Under the hood
Artifact file reads triggered by unattended auto-reply notifications are now blocked outside background/subagent contexts
What
The permission check for reading artifact files now explicitly refuses to allow the read when it was queued as a result of an unattended auto-reply notification, unless the current context is a background or subagent context.
Why
This closes off a path where an automatic, unattended notification reply could trigger a file read outside of a controlled background process, keeping such reads confined to contexts where they're expected.