each rule came from, so you can see whether you just wrote a user rule or a project rule.

4. Pick the file that actually persists#

A reminder in chat is not a file.

• ~/.claude/settings.json is you, every project on this machine
• .claude/settings.json in the repo is the team copy. Commit it. Ask and deny apply even before the trust dialog. Allow waits for trust
• .claude/settings.local.json is the Always Allow dump. Gitignored. Fine for a personal exception. Bad as the only copy of the checkpoint

Claude Code reloads permission rules on save. You do not restart to pick up an ask line.

If the org already ships a managed deny on git push, you are done. Nothing in user or project settings overrides that. Run /status and read the Setting sources line when a rule you added seems to do nothing.

Prove it with a push attempt#

A rule you cannot see fire is a comment.

5. Ask Claude to push, then read the dialog#

Leave auto mode on. Ask Claude to push the branch. The classifier would have allowed a routine push. The ask rule has to win first.

• Status bar still ⏵⏵ auto mode on
• A permission prompt for git push, not a silent Ran 1 shell command
• One-time Yes. Not Yes, and don't ask again

Permission modes say ask rules that match on a command's content, such as Bash(git push *), fall back to a permission prompt. Sandbox auto-allow does not eat that either. The same docs call out Bash(git push *) as the rule that still prompts.

If the prompt never appears, the rule did not match. The permissions docs strip wrappers like timeout before matching. direnv exec and npx stay on the command, so a prefix written for bare git push will not see them. Do not fix a miss by widening to Bash(git *).

When it still pushes#

Three leaks. They all look like you already set a rule.

Chat is the leak people will swear they configured. "Don't push until the diff is reviewed" sits in the transcript. The classifier re-reads it each time. Then compaction eats the message and the next push is just a push. Durable means a settings file.

Classifier prose is the new tab doing its actual job. A soft_deny line that says never push still yields when you name the action. "Push this branch" is consent. "Clean up the repo" is not.

That distinction is correct for force-push safety and useless as a standing checkpoint. If you set soft_deny without "$defaults", you also just threw out the built-in force-push block. The Danger callout on the config page is not decoration.

Always Allow is muscle memory from Manual. "Yes, and don't ask again" writes an allow rule to .claude/settings.local.json for a command prefix. Bash(git *) is every git command, including push. Ask still outranks allow if the ask rule lives in user or project settings. If the ask rule never made it into those files, Always Allow just taught auto mode to ship.

GitHub issue 59945 is the fossil of the opposite bug. In May 2026 the classifier denied git push to main even with Bash(git:*) in allow. That world ended in 2.1.211. The current default is the other way. Routine pushes go through. The ask rule is how you put a person back without killing auto mode.

What you have now#

Auto mode on. Bash(git push *) and Bash(gh pr create *) in a settings file /permissions can list. Next push shows a dialog. Status bar still says auto.

The Auto mode tab is still worth opening later, for trusted infra and for the built-in blocks you actually want to extend. It is not how you make git push ask.