Hey, thanks for the detailed report. Git commit or push from Ask mode is a really unpleasant surprise.
Here’s how it works right now. Ask mode removes edit apply and MCP tools, but the terminal itself isn’t hard blocked at the tool level. Write protection relies on a read only sandbox, which isn’t always active yet. It depends on whether the OS sandbox is enabled. When the sandbox isn’t active, shell commands in Ask mode, including git add git commit git push, can run with full access. So this isn’t the model bypassing instructions. It’s that the hard block on the terminal in Ask mode isn’t enforced at the tool level yet. This is a known limitation and it should be tightened, but I don’t have a timeline for it right now.
For now, here’s a workaround to guarantee no writes:
- Set Auto Run so every command needs confirmation. Don’t use an allowlist or auto mode that approves itself.
- When you actually need changes, switch to Agent mode with manual approve, instead of asking git to run in Ask mode.
Also, like @Tom_Coustols said above, if you share the Request ID from this chat, it’ll help us look at your exact case. Three dots in the top right of the chat > Copy Request ID.