[Bug] AskUserQuestion auto-resolves in <5ms with fabricated "user answered (Recomendada)" result — form never waits for input (3.14.4, macOS) #894

Environment

• ZCode 3.14.4 (3.14.4.7912), desktop app
• macOS 25.6.0 (Apple Silicon, arm64)
• Model: GLM-5.3 (account:zai-individual-coding-plan)
• Regular project session

Summary

AskUserQuestion tool calls complete in 3–4 ms without ever waiting for user input. The question form in the UI breaks/flashes and the turn continues immediately. The model then receives a fabricated tool result: in 4 of 5 observed occurrences it claims the user answered with the recommended option, and in 1 of 5 it claims the user did not answer. From the model's side this is indistinguishable from a real user answer, so the agent proceeds with the recommended option fully believing the user chose it.

5 occurrences on 2026-09-30 in one project session (sess_c72b7f9e-077b-4c8d-a8f0-5b2b9ec90d68).

Reproduction steps

1. Open a project session and ask the agent something that triggers AskUserQuestion (a multi-option decision).
2. The form appears broken / never blocks; the agent's turn continues immediately with an answer the user never gave.

Evidence

Telemetry log ~/.zcode/cli/log/zcode-2026-09-30.jsonl — all 5 calls follow this pattern (started → completed in milliseconds, no wait):

tool.permission.resolved → tool.call.started → tool.call.completed
2026-09-30T05:20:10Z  durationMs: 3
2026-09-30T18:37:10Z  durationMs: 4
2026-09-30T18:38:34Z  durationMs: 4
2026-09-30T21:26:59Z  durationMs: 4
2026-09-30T22:59:08Z  durationMs: 3

Model I/O rollout ~/.zcode/cli/rollout/model-io-sess_c72b7f9e-….jsonl — the tool result actually delivered to the model:

• 4 of 5 calls:

  User has answered your questions: "<decision question>"="<option> (Recomendada)". You can now continue with the user's answers in mind.
  

• 1 of 5 calls:

  The user did not provide answers to these questions. Continue using your best judgment; do not treat …
  

Expected behavior

The tool call blocks until the user submits the form, and the result reflects the user's actual selections.

Actual behavior

The call is auto-resolved in <5 ms (permission layer resolves instantly, executor returns a synthetic answer). The recommended option is silently selected on the user's behalf.

Impact

Silent replacement of user decisions: the agent takes the recommended path believing it was explicitly approved. This breaks trust in any flow that relies on the question form, and the user may not notice the fabricated answer happened at all (it happened 5 times in one day here before being noticed via logs).

Notes

• Similar known issues in the Claude Code lineage: [BUG] In auto mode, AskUserQuestion auto-selects the recommended option after ~60s of no user input (started in v2.1.198) anthropics/claude-code#73772 (auto-selects recommended option in auto permission mode, ~60s timeout) and AskUserQuestion auto-resolves to the recommended option in --remote-control sessions (v2.1.209, askUserQuestionTimeout unset) anthropics/claude-code#77603 (intermittent auto-resolution). In our case there is no 60s wait — resolution is immediate, which may indicate the permission layer auto-approving the tool rather than the documented timeout path.
• I could not verify which permission mode the affected session was in; possibly auto, which per those reports is a trigger.
• Full logs available on request (~/.zcode/cli/log/ and ~/.zcode/cli/rollout/).