Trail of Bits' gh-cli plugin stops long Claude Code sessions from breaking every Bash call

Trail of Bits has fixed gh-cli, its Claude Code plugin that sends GitHub fetches through your signed-in GitHub command line tool. Its session start hooks kept writing the same two lines into the session's environment, until every Bash call in that session failed. Version 1.6.3 writes each line once.

Session start fires when a session starts, when it resumes, and after every compact. Each time, both hooks appended an export line, one for PATH and one for the session ID, without checking for a copy already there. One user found 88 to 246 duplicate lines in each of seven long-running sessions.

Claude Code joins those environment files and cuts the result off at about 8 kilobytes. Once the duplicates pass that size, the cut lands in the middle of a line. From then on every Bash call in the session fails, even echo hi, with an unexpected end of file.

Before, each hook appended its line on every fire. Now it searches all of the session's environment files for that exact line, and writes it only when it is missing. Skipping the hook on resume and compact would have missed repeated startup fires, so the check covers more.

Resume and compact also start a new environment file, and Claude Code joins them all. Checking only the current file would still let the line repeat once per file. A maintainer asked for a test across two files. Fired four times across a pair, the old hook left four session ID lines, and the new one leaves one.

The fix ships in gh-cli 1.6.3, merged on October 15. The bug was reported on version 1.6.0 under Windows 11 and Git Bash, and 1.6.2 had the same code. New regression tests fail on the old hooks and pass on the new ones. The pull request carries the diff and the tests.