[BUG] Conversational mention of "workflow" triggers dynamic workflows; declining still leaves a persistent daemon that hijacks claude into agent view and survives reinstalls

Found 3 possible duplicate issues:

1. https://github.com/anthropics/claude-code/issues/64524
2. https://github.com/anthropics/claude-code/issues/64744
3. https://github.com/anthropics/claude-code/issues/59252

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

The daemon persistence behavior after declining is the part that makes this especially frustrating — declining an opt-in prompt is a strong signal the user wants to exit the feature entirely, not just defer it. Leaving a background process running that changes session behavior across all projects is exactly the opposite of what "decline" should mean.

The unintended activation via conversational word matching is a related but separate problem. "Workflow" is an ordinary English word that shows up in code comments, task descriptions, planning conversations. Treating it as a magic trigger puts users in a position where they have to avoid natural language in their own sessions.

For anyone hitting the daemon persistence issue right now, the cleanup is:

pgrep -f "claude daemon run" | xargs kill

And if you want to prevent auto-launch entirely until this is fixed:

// ~/.claude/settings.json
{
  "disableAgentView": true
}

The surviving-reinstall aspect is what escalates this from a bug to a trust issue. Users expect that reinstalling a tool resets it to a clean state. A daemon that outlives reinstallation is behaving more like rootkit than a feature.

Agree with the OP that the fix here is: decline = full teardown, and word-matching activation needs an explicit opt-in gate.

The accidental activation problem here points to a missing invariant in session lifecycle design: feature activation should be explicit, and deactivation should be atomic.

The specific gap: when a user declines an orchestration prompt, the expectation is that the system returns to its prior state — no persistent processes, no redirected commands. Instead you're left with a daemon that survives reinstalls and has commandeered your normal claude entrypoint.

The pgrep workaround you found is the right recovery step, but it shouldn't be necessary. A few things that would close this class of bug:

1. Explicit activation surface only — workflow/agent features should require a deliberate flag or command, not pattern-match against conversation text
2. Declining the prompt should be a hard rollback — if a daemon was started to evaluate feasibility, decline should kill it and clean up routing state
3. claude doctor should surface daemon state — if a background process is affecting claude behavior, the diagnostic tool should know about it

The "surviving reinstall" part is especially concerning — it implies state is being written to a path that package uninstall doesn't clean. Probably the daemon.json you found in ~/.claude/, which lives outside the CLI binary's scope.

This is a nasty one — the daemon-persists-after-decline path is especially bad because it's completely non-obvious to a new user. The pkill + settings.json workaround you found works, but it shouldn't be needed.

A few things that might help others hitting this until a fix lands:

1. Check for running daemons before reinstalling: pgrep -f "claude daemon" — if it's running, kill it first, then reinstall. The installer doesn't appear to check for running processes before laying down the new binary.

1. The disableAgentView: true flag in ~/.claude/settings.json is undocumented in the main docs as of this writing — worth Anthropic surfacing it in the troubleshooting section.

1. The TTY corruption when background sessions write to the same terminal is a separate but real problem in its own right. The implicit daemon assumes it owns the TTY lifecycle; it doesn't account for users who open Claude in multiple panes of the same terminal multiplexer session.

On the root issue: the trigger being a conversational word rather than an explicit command (/workflows) is the core problem. Dynamic feature activation based on language pattern matching is inherently ambiguous — the word "workflow" in context of "what's your git workflow?" is not a feature invocation intent. Making this opt-in via explicit command or settings flag would be the right fix.

The persistent daemon surviving reinstalls is a significant issue. For anyone hitting this in the meantime: the workaround of killing the daemon PID plus setting "disableAgentView": true in settings.json does work, but you need to do it in the right order:

1. Kill the daemon first: pgrep -f "claude daemon run" | xargs kill -9
2. Wait ~5 seconds for the spare session pairs to exit
3. Set "disableAgentView": true in ~/.claude/settings.json (create the file if it doesn't exist)
4. Only then reinstall or restart -- the daemon re-spawns on binary startup if the settings key isn't already present

The --bg-spare session pair spawning with no upper bound is also worth flagging separately -- that's a resource exhaustion issue independent of the workflow trigger bug. Saw 4 sessions grow to 10+ in under a minute in a similar situation.

The keyword-triggered activation is the root problem here. "Workflow" as a reserved word in conversational context with no escape mechanism (like @workflow for explicit invocation vs the word appearing naturally in prose) is going to keep causing accidental triggers. +1 on making this explicit-invocation-only.

The "workflow" keyword trigger is a real gotcha. Easy to hit accidentally in normal conversation and the consequences - a persistent daemon that survives reinstalls and silently changes what the bare claude command does - are disproportionate to what should be an accidental activation.

Your workaround is the right one:

pkill -f "claude daemon run"

And in ~/.claude/settings.json:

"disableAgentView": true

One thing worth noting for anyone else hitting this: the daemon accumulating spare sessions (4 to 6 to 10 in two minutes in your case) is a separate problem from the keyword trigger. Even intentional workflow use hits this - there is currently no rate limit or dedup on background session creation. So if you do want to use dynamic workflows intentionally, you still want some way to cap what gets spawned.

The core feedback here - that a common conversational word should never silently activate an orchestration feature - seems clearly right. Hope this gets addressed soon.