claude-code - 💡(How to fix) Fix postinstall strips Mach-O code signature on darwin-arm64 → macOS SIGKILLs claude on launch [2 comments, 3 participants]

Environment

• macOS Darwin 25.2.0 (Apple Silicon, arm64)
• Node v20.19.6, npm global install via Homebrew prefix (`/opt/homebrew/lib/node_modules`)
• Claude Code installed globally: `@anthropic-ai/claude-code`

Symptom

After an auto-update, `claude` is killed immediately on launch:

``` ~ ❯ claude [1] 90529 killed claude ```

Root cause (diagnosed)

The native binary at `@anthropic-ai/claude-code/bin/claude.exe` loses its code signature during the postinstall. macOS kernel then SIGKILLs it on exec.

``` $ codesign -dv /opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe ...: code object is not signed at all ```

The platform-native package under `node_modules/@anthropic-ai/claude-code-darwin-arm64/` kept its signed copy:

``` $ codesign -dv .../claude-code-darwin-arm64/claude Identifier=com.anthropic.claude-code Format=Mach-O thin (arm64) CodeDirectory v=20500 size=1654533 flags=0x10000(runtime) Signature size=9046 ```

So the signature exists on the source binary but is missing on the destination after `install.cjs` writes it to `bin/claude.exe`.

On this install the postinstall had also left `bin/claude.exe` as the ASCII fallback stub ("Native package … not found"), because the `package.json` of `claude-code-darwin-arm64` was missing from `node_modules` (only the `claude` binary remained). `require.resolve('@anthropic-ai/claude-code-darwin-arm64/package.json')` in `install.cjs:144` then failed, so the real binary was never copied at all. A retained staging copy at `@anthropic-ai/.claude-code-*/` had the complete package.

Reproduction sketch

1. Fresh `npm i -g @anthropic-ai/claude-code` on Apple Silicon.
2. Trigger an auto-update (or any subsequent upgrade).
3. Observe that `bin/claude.exe` is either (a) the ASCII fallback stub, or (b) a Mach-O binary that reports "not signed at all" to `codesign -dv`.
4. `claude` → SIGKILL.

Manual fix that worked

```bash src=/opt/homebrew/lib/node_modules/@anthropic-ai/.claude-code-<hash>/node_modules/@anthropic-ai/claude-code-darwin-arm64/claude dst=/opt/homebrew/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe rm -f "$dst" && /bin/cp "$src" "$dst" && chmod +x "$dst" codesign -dv "$dst" # signature preserved ```

Suggested fixes

1. Preserve code signatures: `install.cjs` should use a copy method that preserves extended attributes and code signing (e.g. `fs.copyFileSync` with COPYFILE_FICLONE, or `cp -c` via spawn). If the current impl does a `fs.writeFileSync(fs.readFileSync(...))` round-trip, that loses the signature.
2. Ad-hoc re-sign as a fallback: if signature preservation isn't feasible across copy paths, have the postinstall do `codesign --force --sign - <dst>` after the copy on darwin. Ad-hoc signing is enough to stop the kernel killing it.
3. Verify after install: add a `codesign -v` check at the end of `install.cjs` on darwin and bail loudly if the destination is unsigned, instead of leaving the user with a silently-broken install.
4. Preserve package.json when overwriting optional dep dirs: something in the upgrade path stripped `package.json`/`LICENSE`/`README` from `claude-code-darwin-arm64`, which was the original reason `install.cjs` fell back to the stub. Worth investigating whether an atomic rename vs file-by-file overwrite would help.

Happy to test patches against my env if useful.