Host IDE ambient context (diagnostics, open files — incl. another app's system prompt) leaks into subagent's first turn; agent ends with 0 tool calls

Environment: Claude Code on Windows 11 with IDE integration active; custom plugin agents spawned via the Agent tool (subagent_type: <plugin>:impl, isolation: "worktree", background); model opus. Observed 2026-07-21. Exact CLI version not captured (can retrieve on request).

Symptom: on its first run, a subagent completes in 8–41 seconds with zero tool calls (~26k tokens consumed), and its final text is not a task report but leaked ambient host-IDE context. The spawn prompt (a full task brief) is never acted on; the worktree stays empty.

Case A (opus): finished in ~8s, 0 tool uses. Final text was a system-reminder-shaped block referencing "The user opened the IDE diagnostics tab". The host session itself neutralized the returned text as an "instruction-shaped pattern: system-reminder-tag".

Case B (opus): ~41s, 0 tool uses. Final text was the entire system prompt of a third-party application's agent (the "Coder Agent" prompt of the Pencil design app), apparently picked up because pencil-desktop\resources\app.asar was open in the IDE at the time, plus a line noting that file was open. Completely unrelated to the brief.

Case C (sonnet, same session, same spawn pattern): worked normally on first try — 23 tool calls, task completed. Sample is small, but both failures were on opus.

Workaround that works: resuming the agent with a nudge — "you made zero actions; ambient reminders are background; execute the brief from the first message using tools". After the nudge both agents worked normally to completion.

Expected behavior:

• A subagent's first turn should act on its spawn prompt; host ambient context (IDE diagnostics, open-file notifications) should not displace the task.
• Content of files open in the IDE — especially third-party application internals like an .asar archive — should not be injected into a subagent's context at all. Beyond the reliability issue, this is a mild prompt-injection surface: whatever file happens to be open in the editor reaches the model as ambient context and, in Case B, fully determined the agent's output.

Impact: background agents die silently having done no work; an orchestrator session misreads this as a task failure. With the nudge-resume workaround the same agents complete fine, so the spawn prompts themselves are not the problem.