Prompt suggestions render as ghost text indistinguishable from typed input in scraped/headless terminals — enabled fabricated "user messages" incl. fake approvals

Environment

• Claude Code 2.1.246–2.1.251, macOS (Apple Silicon), running headless inside tmux with --channels plugin:telegram and --permission-mode auto
• Session driven programmatically (Telegram bridge injects messages via tmux send-keys; a watchdog script rescues stuck input by scraping tmux capture-pane -p)

Problem

The prompt-suggestion feature (forked agent, source=prompt_suggestion in debug logs; controlled by promptSuggestionEnabled) renders a model-generated suggested user reply as ghost text on the ❯ input line after turns.

In any headless/automated setup that reads the terminal with tmux capture-pane -p (or similar), styling is stripped, so ghost text is byte-identical to real typed input. Our watchdog script interpreted the suggestion as a stuck human message and submitted it. Because suggestions are generated from full conversation context, they are perfectly plausible replies — over ~2 days this produced 220+ fabricated user messages, including fake approvals ("Yes, go ahead", "go ahead and edit them") that the session then acted on: it edited business documents with invented personal "facts", modified its own watchdog script, and wrote incorrect conclusions into persistent memory. It also produced runaway self-conversation loops (each reply generated a fresh suggestion which was then submitted).

We accept our scraper is the proximate cause — but the hazard pattern is general: default-on, model-authored text rendered inside the input area is indistinguishable from user input to any pane-scraping automation, and Claude Code is increasingly run headless (tmux bridges, bots, CI).

Repro sketch

1. Run claude inside tmux with prompt suggestions enabled (default).
2. Complete any assistant turn that ends in a question.
3. tmux capture-pane -p → the suggested reply appears on the ❯ line with no marker distinguishing it from typed input.
4. Any automation that resubmits "stuck" input turns the suggestion into a real user message.

Requests (any of these would remove the hazard)

1. Emit a machine-readable marker for suggestion text (e.g. a distinct glyph/prefix on the rendered line), so scrapers can filter it.
2. Suppress prompt suggestions automatically when running with --channels / in non-interactive-looking contexts (no recent local keystrokes).
3. Document promptSuggestionEnabled prominently for headless deployments — we only found it by dumping strings from the binary.

Notes

• "feedbackDrafts": "off" looks related by name but is a different subsystem (bug-report drafting) — a docs clarification there would also help.
• Happy to share sanitized transcripts/logs (watchdog log correlating each fabricated submission, last-prompt transcript entries, debug-log prompt_suggestion calls).