Claude Code node process posts phantom Cmd+V (CGEvent) system-wide on macOS

Description

While Claude Code is running in any terminal on macOS, system-wide Cmd+V (paste) events are being generated that the user did not trigger. These paste events inject clipboard content into whatever application is focused — not just the terminal running Claude Code.

Evidence

Using a custom CGEvent tap monitor (compiled Swift binary listening for keyDown events with Cmd modifier), I captured the following while Claude Code was running:

[02:49:50] PASTE (Cmd+V)
  → App:        Warp (pid: 824, bundle: dev.warp.Warp-Stable)
  → Source:     node (pid: 50046, bundle: ?)
  → State ID:   1

[02:49:50] PASTE (Cmd+V)
  → App:        Warp (pid: 824, bundle: dev.warp.Warp-Stable)
  → Source:     node (pid: 50046, bundle: ?)
  → State ID:   1

The node process (pid 50046) is Claude Code's runtime. It is the source of the CGEvent paste keystrokes, as reported by CGEventField.eventSourceUnixProcessID.

For comparison, actual user-initiated Cmd+V paste events show pid 0 (HID system / no specific process).

Behavior

• Clipboard content gets randomly pasted into focused applications (Slack, VS Code, browser, etc.)
• Happens sporadically while Claude Code is actively running (processing, rendering output)
• Stops when Claude Code is terminated
• Reproducible across different terminals (Warp, Terminal.app)
• No clipboard managers, text expanders, or automation tools running
• On TUI exit, ^[i (ESC + i) escape sequence leaks to the terminal

Environment

• OS: macOS 15 (Sequoia)
• Claude Code version: latest
• Node: v25.2.1 (via nvm)
• Shell: zsh
• Terminals tested: Warp, Terminal.app

Possibly related

• #3134 — bracketed paste mode not disabled on exit
• #24418 — bracketed paste mode not disabled before launching external editors
• #17787 — escape sequence timing race condition (cursor position responses leak)
• #13183 — CLI hangs on paste from accessibility tools, bracketed paste mishandling

Investigation method

The CGEvent tap monitor source is a Swift binary using CGEvent.tapCreate with .cgSessionEventTap / .listenOnly, filtering for keycode == 9 (V key) with .maskCommand flag, logging eventSourceUnixProcessID and frontmost application for each event.