gh-cli 1.6.3 stops breaking every Bash call in long sessions
Trail of Bits' gh-cli plugin stops long Claude Code sessions from breaking every Bash call
Trail of Bits has fixed gh-cli, its Claude Code plugin that sends GitHub fetches through your signed-in GitHub command line tool. Its session start hooks kept writing the same two lines into the session's environment, until every Bash call in that session failed. Version 1.6.3 writes each line once.
Every startup, resume and compact added two more lines
Every startup, resume and compact added two more export lines
Session start fires when a session starts, when it resumes, and after every compact. Each time, both hooks appended an export line, one for PATH and one for the session ID, without checking for a copy already there. One user found 88 to 246 duplicate lines in each of seven long-running sessions.
Past about 8 KB, every Bash call fails
Past about 8 KB, the cut lands mid-line and every Bash call fails
Claude Code joins those environment files and cuts the result off at about 8 kilobytes. Once the duplicates pass that size, the cut lands in the middle of a line. From then on every Bash call in the session fails, even echo hi, with an unexpected end of file.
Each hook now checks for its line before writing it
Each hook now writes its line only when the session lacks it
Before, each hook appended its line on every fire. Now it searches all of the session's environment files for that exact line, and writes it only when it is missing. Skipping the hook on resume and compact would have missed repeated startup fires, so the check covers more.
Resume and compact add a second env file
Resume and compact start a second env file, so the check spans every file
Resume and compact also start a new environment file, and Claude Code joins them all. Checking only the current file would still let the line repeat once per file. A maintainer asked for a test across two files. Fired four times across a pair, the old hook left four session ID lines, and the new one leaves one.
gh-cli 1.6.3, for Claude Code
The fix ships in gh-cli 1.6.3, a Claude Code plugin
Reported on gh-cli 1.6.0 under Windows 11 and Git Bash. 1.6.2 had the same code. New regression tests fail on the old hooks.
The fix ships in gh-cli 1.6.3, merged on October 15. The bug was reported on version 1.6.0 under Windows 11 and Git Bash, and 1.6.2 had the same code. New regression tests fail on the old hooks and pass on the new ones. The pull request carries the diff and the tests.
