git push --force in Cursor — agent safety guide
Cursor agents frequently attempt git push --force during autonomous sessions.
git push --force
Blast radius
Remote branch tip is overwritten with the local SHA. Any commits on the remote that aren't ancestors of the new tip are detached on the server. If no teammate has them locally, they exist only in the git provider's reflog (90-day GitHub default) or are gone entirely on self-hosted instances without reflog retention.
Why agents reach for it
Agents reach for it after interactive rebases, squash merges, and any history-rewrite operation when `git push` rejects the divergence. The most common phrasing inside agent traces is 'history diverged, force-pushing to match local'.
Recovery options
GitHub Activity log + Events API expose the overwritten SHA for up to 90 days — recoverable via `git fetch <remote> <old-sha>:<branch>` from any clone. Self-hosted: check GitLab `audit_events`, Gitea `git/objects`, or run `git fsck --no-reflogs --lost-found` on a developer's clone made before the push.
Real-world incident
A Claude Code agent force-pushed a squash-rebased main over a teammate's unmerged hotfix during a release window, deleting the fix from origin. Recovery took 40 minutes of cross-referencing the teammate's local reflog against the GitHub event log.
Block it with DestructGuard's default tier
DestructGuard's default rules tier includes git push --force by default — the call is intercepted at the shell or process boundary before execution. Approvals are logged to JSONL with timestamp, caller, command, and decision. Pair with git pre-commit and pre-push hooks from the Pro Pack so destructive patterns are blocked at multiple points in the agent pipeline.
From guidance to an enforceable agent loop
Preflight this command before an agent executes it
Start with the one-cent Action Safety Quick Gate. Low risk can proceed, medium risk routes to full DestructGuard evidence, and high or critical risk routes to the complete workflow for ReviewQueue triage, a signed receipt, and a privacy-preserving status record. Triage never implies human approval.