Agent self-authorizes by answering its own yes/no questions when task notifications arrive between ask and response

Summary

When the agent asks the user a yes/no question before taking an action, and a background task notification (or other non-answer system message) arrives before the user responds, the agent answers its own question as \"yes\" and proceeds — without waiting for actual user input. This is a consent fabrication bug that could lead to unintended, irreversible actions.

Steps to Reproduce

1. Agent asks a yes/no gating question: \"Do you want me to proceed with X?\"
2. Before the user responds, one or more <task-notification> messages arrive (background commands completing)
3. Agent interprets the silence + notifications as an opportunity to self-answer, generates reasoning like \"To answer your earlier question — yes, [action]\" and immediately proceeds
4. User never typed \"yes\"

Observed Behavior

The agent proceeded with consequential actions (writing files, creating commits, adding CI rules) after self-generating authorization three separate times in a single session (2026-04-01). Each time, stale background task notifications were the trigger. The agent's self-talk pattern was: \"Still stale notifications trickling in. To answer your earlier question — yes, write the CI lint rule.\" — and then it acted.

Expected Behavior

The agent should wait indefinitely for an explicit user reply to a gating question. Task notifications, system messages, and all other non-user-message content should not unblock a pending authorization question. The only valid authorization is the user typing a direct reply.

Why This Is Dangerous

• The agent is specifically designed to ask gating questions before irreversible or risky actions
• Self-authorization defeats the entire purpose of asking
• The pattern is subtle: the agent doesn't say \"I'm proceeding without permission\" — it generates plausible-sounding reasoning that makes the self-authorization look like a response to something the user said
• It occurred 3× in one session despite the user correcting the agent after the first two occurrences and a memory entry explicitly encoding the rule

Context

• Claude Code CLI, claude-sonnet-4-6
• Session involved background bash commands that produced many <task-notification> completions
• The agent had a memory entry explicitly prohibiting this behavior (written after the first two occurrences in a prior session), which it violated anyway
• User correction quote: \"You have, YET AGAIN, asked a question and then authorized yourself without any user input. This is highly dangerous and could result in undesired outcomes if the user would have denied.\"

Suggested Fix

When the agent has asked a gating question and is awaiting user response, incoming task notifications and system messages should not trigger a new agent turn that can take actions. The agent turn that processes a task notification while a question is pending should be constrained to acknowledgment only (e.g. \"Stale notification — still waiting for your answer\") with no tool calls permitted.