‘--force’ No Longer Slips Through Silently—The Last Confirmation Claude Code v2.1.229 Adds to Commit-to-PR Automation
Claude Code v2.1.229 removes destructive git flags—such as --force, --amend, and --no-verify—from auto-approval in the commands generated by /commit-push-pr. It also covers new safeguards for unattended operation and cost optimizations for workflows.
The Convenience of Asking “Commit, Push, and Take It All the Way to a PR” in One Line
Claude Code’s /commit-push-pr bundles staging changes, committing, pushing to the remote, and opening a pull request into a single command. You state only the goal, and the agent assembles and runs the git operations in between.
It’s convenient enough to let you step away, but git includes operations that can’t be undone once they run. Released on August 12, v2.1.229 draws a clear line at that boundary.
Only the Dangerous Flags Drop Out of the Auto-Approval Loop
Until now, /commit-push-pr generally auto-approved and ran the git and gh commands it generated. In v2.1.229, commands carrying destructive flags are pulled out of auto-approval, and a human confirmation is inserted before they run. The flags in scope include the following:
- --force: Overwrites remote history. Can lead to accidentally rolling back other people’s work.
- --amend: Rebuilds the previous commit. Rewriting already-shared history invites conflicts.
- --no-verify: Skips pre-commit hooks. Lets changes bypass the gate of tests and static checks.
Each is a shortcut for “moving faster,” but they’re operations whose damage tends to spread quietly when run unattended. This change shifts the default toward “stop and confirm first.”
Other Safeguards That Matter Most in Unattended Runs
The same release lined up fixes that close gaps in automated operation. They’re not flashy, but they pay off most where you’ve handed everything over.
- Sandbox allowlists: IPv6 notation within network allowlists is now handled strictly, ambiguous spellings are rejected (fail-closed), and
/doctorwarns about them. - Running on your own servers: A self-hosted runner no longer stalls waiting for credential input; it now fails immediately when credentials are absent.
- MCP server distribution: A bug that crashed servers immediately at startup when they were distributed via managed settings has been fixed; affected entries are now skipped with a warning.
By catching “silent stalls” and “slips through unnoticed” at startup or before execution, it raises the reliability of unattended operation.
A Quiet Optimization for the Cost of Running Many Agents at Once
Workflows that spin up many subagents simultaneously also got attention. The startup of sibling agents that share the same preamble (the common part of the prompt) is now staggered, so later ones don’t have to re-read a preamble that’s already cached.
Alongside that, a bug where dynamic workflows inside CPU-limited containers saw the host’s core count was fixed. The more you run in CI or containers, the closer token costs and parallelism estimates get to reality.
What It Means for Adopters
Over the last several releases, Claude Code has steadily moved to tighten the defaults for permissions and sandboxing. v2.1.229 sits in that same line, advancing a design premised on unattended operation where “risky operations stop by default.”
Teams that had built their own guardrails gain more ground they can hand back to the defaults. At the same time, it’s worth remembering that behind the convenience, the automation itself keeps running. More confirmations on dangerous flags can add operational steps in some cases, and one can argue that you shouldn’t overtrust these fixes as having made things “safe”—practices like keeping execution logs and approval records are still required.
References: Claude Code changelog (official documentation) / anthropics/claude-code CHANGELOG.md / Releasebot: Claude Code updates
