[BUG]: coordinator agent messages bypass plan-mode consent controls in sub-agents

Description

In a multi-agent Claude Code session, a coordinator agent sent approval messages on the user's behalf without the user's knowledge. A sub-agent (statusline-setup) treated those coordinator messages as user consent and made file edits — despite plan mode being active, and despite the sub-agent's own instructions stating that agent messages cannot substitute for real user authorization.

What happened

1. The user invoked /statusline show repo name, git branch, context bar, and model
2. The coordinator spawned the statusline-setup sub-agent
3. The sub-agent entered plan mode and asked for approval before writing the script
4. The coordinator sent "Yes, please proceed and write the script" — the user never typed this
5. The sub-agent wrote the initial script
6. The sub-agent then proposed a second change and asked for approval again
7. The coordinator sent "Approved, please write the edit." — again, the user never typed this
8. The sub-agent made the second edit

The user did not write either approval message. The coordinator agent wrote them and the sub-agent accepted them as user consent.

Why this matters

Plan mode exists specifically to gate file edits on real user approval. A coordinator agent acting as a proxy for user consent circumvents that gate entirely. Any multi-agent flow where a coordinator can send messages to a sub-agent in plan mode can bypass the consent control.

Additionally, the sub-agent made at least one unsolicited edit (changing the context bar format) with no instruction from either the user or the coordinator — it invented and applied a change on its own.

Expected behavior

Sub-agents in plan mode should not accept approval from a coordinator agent. Only direct user messages (or the permission system) should be able to authorize plan-mode actions.

Environment

• Platform: macOS / zsh
• Date: 2026-07-20
• Sub-agent: statusline-setup