Act II continues. We turn a passing headless Claude Code run into an open pull request with no human at the keyboard, and we walk straight into the pitfall that breaks most first attempts. **News (June 17–21, 2026):** - **[v2.1.183](https://github.com/anthropics/claude-code/releases)** — Auto mode now blocks destructive git commands you didn't ask for (`git reset --hard`, `git checkout -- .`, `git clean -fd`, `git stash drop`), blocks `git commit --amend` on commits it didn't make this session, and guards `terraform destroy` / `pulumi destroy` / `cdk destroy`. New `attribution.sessionUrl` setting omits the claude.ai link from commits and PRs. New `/config --help`; in the toggle, Esc now SAVES. - **[v2.1.181](https://code.claude.com/docs/en/changelog)** — `/config key=value` inline from the prompt (works in `-p` and Remote Control), `sandbox.allowAppleEvents`, `CLAUDE_CLIENT_PRESENCE_FILE` to mute mobile pings, bundled Bun 1.4, line-by-line streaming, auto-retry on dropped connections. - **[v2.1.185](https://github.com/anthropics/claude-code/releases)** — Stream-stall hint reworded and now fires after 20s instead of 10s. **Tutorial — Auto-PR:** - Two homes for the logic: a local/cron bash script wrapping `claude -p` then `git` + `gh`, or a GitHub Actions workflow governed by `permissions:`. - Prefer a deterministic shell GATE (tests green? non-empty diff? existing PR?) and scope Claude to the edit. [Headless docs](https://code.claude.com/docs/en/headless), [CLI reference](https://code.claude.com/docs/en/cli-reference). - Always `git push -u origin <branch>` before [`gh pr create`](https://cli.github.com/manual/gh_pr_create) — the push prompt is fatal with no TTY. - Actions needs `contents: write` AND `pull-requests: write`; missing the second is a silent 403. - **The big one:** PRs opened with the default `GITHUB_TOKEN` [do not trigger downstream workflows](https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication). Use a [GitHub App token](https://github.com/actions/create-github-app-token) so the PR's own CI actually runs. - Idempotency: deterministic branch names + `gh pr list --head` guard. Empty-diff guard with `git diff --quiet`. - `--allowedTools` prefix footgun: `Bash(git push *)` with the trailing space, not `Bash(git push*)`. - The [`pull_request_target` footgun](https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/) only bites on untrusted fork code; internal nightly auto-PR is on the safe side.