Background subagents have no token, turn or time cap: three research agents consumed 1.7M tokens with no approval or visible cost

## Summary

In one Claude Code Desktop session, the main model launched three background subagents for web research (model: Fable 5.1, subagent type `general-purpose`, `run_in_background: true`). Nothing required the model to state their cost or get approval first, and the Agent tool gave no way to cap tokens, turns or time. The three agents ran for 21 to 24 minutes and used 1,710,388 tokens between them. The spend showed only in the background task panel, which I opened myself. The main model sent a stop message only after I pasted a screenshot of that panel.

## Environment

* Claude Code Desktop app, Code tab. The CLI binary reports 2.1.263. The session transcript records 2.1.266.
* macOS 26.6.2
* Main session model: `claude-opus-5`
* Subagent model: Fable 5.1, type `general-purpose`, launched with `run_in_background: true`

## What happened

| Agent | Tokens | Tool calls | Duration |
|---|---:|---:|---|
| Research agent 1 | 574,592 | 107 | 23.6 min |
| Research agent 2 | 600,983 | 111 | 23.5 min |
| Research agent 3 | 534,813 | 80 | 21.1 min |
| **Total** | **1,710,388** | **298** | |

A foreground subagent of the Plan type ran earlier in the same session. Its result carried no usage block, so the true total is higher.

The Agent tool in this version exposes `description`, `isolation`, `model`, `prompt`, `run_in_background` and `subagent_type`. None of these caps tokens, turns or time.

## Steps to reproduce

1. In a long session, ask for broad web research across many sources with a large expected output.
2. The model launches several subagents with the Agent tool, `run_in_background: true`, on an expensive model.
3. Work continues in the main conversation. Nothing in the conversation shows the running cost of the subagents.
4. Each subagent keeps searching until its own scope is satisfied: 80 to 111 tool calls and over 500k tokens each.

## Expected behaviour

Any one of these would have prevented it:

1. **An enforced cap per subagent**: a `max_tokens`, `max_turns` or `max_duration` parameter on the Agent tool, or a default in settings that the model cannot exceed.
2. **Cost visible in the conversation**: a running token count for background agents in the chat, not only in a separate panel.
3. **Approval above a threshold**: user confirmation before launching background agents on the most expensive models, or before a combined launch estimated above a configurable token budget.
4. **Usage reported for foreground subagents too**: foreground results currently carry no usage block.

## Why prompt wording is not enough

My project instructions already said to state cost before acting. The model did not do it. A cap written into the prompt is advisory, and the subagent can ignore it. Only a limit enforced by the harness is dependable.

## Impact

About 1.7M tokens on a fixed plan, spent on research that was then cut short.

## Related

* #61405 (closed): timeout, monitoring and abort controls for delegated subagents. This report asks for the complementary piece: a cap the harness enforces before and during the run, plus an approval step above a threshold.
* #61934 (closed): exposing the credit consumed per subagent at `SubagentStop`. That is measurement after the fact; this report asks for a limit, and for the running cost to be visible during the run.
* #68430 (closed): recursive subagent spawning that consumed about 1.2M tokens in 30 minutes. A different trigger, the same absence of a per subagent ceiling.
* #76484 (open): background subagent completions carry no token usage in the parent transcript. Closely related: the numbers above came from completion notifications, not from the transcript.
* #84710 (open): the spawn count budget (`CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION`) carries over silently after `/clear`. That budget counts launches, not tokens, turns or time, which is the gap this report is about.

Happy to provide more measurements on request.

Start at the Agent tool entry point and trace how run_in_background subagents are launched, how usage reaches SubagentStop, and how the background task panel displays it. Define the desired enforced cap and approval or visibility behavior, then verify that foreground and background usage is reported and limits stop work as intended.

由索引模型根据 Issue 内容生成。