Cross-tab background agents can take direct requests and silently collide on shared files/resources

When multiple Claude Code tabs are open against the same working directory, a background agent (subagent dispatched via the Agent tool) appears to be resumable from any tab, not just the one that launched it — and completion notifications route back to whichever tab happens to be listening, even when the resuming instruction came from a different tab. A tab receiving such a notification has no way to tell the instruction didn't originate from it, which risks unrelated concurrent edits to shared files/data and makes it hard to distinguish genuine cross-tab activity from actual anomalous agent behavior.

Suggested fix: cross-tab access to a background agent should be view-only — a non-owning tab should be able to see that an agent is running/its progress, but resuming it with new instructions should be scoped to the tab that launched it. At minimum, notifications delivered to a non-owning tab should clearly flag that the resumption came from another session.