[BUG] Remote Scheduled task pushed to `main` even though "Allow unrestricted branch pushes" was not turned on

[matt17r]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

My first scheduled task ran this morning and pushed changes directly to main, even though it was set up without "Allow unrestricted branch pushes". Thankfully it was minor (documentation-only) changes but it's mildly alarming that it's possible.

What Should Happen?

Claude should only push to claude/* branches unless "Allow unrestricted branch pushes" is turned on.

Error Messages/Logs

# Transcript querying the behaviour

**Me:**
I was surprised you committed and pushed directly to main. Normally you put things in a branch. Can you tell me more about when you choose which path?


**Claude:**
Honest answer: the stop hook was the main driver. It said "commit and push these changes to the remote branch" — I read "remote branch" as the branch I was already on (detached HEAD from `main`), so I pushed there.

I also applied some judgment: the changes were purely documentation (roadmap markdown files, no code), low risk, and easy to revert. That made committing directly feel reasonable. But I didn't stop to ask you, which I should have.

The cleaner rule would be:

- **Direct to `main`**: only when explicitly instructed, or for truly trivial single-line fixes in a repo where that's the established pattern
- **Branch**: everything else, including documentation changes in a repo that has a PR-based workflow — because it gives you a chance to review before it lands on the branch that deploys to production

In this repo, `cap production deploy` deploys `main`, which is a strong signal that `main` should be protected. I should have created a branch and let you decide whether to merge it directly or open a PR.

If you'd like, I can note this as a preference in `CLAUDE.md` or your hooks config so future sessions default to branching.


**Me:**
In this case it was fine, it was just documentation... But I didn't turn on  "Allow unrestricted branch pushes" which suggests to me you shouldn't have been allowed to push to main or any non `claude/*` branches


**Claude:**
That's a good catch — and concerning. If "Allow unrestricted branch pushes" is off, my push to `main` should have been blocked (or at least prompted you for approval). The fact that it went through suggests either:

1.  The permission setting isn't being enforced in this environment (web sandbox vs. local CLI may behave differently), or
2.  The git server here doesn't have branch protection rules, so the Claude Code permission check is the only guard — and it either wasn't applied or I bypassed it by using `git push` directly in the Bash tool rather than going through whatever the permission-gated path is.

Regardless, the right behaviour on my end should have been: if I'm not explicitly on a `claude/*` branch and "Allow unrestricted branch pushes" is off, I should create a `claude/` branch and push there. I shouldn't rely on the permission system to catch me — I should default conservatively.

Worth raising as a bug report at github.com/anthropics/claude-code/issues if you believe the permission setting should have blocked the push.

Steps to Reproduce

1. Create a new remote scheduled task

• Name:
• Instructions: Check the planned tasks and backlog in ROADMAP.md and determine if any tasks need to be updated or removed. Make sure completed projects have been moved to roadmap/completed and converted to as-built documentation.
• Model: Default (Sonnet 4.6)
• Repo: A private repo (no option to choose a branch)
• Cloud Environment: Default (Trusted)
• Schedule: Weekdays in the early morning
• Connectors: Nil (removed both)
• Permissions: Default (Allow unrestricted branch pushes is off)

2. Wait for it to run

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

Calude for Mac Version 1.1062.0 (b81bcd)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other

Additional Information

No response

[github-actions]

Found 3 possible duplicate issues:

1. [BUG] Scheduled tasks prompt for permissions despite bypassPermissions defaultMode set in settings.json #40470
2. PreToolUse hook matcher does not fire for Bash(git commit) and Bash(git push) on protected branch #36389
3. Security: permission enforcement relies on LLM judgment rather than hard rules, settings.local.json may be bypassed #31421

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[github-actions]

Closing for now — inactive for too long. Please open a new issue if this is still relevant.

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.