DA1 terminal query-reply leaks into the shell after subcommands exit
Environment
- Claude Code 2.1.238
- macOS 26.6.1 (25G76)
- iTerm2 3.6.11,
TERM=xterm-256color, zsh tuiunset in~/.claude/settings.jsonand.claude/settings.local.json
What happens
claude mcp remove queries the terminal for device attributes and exits before reading the reply. The reply lands in the shell as typed input and runs.
Repro
Run claude mcp remove <name> --scope local from an interactive zsh prompt.
Actual
Removed MCP server <name> from local config
➜ repo-a git:(<branch>) ✗ 64;1;2;4;6;17;18;21;22c
zsh: command not found: 64
~/dev/src/github.com/org/repo-b
~/dev/src/github.com/org/repo-c
cd: no such entry in dir stack
cd: no such entry in dir stack
zsh: command not found: 17
zsh: command not found: 18
zsh: command not found: 21
zsh: command not found: 22c
➜ repo-c git:(<branch>) ✗
64;1;2;4;6;17;18;21;22c is a DA1 reply. zsh splits it on ; and runs each part. The numeric parts hit zsh's directory-stack shortcuts.
Impact
The shell ended up in a different repository. The next command typed would have run in the wrong directory. Happened on both claude mcp remove runs.
<details>
<summary>Relationship to #75482</summary>
#75482 reported the same leak and was closed as NOT_PLANNED on 2026-08-24. It was scoped to "tui": "fullscreen" on 2.1.203 via claude plugin marketplace list.
This reproduces with tui unset, on 2.1.238, via claude mcp remove.
</details>