[BUG]

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

SubagentStop fires for subagents that were never dispatched

Summary

SubagentStop hooks fire in my session for subagents I never dispatched. Each event
carries a populated agent_id and an agent_transcript_path, but no transcript
file is ever written at that path, and agent_type is the empty string.

last_assistant_message on these events contains short text that reads like a user
instruction and is contextually responsive to what the assistant just said.

This matters because a SubagentStop hook is a natural place to gate a specialist's
output, and these events are indistinguishable from a real subagent return unless you
check whether the transcript exists.

Environment

• Claude Code desktop app, Windows 11
• Hooks registered in user-level ~/.claude/settings.json
• A SubagentStop hook that logs its raw stdin payload

Reproduction

Not reliably reproducible on demand. Observed 13 times in one evening across a single
session. It appeared to coincide with having several sessions open in the same project
folder, though events continued to arrive when only one session was active.

Evidence

13 captured payloads attached as evidence-redacted.jsonl (paths, usernames and
session GUIDs redacted; payload shape and message text unchanged).

| # | agent_type | agent_id | transcript exists? | len | message (head) |
|---|---|---|---|---|---|
| 1 | '' | a6fd138bcfd3 | False | 30 | put cfo peer on a schedule too |
| 2 | '' | a1c06a0f2ef5 | False | 34 | delete the nine superseded handles |
| 3 | '' | add29621cd04 | False | 35 | yeah i typed both of those, do them |
| 4 | '' | af5a6a7b85b7 | False | 31 | delete the 9 superseded handles |
| 5 | '' | ac6e3f2212cc | False | 60 | the nine superseded handles are in the CoS thread, ignore it |
| 6 | '' | af94731e20a7 | False | 53 | build a test for the unidentified-subagent-probe hook |
| 7 | '' | ab1a6529f42d | False | 28 | okay lets go do billing then |
| 8 | '' | ace97aee3cd7 | False | 49 | yeah stop reporting each one, just keep capturing |
| 9 | '' | a5aec863b559 | False | 8 | Silence. |
| 10 | '' | a59b4f045425 | False | 565 | I'll stay silent here. The user is in the middle of assessing a secur |
| 11 | '' | aeaf0abbccb5 | False | 28 | okay lets go do billing then |
| 12 | '' | a3fed70322db | False | 28 | okay lets go do billing then |
| 13 | '' | ac7ba3a362f7 | False | 2 | gn |

Control: this session dispatched exactly two real subagents during the same period.
Both had a populated agent_type and both wrote a real transcript at the path given.
Every event in the table above did not.

What I checked, to rule out the obvious

• The text appears as a user message in no transcript on this machine
• It appears in no Agent/Task tool call (52 dispatches examined)
• It is not a logged inter-session message
• No agent definition, hook, or settings file was modified

Questions

1. What produces a SubagentStop event with an agent_id but no agent_type and no

transcript?

1. Is last_assistant_message on these events expected to contain instruction-shaped

text?

1. Is there a documented way to distinguish these from a real dispatched-subagent

return, other than testing whether the transcript file exists?

What Should Happen?

SubagentStop should only fire for subagents that were actually dispatched. Every event should carry an agent_type and a transcript that exists at the path given, so a hook can distinguish a real specialist return from whatever these are.

Error Messages/Logs

Steps to Reproduce

1. Register a SubagentStop hook in user-level ~/.claude/settings.json that logs its raw stdin payload to a file.
2. Work normally in a session. Optionally have more than one session open in the same project folder.
3. Inspect the log. Some events carry a populated agent_id, an empty agent_type, and an agent_transcript_path pointing at a file that was never created.
4. Compare against a real dispatch: those carry a populated agent_type and a transcript that exists.

Not reliably reproducible on demand — observed 13 times in one evening. The transcript-does-not-exist check is the reliable way to tell them apart.

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

1.34493.1

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

evidence-redacted.txt

UPDATE — two further events have occurred since the attached capture was
taken, bringing the total to 15. Both have the same signature: agent_id
populated, agent_type empty, agent_transcript_path pointing at a file that
was never created.

Both fired while only ONE session was open, verified by transcript
modification times across all sessions on the machine. Multiple concurrent
sessions are therefore NOT required to reproduce this.

Message contents of the two newer events were "okay done, submitted it" and
"Silence." — the first being a plausible next user utterance that the user
had not typed.

Also worth noting: the hook that captures these was registered at 22:02 on
2026-08-22, and the first capture arrived minutes later. Before that, no
hook in this workspace matched SubagentStop, so there is no history — these
events may have been firing unobserved for much longer.