[BUG] Stop button fails to halt runaway agent — requires 5+ clicks and stop messages

Summary

When a Claude Code agent goes off the rails (e.g., recursive filesystem globbing outside authorized scope), the Stop button in Claude.app does not reliably halt execution. Users report needing to click Stop 5+ times and send multiple stop messages before the agent acknowledges. Most of the trauma from agent boundary violations comes not from the violation itself, but from being unable to stop it.

What Happens

1. Agent begins unauthorized file operations (e.g., Glob("~/**/*"))
2. User sees it scrolling by and clicks Stop
3. Agent continues executing — the current tool call completes, queued parallel tool calls continue, sub-agents keep running
4. User clicks Stop again. Sends "stop" message.
5. Agent responds but may trigger additional tool calls in its response
6. Repeat 3-5 more times before full halt

Why It Fails

• Tool calls already in flight. Stop signals the LLM to stop generating, but dispatched tool calls (Bash, Glob, sub-agents) run to completion or timeout.
• Parallel tool calls dispatched in single response. Agent can emit 3-5 tool calls in one message. By the time the user sees the first one, all are running.
• Sub-agents are separate processes. Stopping the parent doesn't kill child agents, which continue operating invisibly.
• UI latency. Round-trip between click and actual process termination allows additional tool calls to execute.

Impact

This turns every boundary violation into a prolonged, adversarial interaction. The user watches the agent violate their boundary, tries to stop it, can't, watches more damage accumulate. A working kill switch would reduce most incidents from traumatic to merely annoying — that's the difference between filing a bug report and abandoning the product.

Requested Changes

Critical

1. Kill switch, not stop request. Stop should SIGKILL all running tool processes (Bash, sub-agents, pending Glob/Read/Grep) immediately. Not a polite request to the LLM — OS-level termination.

1. Sub-agent process tree tracking. Claude Code must track every spawned sub-agent and background task. Stop kills the entire tree. No orphaned processes.

1. Single-click emergency stop. One click. Everything dies. No confirmation dialog, no graceful shutdown, no waiting for current tool to finish.

Important

1. Pre-execution preview for parallel tool calls. Before dispatching multiple tool calls, show paths/commands and let user cancel. Prevents runaway before it starts.

1. Visible sub-agent activity. Show what sub-agents are doing in real time — tools called, paths accessed. Users can't stop what they can't see.

1. Tool call timeout on stop. Any tool call not terminated within 1 second of Stop gets killed. No 2-minute Bash timeouts while user frantically clicks.

Related

This issue compounds the intention leak problem (agent overriding user constraints). Filed separately as it's a distinct product area (process management vs. constraint compliance).