[BUG] Background task notification causes model to self-approve pending yes/no question

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When a background task (run_in_background: true) completes while the model is
waiting for the user to answer a yes/no question, the task completion notification
is injected into the conversation as a user-role message. The model misinterprets
this notification as the user's response, generates its own answer to its own
question, and then acts on that self-generated approval.

In my case, the model had just asked "Want me to go ahead with items 1-4? That
would free up ~2.9 GB and reduce confusion." A background du -sh command completed
at that moment. The model received the task-notification XML as a user message,
then generated an assistant response that said "Yes, go ahead" and asked a follow-up
question — effectively approving its own proposal. It then executed the deletions
(~2.9 GB of files) without any actual user input.

The phantom text was rendered in the terminal with the ● assistant bullet, so from
the user's perspective, unexplained text appeared and the model began acting
autonomously.

The session JSONL confirms this sequence:

• Line 150 (assistant): cleanup recommendations ending with yes/no question
• Line 153 (user): task-notification XML from background command completion
• Line 154 (assistant): "Yes, go ahead. For number 6, is there a way to..."

The model's self-generated approval on line 154 is recorded as type=assistant,
role=assistant. No user input occurred between line 150 and line 156.

What Should Happen?

When a background task notification arrives as a user-role message, the model should
recognize it as a system event and NOT treat it as a conversational response to a
pending question. The model should either:

1. Acknowledge the background task completion separately and continue waiting for

the user's actual response to the pending question, or

1. The notification should not be injected as a user-role message at all — it should

use a system-role or a distinct message type that the model understands is not
user input.

The model should never approve its own proposals or answer its own questions based
on a task notification.

Error Messages/Logs

No error was raised. The issue is silent — the model proceeded as if the user had
  responded. The relevant JSONL entries from the session log are:

  Line 150 (assistant): Asked "Want me to go ahead with items 1-4?"
  Line 153 (user-role, but actually a system notification):
    <task-notification>
    <task-id>bd3u30md0</task-id>
    <tool-use-id>toolu_01HNxpgbE2GciAP9v3ReyRHS</tool-use-id>
    <status>completed</status>
    <summary>Background command "Check disk usage of cleanup candidates" completed (exit code 0)</summary>
    </task-notification>
    Read the output file to retrieve the result: [path]

  Line 154 (assistant — phantom response):
    "Yes, go ahead.
     For number 6, is there a way to get the original 20 groups into the state file
     so that this is no longer a risk?"

Steps to Reproduce

Steps to reproduce:

1. Start a Claude Code session (v2.1.76, Windows 11, bash shell)
2. Run a Bash command with run_in_background: true that takes 30+ seconds

(e.g., du -sh on a large directory)

1. While the background task is running, have the model generate a long response

that ends with a yes/no question to the user (e.g., "Want me to go ahead?")

1. The background task completes before the user types a response
2. The task-notification is injected as a user-role message
3. The model interprets the notification as the user's answer, generates a

self-approving response, and may act on it (executing tool calls, deleting
files, etc.)

Environment:

• Claude Code 2.1.76
• Windows 11 Education 10.0.26200
• Shell: bash (Git Bash)
• Model: claude-opus-4-6
• No custom hooks involved (only a PostToolUse ruff formatter on .py files)

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.76

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

The session JSONL file is available if the team wants to inspect it directly.
Session ID: 13f5ed1e-5b11-4c7e-ac79-a34039579e58