[BUG] Pull requests from four unrelated third-party repositories appear in a local desktop session's state (prs[]) — and are rewritten after deletion

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

Four pull requests belonging to repositories I have never opened, do not own, and cannot even access appeared in the PR widget of a **local** Claude Code desktop session:

- `UpSpeech/upspeech-website` #70 (`feat/human-imagery`, MERGED)
- `hieyashraj/Doolphin` #1 (`fix/documented-cost-ceilings`, OPEN)
- `phassle/DancingGrandma` #96 (`feature/95-fal-error-detail`, OPEN)
- `Emmanuelok/Personality-Tests` #5 (`agent/cinematic-motion-landing`, OPEN)

They are stored in the session state file, in the `prs` array, each entry carrying `prNumber`, `url`, `repo`, `host`, `branch`, `baseRef` and `state`.

**Why this is not stale cache or a corrupted file**

1. The entries carry live GitHub metadata — including `"state":"MERGED"` — which does not exist locally. Something queried GitHub for it.
2. I deleted the `prs` array from the file. It was rewritten with all four entries about an hour later, while the app was running — so the data lives in the running session, not just on disk.
3. Out of 88 saved sessions on this machine, the `prs` field appears in exactly one. So it is not seeded demo data.

**Confirmed local session, no project configuration involved**

- Session ID prefix is `local_`; `cwd` and `worktreePath` both point to my own disk.
- `/.claude/` contains only `worktrees/` — there is no `settings.json`, `settings.local.json`, `.mcp.json` or `config.json`, neither in the repo nor in the worktree.
- Grep across all Claude configuration (project and user level): zero references to those four repositories.
- My only git remote is my own private repository. GitHub confirms I do not even have read-collaborator access to any of the four.

**Environment**

macOS · Claude Code desktop app
Outer session `bf093e97-0074-41b1-9221-728d075f2e6e`
Inner session `local_a6ee621a-cce8-4e74-b366-543db1ee58c1`

**Related but different**

#63516 and #58491 describe `GitHubPrManager` failing to refresh PR state. Here the problem is not staleness — it is that pull requests from other people's repositories are present at all.

I have preserved the original state file and can provide it privately. I have also opened a support conversation (ID 215475606793274).

### What Should Happen?

A local session's `prs[]` should only ever contain pull requests belonging to repositories opened in that session (or reachable from its git remotes). It should never contain pull requests from third-party repositories the user has no relationship with — and deleting them from the state file should not result in them being written back.

### Error Messages/Logs

```shell
The `prs` array as found in the session state file (formatted for readability):

"prs":[
{"prNumber":70,"url":"https://github.com/UpSpeech/upspeech-website/pull/70","repo":"UpSpeech/upspeech-website","host":"github.com","branch":"feat/human-imagery","baseRef":"main","state":"MERGED"},
{"prNumber":1,"url":"https://github.com/hieyashraj/Doolphin/pull/1","repo":"hieyashraj/Doolphin","host":"github.com","branch":"fix/documented-cost-ceilings","baseRef":"main","state":"OPEN"},
{"prNumber":96,"url":"https://github.com/phassle/DancingGrandma/pull/96","repo":"phassle/DancingGrandma","host":"github.com","branch":"feature/95-fal-error-detail","baseRef":"develop","state":"OPEN"},
{"prNumber":5,"url":"https://github.com/Emmanuelok/Personality-Tests/pull/5","repo":"Emmanuelok/Personality-Tests","host":"github.com","branch":"agent/cinematic-motion-landing","state":"OPEN"}
]

For contrast, in the same file:
"writtenBranches":["claude/scenario-exercise-library-c9c57f"] <- my own branch, correct
"cwd":"/Users///.claude/worktrees/" <- my own disk, correct

No credentials of any kind are present in the file; I verified that before preserving it.
```

### Steps to Reproduce

I cannot reproduce it on demand — it appeared on its own in one long-running local session. What can be verified, on my machine, is the state:

1. Open the desktop app on a local project (no `.claude/settings.json`, no `.mcp.json`, single git remote pointing at my own private repository).
2. Look at the PR widget: four pull requests from repositories I have no relationship with are listed.
3. Inspect the session state file:
`~/Library/Application Support/Claude/claude-code-sessions///local_.json`
The `prs` array contains all four, with live GitHub fields.
4. Delete the `prs` array from the file while the app is running.
5. Wait — the array is written back with the same four entries (observed roughly an hour later, at the next state save).
6. `grep -rl '"prs":\[' claude-code-sessions/` → 1 file out of 88 sessions.

Environment checks that came back negative: no project settings files exist; no Claude configuration references those repositories; `gh api repos///collaborators/` returns "Must have push access to view repository collaborators" for all four, i.e. I am not even a collaborator.

### Claude Model

None

### Is this a regression?

I don't know

### Last Working Version

_No response_

### Claude Code Version

2.1.92 (Claude Code) — desktop app 1.34493.1

### Platform

Anthropic API

### Operating System

macOS

### Terminal/Shell

Terminal.app (macOS)

### Additional Information

I have not modified anything in the app; the session had been running for a long time (217 completed turns) on a normal local project.

Two details that may help narrow the source:

- The four pull requests are recent, unrelated to each other, and belong to four different owners. Three are OPEN, one is MERGED — so whatever produced the list had current GitHub state for each.
- The list survived deletion from disk, which suggests it lives in the running session object rather than only in the persisted file.

If it is useful, I can share the preserved state file privately (support conversation 215475606793274). I would rather not attach it publicly, since it contains my local paths and the list of connectors I use.

Screenshot of the widget as it appears in my session:

Start with the PR widget, GitHubPrManager references from issues #63516 and #58491, and the local session state path containing the prs array. Trace how PR metadata is populated and rewritten during state saves, using the preserved state file if available. Done means unrelated repositories are excluded and deleting prs entries does not restore them.

Rédigé par le modèle d'indexation à partir du texte de l'issue.