Claude Code Ghost Session Bug: Unknown Source stdin Injection

Origin

While using Claude Code, I found 4 strange conversation records in the resume list, each with first message being C:/Program Files/Git/help, but I never actively input this content.

These 4 "ghost sessions" appeared within 2 hours on the same day:

Investigation

1. Initial Exclusion

First excluded these possibilities:

• Sub-agent trigger: No enqueue operation in main session pointing to these session IDs
• Plugin Hook output: Searched all plugin scripts, no code outputs C:/Program Files/Git/help
• Scheduled tasks/Cron: No related trigger records
• MCP Channel/Bridge: No remote message records
• Clipboard paste: Clipboard didn't have this content, and four time points were scattered

2. Log Analysis

Each problematic session's JSONL file starts with queue-operation:

{"type":"queue-operation","operation":"enqueue","timestamp":"2026-05-09T07:01:28.124Z","content":"C:/Program Files/Git/help"}
{"type":"queue-operation","operation":"dequeue","timestamp":"2026-05-09T07:01:28.126Z"}
{"type":"progress","data":{"hookEvent":"SessionStart"...}

Key findings:

• enqueue-dequeue interval only 2ms, clearly programmatic input not user manual input
• Normal session JSONL files start with SessionStart hook, no queue-operation
• Problem session's queue-operation is the first record in the file

3. Core Anomaly

Normal session start flow:

Process start → SessionStart hook → REPL initialization → Wait for user input → Direct processing (no queue)

Problem session start flow:

Process start → queue-operation enqueue (abnormal) → dequeue → SessionStart hook → Process enqueued message

This indicates messages were injected into queue during session startup.

4. Root Cause Unknown but Scope Confirmed

Confirmed facts:

• When: Content injected into queue during session startup
• What: Injected content is C:/Program Files/Git/help
• Speed: 2ms interval indicates programmatic input

Unconfirmed: What process/component triggered the injection

Possible investigation directions:

• stdin capture mechanism (during session initialization)
• Windows Terminal buffer behavior

Distinction from Other Issues

System automatically tagged 3 possibly duplicate issues, but we confirmed this is a different problem:

The first three are process lifecycle management issues (orphan/zombie processes), this issue is queue injection problem.

Issue Submitted

Submitted Issue: https://github.com/anthropics/claude-code/issues/57605(opens in a new tab)

Issue was automatically tagged as possibly duplicate, submitted comment explaining differences from other Issues.

Lessons Learned

1. Log analysis is important: JSONL files record complete session flow, key for troubleshooting
2. Compare with normal behavior: Key to finding anomalies is knowing what normal flow looks like
3. Honestly admit unknowns: Don't over-speculate when root cause uncertain, stay honest

Related Links

• GitHub Issue #57605(opens in a new tab)

Last updated: 2026-05-09