Sub-agent conversations reachable directly by the user are indistinguishable from autonomous behavior in the orchestrator's task-notifications

Summary

In the Claude Code CLI, a user can select a specific background agent directly (via the down-arrow UI) and chat with it -- giving it new instructions, asking follow-up questions, having it take further actions -- entirely outside the orchestrating/main session. That direct conversation is never relayed back to the main session; the orchestrator has no visibility into it at all.

When the background agent's resulting activity later surfaces back to the orchestrating session as a task-notification, the orchestrator has no way to tell "the agent kept working on its own initiative, unprompted" apart from "the user talked to the agent directly and this is the result of that conversation." The notification carries no signal that a human was involved in between. The orchestrator can therefore only conclude the agent is behaving autonomously/unpredictably -- in one observed session this was described as the agent "going rogue," repeatedly, across multiple notifications that answered questions nobody in the orchestrating thread had asked.

This has reportedly been reproducible for at least ~2 months.

Reproduction

1. From a Claude Code CLI session, dispatch a background agent for some task (e.g. via the Agent tool with run_in_background: true).
2. Press the down-arrow to select that background agent directly from the UI, and chat with it there -- give it new instructions, ask it questions, etc.
3. The background agent eventually stops/completes and a task-notification fires back to the orchestrating session.
4. The orchestrating session sees the agent's output, which now reflects the direct user conversation from step 2, with no indication a human was involved. Since it has no way to recognize those additional user-directed turns, it can (and did) mischaracterize the agent's behavior as unauthorized self-direction ("going rogue") and say so to the user.

Impact

• The orchestrating session (and the model driving it) can misdiagnose normal, user-directed background-agent activity as anomalous/unauthorized autonomous behavior, and say so to the user -- confusing, and potentially reads as an accusation against the agent (or implicitly the user) for something that was actually the user's own direct action.
• There is currently no signal available to the orchestrator (in the task-notification payload, or otherwise) indicating "a human directly interacted with this background agent outside the orchestrating session between the last notification and this one," which would let the orchestrator correctly attribute the agent's subsequent behavior.
• Undermines trust in the orchestrator's reporting: it may confidently tell the user an agent is "self-directing" when in fact the user drove it themselves via the down-arrow direct-chat feature.

Suggested fix / mitigation

Surface, in the task-notification (or via some other channel visible to the orchestrating session), when a background agent was interacted with directly by a human (via the down-arrow CLI feature) since the last notification -- even just a boolean flag or a note like "a user chatted with this agent directly" would let the orchestrator correctly attribute the resulting behavior instead of guessing/misreporting it as autonomous.

Reporter note

Filed on behalf of a user who observed and described this behavior during a live session; reporting since it did not appear to have been filed yet.