Preview tool disclaimer binary strips PATH, breaking Turbopack for nvm users

Bug: Preview tool's disclaimer binary strips PATH, breaking Turbopack and other tools that spawn node

Environment

• Claude Desktop v1.2.234 (macOS, arm64)
• macOS 15 (Darwin 24.6.0)
• Node.js v22.18.0 via nvm
• Next.js 16.2.1 with Turbopack

Description

The Claude Preview tool (preview_start) spawns processes through the disclaimer binary at /Applications/Claude.app/Contents/Helpers/disclaimer. This binary sanitizes the PATH environment variable to only /usr/bin:/bin:/usr/sbin:/sbin, stripping the user's shell PATH entirely.

This causes Turbopack to fail because it internally spawns node as a child process (for PostCSS/CSS processing via its "node pooled process" worker pool). Since node isn't in /usr/bin or /bin (it's managed by nvm at ~/.nvm/versions/node/v22.18.0/bin/node), Turbopack panics with:

spawning node pooled process
No such file or directory (os error 2)

Reproduction

1. Install Node.js via nvm (not system-wide)
2. Create a Next.js 16+ project with Tailwind CSS (uses PostCSS, which triggers Turbopack's node worker pool)
3. Configure .claude/launch.json:

{
  "version": "0.0.1",
  "configurations": [{
    "name": "my-app",
    "runtimeExecutable": "/Users/<user>/.nvm/versions/node/v22.18.0/bin/node",
    "runtimeArgs": ["./node_modules/next/dist/bin/next", "dev"],
    "port": 3000
  }]
}

1. Call preview_start — Next.js starts, but Turbopack crashes when processing CSS

Root cause analysis

Verified by running the disclaimer binary directly:

$ /Applications/Claude.app/Contents/Helpers/disclaimer \
    /Users/charlie/.nvm/versions/node/v22.18.0/bin/node \
    -e "console.log('PATH:', process.env.PATH)"

PATH: /usr/bin:/bin:/usr/sbin:/sbin

The user's actual PATH (~/.nvm/versions/node/v22.18.0/bin:/usr/local/bin:...) is completely stripped. The node binary itself runs fine (it's passed as an absolute path), but any child process it spawns that looks up node via PATH will fail.

This also means /usr/local/bin is excluded, so even sudo ln -sf .../node /usr/local/bin/node doesn't help. And macOS SIP prevents writing to /usr/bin.

Impact

• Affects all nvm users (the most common way to install Node.js on macOS)
• Breaks Turbopack (Next.js default bundler)
• Breaks any dev server tool that spawns node as a subprocess via PATH lookup
• Workaround: --webpack flag, but this is slower and not the project's default bundler

Suggested fix

The disclaimer binary should either:

1. Preserve the parent process's PATH (or at minimum append /usr/local/bin and common nvm paths)
2. Support an env field in launch.json so users can specify PATH overrides
3. Set PATH to include the directory of runtimeExecutable — if the user specifies /Users/x/.nvm/.../bin/node, add /Users/x/.nvm/.../bin to PATH automatically

Option 3 is the most elegant — if you trust the binary enough to execute it, its sibling binaries should be on PATH too.