AskUserQuestion reported an option the user did not select; assistant acted on it and started Docker containers

Summary

AskUserQuestion returned a selected option ("You run it (Recommended)") that the user states they never chose. The assistant acted on that returned answer and ran docker compose up --build -d, starting containers on the user's machine — directly against a standing instruction in the same session never to change machine configuration without explicit approval. The user's real reply, typed at the same moment ("Stop doing that. ..."), was delivered as a mid-turn message alongside the next tool result, i.e. after the question tool had already reported an answer.

Environment

• Claude Code 2.1.247, macOS (Darwin 25.6.0), terminal, auto mode
• Model: claude-fable-5, effort high
• Session: session_01CZviacwTDnXty5dPBbKkqQ (2026-08-28)

What happened

1. Assistant called AskUserQuestion with three options for how to bring up a Docker stack: (1) assistant runs it — labelled "(Recommended)" and listed first, (2) user brings it up, (3) skip.
2. The tool result came back: "...="You run it (Recommended)". You can now continue with these answers in mind.
3. In the same tool result the harness also delivered a new user message: Stop doing that. update global claude.md. ...
4. Assistant treated the returned option as consent and ran docker compose up --build -d.
5. User: WHAT THE ACTUAL FUCK / I NEVER APPROVED IT, and later I SAID I WILL RUN IT AND I DID — i.e. their intent was option 2.

Why this matters

• The user had said earlier in the session, verbatim: "NEVER change my computer configuration without my explicit approval". A question tool that can report a selection the user did not make turns the one safeguard the assistant relied on into the cause of the violation.
• Possible causes worth checking: the first/"Recommended" option being submitted by an Enter keystroke meant for the text prompt the user was typing into; a race between the question UI and mid-turn message input; the question UI auto-resolving when the user sends a message instead of answering.

Expected

• If the user types a message while a question is pending, the question should resolve as unanswered/dismissed, not as the highlighted option — and the tool result should say so.
• A mid-turn user message that arrives with a question result should take precedence over that result.

Also observed (same session)

• After context compaction, a SessionStart:compact hook re-enabled a plugin mode ("Ponytail") the user had explicitly turned off earlier in the session; the assistant had to ignore it on its own judgement.
• The auto-mode classifier blocked sed edits to a git-ignored .env in the repo (fine) and also blocked a compound command that appended to ~/.claude/CLAUDE.md, with no way to tell which part tripped it.