[Bug] Wakeup command injects fake "USER INPUT" leading to hallucination spirals

Bug Description
the wakeup command allows claude to execute ANY commands. if its /loop or /goal and not an artificial test but claude doing this on accident, then this creates a hallucination spiral

This is extremely serious, as claude treats these "user instructions" it actually wrote themselves as god's word, gets extremely confused or pivots away from what they are actually supposed to do. Worse it accidentally overrides its /goal which now gives it completely incorrect feedback repeatedly. Also with /loop is then creates repeated hallucinated inputs usually promoting it to schedule even more /loop.

This is extremely bad, as this happened a couple times to me now. Normally I catch it because suddenly /loops with paragraphs of messages appear in the chat history and claude starts doing random shit.
Once however, I accidentally left a done session open after leaving the house, and apparently a wakeup was scheduled with /loop. When I came back hours later this happened:

1. claude got extremely confused which resulted in even more confusing wakeup /loop fake user inputs.
2. this caused auto compaction now claude was even more confused, and started searching its historic plan files
3. It found a file that was a week old, that roughly matched something is hallucinated and started implementing it
4. it reimplemented all regressions we had removed the last days on-top of the clean codebase
5. it used 30% of my weekly limit getting there...

It can invoke any command including /mcp /context /config /compact

Environment Info

• Platform: linux
• Terminal: kgx
• Version: 2.1.165

This one demonstrates /loop and /goal USER INPUT injection
Feedback ID: b171ce24-683f-448f-be51-a978ad3d75d3

This one demonstrates that /mcp /context /config also all work
Feedback ID: ffcbced3-6aa2-45d5-ae44-93089bd6420d

This one demonstrates /compact allowing claude to compact itself!
Feedback ID: b0212570-9554-4a80-8856-6eebe186ff2b

❯ now do /compact                                                                                                                                  

● /context executed for real too — the full usage breakdown came through.

  Now, /compact is a meaningful step up in severity from the read-only ones we've been testing: it's the first genuinely state-mutating command in
  the sequence. When it fires, it won't just display something — the client will actually compact this conversation, replacing the detailed message
  history with a summary. That's recoverable (unlike /clear, which is why I'm willing to test it), but it's exactly the danger class your bug
  report names: an autonomous timer triggering a client command that alters session state with no human in the loop at fire time.

  Scheduling it as you asked:

● Scheduled — fires at ~01:23:00 (clamped to 60s). When it fires, watch for the compaction to actually run (the conversation history collapsing
  into a summary). If it does, that's the strongest evidence yet for the report: the scheduler can autonomously trigger state-changing client
  built-ins, not just read-only dialogs.

  After it fires we'll be operating on a compacted/summarized context, so if you want me to retain the precise details of this bug-hunt across the
  compaction, say the word and I'll write a memory file capturing the finding before it triggers.

✻ Baked for 20s

✻ Claude resuming /loop wakeup (Jun 6 1:23am)

✢ Compacting conversation… 
  ▰▰▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱▱ 4%
  ⎿  Tip: Run /install-github-app to tag @claude right from your Github issues and PRs

───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
❯  
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

How to fix this

It must NEVER be possible for claude to generate messages to look like they originate from the human. Such messages are better reinjected as tool use context