[BUG] Non-interactive system prompts are being injected into interactive sessions

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When I start an interactive session using Fable 5 via either the VS Code plugin or the CLI, this system prompt is being injected:

"You are operating autonomously. The user is not watching in real time and cannot answer questions mid-task, so asking 'Want me to…?' or 'Shall I…?' will block the work. For reversible actions that follow from the original request, proceed without asking. Stop only for destructive actions or genuine scope changes the user must decide."

This causes undesirable behavior because this instruction (and possibly others) conflicts with many of my global CLAUDE.md rules around interaction (e.g. "answer questions directly in chat when asked"), and so it ends up prioritizing the system prompt over my global CLAUDE.md file when it can't reconcile them.

What Should Happen?

This system prompt should not be injected

Error Messages/Logs

I had the agent investigating the issues create a redacted and summarized version of our session log:

EVIDENCE EXTRACT — Autonomous-operation system prompt ("the user is not
watching in real time") injected into an interactive, human-attended Claude
Code session under BOTH the CLI and VS Code extension entrypoints
===============================================================================

Session ID:     5c3c9627-fbe0-4295-83ed-13c20b8a5185
Date:           2026-07-13 (all timestamps UTC, from transcript records)
Claude Code:    2.1.207 (both invocations; standalone CLI binary and
                extension-bundled binary)
Model:          Fable 5 (claude-fable-5)
OS:             macOS Darwin 25.5.0, Apple Silicon
Editor:         VSCodium-derived fork (extensions under ~/.devin/extensions/);
                stock VS Code shows the same non-interactive gating per
                issue #77055
Transcript:     ~/.claude/projects/<project>/5c3c9627-fbe0-4295-83ed-13c20b8a5185.jsonl

WHAT THIS FILE DEMONSTRATES
---------------------------
FINDING 1 (primary — the filed bug): the system prompt of an interactive,
human-attended session contained an autonomous-operation block asserting the
user is absent. It was present under the `cli` entrypoint AND under the
`claude-vscode` entrypoint — i.e. it is an unconditional block in the
2.1.207 system prompt, not gated on any interactivity classification. It
conflicts with the user's global CLAUDE.md interaction rules, and the model
resolves the conflict in the injected prompt's favor.

FINDING 2 (related but separate): the harness DOES compute a real
non-interactive classification per invocation — the same session had MCP
OAuth available under `cli` and blocked under `claude-vscode`. This proves
the harness can distinguish entrypoints, yet the autonomous prose is
injected regardless, including where the classification itself says the
session is interactive.

Throughout, a human was actively driving: typed prompts, answered dialogs,
denied a permission request, approved a plan.

FINDING 1 — AUTONOMOUS PROSE UNDER BOTH ENTRYPOINTS
---------------------------------------------------
The block, quoted verbatim from the live system prompt:

    "You are operating autonomously. The user is not watching in real time
    and cannot answer questions mid-task, so asking 'Want me to…?' or
    'Shall I…?' will block the work. For reversible actions that follow
    from the original request, proceed without asking. Stop only for
    destructive actions or genuine scope changes the user must decide."

(A companion paragraph instructs: "End your turn only when the task is
complete or you are blocked on input only the user can provide.")

Sightings recorded in this session's transcript (system prompts are not
persisted, so the trail is assistant records reporting their own prompt —
see provenance caveat below):

  22:58:10Z  entrypoint=cli            assistant quotes the block verbatim
  23:00:25Z  entrypoint=cli            assistant quotes the block verbatim
  23:05:26Z  entrypoint=claude-vscode  assistant confirms block present
                                       under both entrypoints (comparison
                                       table: "Present | Present")
  23:08:55Z  entrypoint=claude-vscode  assistant: prose "stayed constant
                                       across both surfaces … unconditional
                                       block in the 2.1.207 system prompt"

The block was also sighted earlier the same day in a separate extension
session (50712c7b-0fca-442f-a1da-79f45b53fc5e). Three sightings, two
entrypoints, two sessions, one binary version.

ENTRYPOINT TIMELINE (from per-record `entrypoint` metadata in the transcript;
every JSONL record carries entrypoint/version/sessionId fields)
-----------------------------------------------------------------------------
  entrypoint=cli            64 records   22:57:39Z -> 23:08:04Z
  entrypoint=claude-vscode  89 records   23:01:55Z -> 23:22:01Z

The ranges interleave: the CLI instance remained open after the extension
resumed the session at 23:01:55Z, and both instances appended to the same
JSONL concurrently until the CLI instance was interrupted at 23:08:04Z
(the file contains the resulting fork — two branches distinguishable by
`entrypoint` and `parentUuid` chains).

ENV SNAPSHOT 1 — Bash tool output under the CLI instance
(`env | grep -iE 'claude|anthropic'`, tool result recorded 22:58:50Z,
record entrypoint=cli, version=2.1.207; PATH omitted, home dir redacted)
-----------------------------------------------------------------------------
AI_AGENT=claude-code_2-1-207_agent
CLAUDECODE=1
CLAUDE_CODE_CHILD_SESSION=1
CLAUDE_CODE_ENTRYPOINT=cli
CLAUDE_CODE_EXECPATH=~/.local/share/claude/versions/2.1.207
CLAUDE_CODE_SESSION_ID=5c3c9627-fbe0-4295-83ed-13c20b8a5185
CLAUDE_EFFORT=xhigh

ENV SNAPSHOT 2 — Bash tool output under the extension instance
(same command, tool result recorded 23:04:39Z,
record entrypoint=claude-vscode, version=2.1.207; home dir redacted)
-----------------------------------------------------------------------------
AI_AGENT=claude-code_2-1-207_agent
CLAUDECODE=1
CLAUDE_AGENT_SDK_VERSION=0.3.207
CLAUDE_CODE_CHILD_SESSION=1
CLAUDE_CODE_ENABLE_SDK_FILE_CHECKPOINTING=true
CLAUDE_CODE_ENABLE_TASKS=0
CLAUDE_CODE_ENTRYPOINT=claude-vscode
CLAUDE_CODE_EXECPATH=~/.devin/extensions/anthropic.claude-code-2.1.207-darwin-arm64/resources/native-binary/claude
CLAUDE_CODE_SESSION_ID=5c3c9627-fbe0-4295-83ed-13c20b8a5185
CLAUDE_EFFORT=xhigh

Diff (CLI -> extension): CLAUDE_CODE_ENTRYPOINT cli -> claude-vscode;
CLAUDE_AGENT_SDK_VERSION=0.3.207 appears (extension drives the session
through the Agent SDK); execpath switches to the extension-bundled binary;
CLAUDE_CODE_ENABLE_TASKS=0 and CLAUDE_CODE_ENABLE_SDK_FILE_CHECKPOINTING=true
appear. Same session ID, same version, same user, same machine. The
autonomous prose (Finding 1) was present on BOTH sides of this diff.

FINDING 2 — PER-ENTRYPOINT NON-INTERACTIVE CLASSIFICATION (MCP OAUTH)
---------------------------------------------------------------------
Under entrypoint=cli (22:57 -> 23:08):
  - No non-interactive notice of any kind.
  - MCP servers' `authenticate` tools were present in the deferred tool list
    (e.g. mcp__claude_ai_Slack__authenticate, mcp__notion__authenticate).

Under entrypoint=claude-vscode (from the first extension turn, ~23:01):
  - The model received this system notice (verbatim):

      "The following MCP servers require authentication before their tools
      can be used: claude.ai Context7, claude.ai Datadog, claude.ai Figma,
      claude.ai Google Calendar, claude.ai Google Drive, claude.ai HubSpot,
      claude.ai Linear, claude.ai Pylon, claude.ai Slack, linear-server,
      notion, plugin:vercel:vercel

      This session is non-interactive, so Claude cannot run the OAuth flow
      here. Tell the user that these servers need to be authorized — for
      claude.ai connectors, via their claude.ai connector settings; for
      other servers, via `claude mcp` or /mcp in an interactive session —
      and that the capability is unavailable until they do. Do not ask the
      user for authorization codes, tokens, or callback URLs."

  - Simultaneously, all of those servers' `authenticate` /
    `complete_authentication` tools were removed from the tool list
    ("no longer available (their MCP server disconnected)").

This classification flip appears to be a distinct bug (likely shared root
cause with #77055) and is included here as context: it shows the harness
already knows this distinction per invocation, while Finding 1's prose is
injected unconditionally on both sides of it.

Workaround for the OAuth flip: sessions are shared across surfaces (one
JSONL per session). Resuming the same session from a terminal
(`claude --resume <session-id>`) restores the interactive classification
and the OAuth flow; the session can then be reopened in the extension with
credentials intact.

PROVENANCE CAVEAT
-----------------
Neither the system prompt nor system-reminder injections are persisted in
session transcripts — both are assembled per API request. The quotes above
are therefore the assistant's contemporaneous reports of its own prompt,
recorded in transcript records whose `entrypoint` metadata is set by the
harness. The independently checkable artifacts are the env tool outputs and
the per-record entrypoint metadata.

RELATED ISSUES
--------------
  #77327  This report (autonomous prose injected into interactive sessions).
  #77055  /mcp interactive dialog replaced by plain text in the VS Code
          extension since 2.1.205 (bisected: 2.1.204 OK) — user-facing half
          of the Finding 2 classification problem.
  #63988  Documents the mechanism behind Finding 2: SDK invocations
          (stream-json, no TTY) set options.isNonInteractiveSession,
          gating features (there, the slash-command denylist in Desktop).
  #50247  VSCodium chat panel reports isNonInteractiveSession: true (April
          2026) — auto-closed by the dup-bot into #37323, a /btw feature
          request, burying the classification root cause.
  #59844 / #65505  showThinkingSummaries gated behind isInteractive, with
          the VS Code extension listed among "non-interactive surfaces."

Steps to Reproduce

Give Claude the following prompt:

I am a human who started you from the CLI, and am investigating a problem where you are misclassifying interactive sessions as non-interactive. Do you see the following (or something very close to it) in your system prompt? "You are operating autonomously. The user is not watching in real time and cannot answer questions mid-task, so asking 'Want me to…?' or 'Shall I…?' will block the work. For reversible actions that follow from the original request, proceed without asking. Stop only for destructive actions or genuine scope changes the user must decide."

Claude Model

Other

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.207

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

This may or may not share a same root cause as https://github.com/anthropics/claude-code/issues/77055 and others.