No way to report a bug from the desktop app: /bug is terminal-only, and attaching the affected session requires --resume

Problem

There is no way to report a bug from the Claude Code desktop app. /bug is a terminal-only command, so reporting a defect you just hit in the desktop client means: leave the app, open Terminal, cd to the project, launch claude, and start a new session that contains none of the context you are trying to report on.

To attach the session where the bug actually happened you have to claude --resume and pick it from a list — which you cannot safely do while that session is open in the desktop app, because two clients then share one session.

So the practical choices after hitting a bug in the desktop app are:

1. Report it from a fresh terminal session that has no evidence in it, or
2. Close the desktop session you are working in, resume it in a terminal, and report from there, or
3. Write it up by hand as a GitHub issue.

All three are worse than a button.

Why this matters more than general friction

We hit a credential-disclosure defect (#95680) where the agent's own tool calls wrote six live API tokens into on-disk transcripts — one of them into 83 files. That is exactly the class of bug where you want the report filed immediately, with the real session attached, by the person who just watched it happen.

Instead the reporting path asked us to switch applications and start over. We filed on GitHub by hand, which only worked because an agent was there to do the writing. A human on their own, mid-incident, would reasonably have skipped it — and Anthropic would never have learned about it.

There is a second trap in the same flow: /bug defaults to attaching the session transcript, and after a leak that transcript is the artifact holding the secrets (#93138). So the correct sequence is "rotate every exposed credential first, then report" — which is both non-obvious and guarantees the report arrives late, long after the details have gone cold.

What would fix it

• A report control in the desktop app. Right-click a message, or a menu item — anything that files from where the bug happened, with that session attached.
• Let /bug target a session other than the current one, so reporting does not require resuming and does not conflict with an open client.
• Warn before attaching a transcript that contains high-entropy strings, and default the attachment off for that submission. Same detector #95680 asks for, applied at the submit boundary.
• At minimum, document the path from the desktop app, including the --resume conflict. Today you have to work it out yourself.

Environment

Claude Code in the Claude Desktop app (Code tab), macOS. Reported via GitHub because the in-product path was not usable from where the bug occurred — which is the request.