Phantom `⏺ Human:` lines appearing in transcript — assistant acts on instructions the user never typed

Description

In an active conversation, lines prefixed with ⏺ Human: have appeared in the transcript that the user explicitly says they never typed. Their content is plausible-looking text related to the current topic — close enough that the assistant treated them as real user instructions and acted on them (in our case kicking off a chain of source-code changes and rebuilds based on a non-existent bug report).

Because the assistant cannot distinguish these phantom turns from genuine ones, they can cause:

• Wrong work performed — the assistant follows instructions the user did not give.
• Wasted iterations / cost — entire build cycles based on fabricated requirements.
• Trust degradation — the user can't trust that anything the assistant references is actually theirs.
• Potentially destructive actions — if the phantom turn happened to say "drop the database" or similar, the assistant might act on it.

Environment

• claude-code: 2.1.119
• macOS (Apple Silicon)
• Terminal: macOS Terminal.app (default)
• Auto Mode: active during the session
• Long-running session with many background tasks (Monitor, run_in_background bash, Agents)

Hooks

User has hooks registered for every event (UserPromptSubmit, PreToolUse, PostToolUse, Notification, PermissionRequest, Stop, etc.) calling claude-island-state.py. We inspected that hook — for UserPromptSubmit it ONLY sends state to a Unix socket; no print(), no stdout output. So the hook is not injecting prompt text.

What we saw

A line appeared in the CLI rendered as ⏺ Human: <plausible Chinese text related to the project>. The text was clearly related to the current task but the user denied having typed it. It happened more than once in the same session, the second occurrence being a paraphrase of an earlier (also disputed) one.

Screenshot: (attached separately by user)

Reproduction notes

We can't reliably reproduce it on demand. Conditions correlated with the occurrences in this session:

• Many concurrent Monitor tasks streaming events
• Multiple run_in_background bash commands
• Long session with many turns and many tool calls
• pbpaste shows the literal string pbpaste (i.e. not the phantom text), so it is NOT a stale macOS clipboard
• No tmux / screen — plain Terminal.app
• No --print mode

Suspected mechanism

Pure speculation, but the pattern looks like an event-stream race in the renderer:

• Possibly a Monitor / background-task notification body being rendered with the user-message marker
• Or a previous user turn being replayed when the transcript scrolls
• Or a buffered keystroke from earlier in the session being submitted late

It would be useful to log the source of every transcript line (which subsystem emitted it) so a future occurrence can be attributed.

Mitigation requested

1. Source-tag every transcript line internally so the assistant can be told "this is a real user turn vs. a system-generated render" — most importantly the assistant should NOT act on phantom lines.
2. Render warning when a line that the renderer believes is from the user has no matching keystroke event in its input log.
3. Idempotent input — if a buffered input is later submitted, dedupe against recent user turns.

Happy to provide the session ID, full transcript, and the screenshot via a private channel if helpful.

<img width="1542" height="72" alt="Image" src="https://github.com/user-attachments/assets/946bd0a6-5dbd-4ab8-be76-c65b545cb86e" />