Bundled Claude Code CLI 2.1.92 fails to start under disclaimer helper (Code tab silently hangs)

Summary

The bundled Claude Code CLI shipped with Claude Desktop (version 2.1.92 on macOS arm64) fails to start when spawned under posix_spawnattr_set_disclaim_np. Since Claude Desktop always runs the Code tab CLI through its own disclaimer helper (which sets that attribute), the Code tab silently hangs — the user sends a message and gets no response.

Reproduction

On an affected machine (macOS Tahoe / Darwin 25.4.0, Apple Silicon):

# Fails — bundled 2.1.92 binary under disclaimer:
/Applications/Claude.app/Contents/Helpers/disclaimer \
  ~/Library/Application\ Support/Claude/claude-code/2.1.92/claude.app/Contents/MacOS/claude \
  --version
# Output: error: An unknown error occurred (Unexpected)
# Exit: 1

# Works — same binary without disclaimer:
~/Library/Application\ Support/Claude/claude-code/2.1.92/claude.app/Contents/MacOS/claude --version
# Output: 2.1.92 (Claude Code)
# Exit: 0

# Works — newer 2.1.101 standalone binary under the same disclaimer:
/Applications/Claude.app/Contents/Helpers/disclaimer \
  ~/.local/share/claude/versions/2.1.101 \
  --version
# Output: 2.1.101 (Claude Code)
# Exit: 0

# Works — sanity check that disclaim itself isn't broken:
/Applications/Claude.app/Contents/Helpers/disclaimer /bin/echo hello
# Output: hello
# Exit: 0

So the bug is specifically in the 2.1.92 bundled CLI's startup code path under a disclaimed spawn. It's fixed by version 2.1.101.

Environment

• macOS Tahoe (Darwin 25.4.0)
• Claude Desktop (latest as of 2026-04-10)
• Bundled CLI version: 2.1.92 (darwin-arm64)
• Apple Silicon (M-series)

Entitlements on 2.1.92 and 2.1.101 are identical (allow-jit, allow-unsigned-executable-memory, disable-library-validation, device.audio-input), so it's not an entitlements regression — it's a runtime bug in 2.1.92.

Impact

Users whose Claude Desktop installation is pinned to the 2.1.92 bundled CLI see the Code tab silently do nothing. A fresh Claude Desktop install (via drag-to-Trash → redownload) still fetches the broken 2.1.92 bundle, so reinstalling doesn't help.

Workaround

Replace the bundled binary with a symlink to any newer CLI that starts correctly under disclaim:

DIR=~/Library/Application\ Support/Claude/claude-code/2.1.92/claude.app/Contents/MacOS
rm "$DIR/claude"
ln -s ~/.local/share/claude/versions/2.1.101 "$DIR/claude"

Symlinking (rather than copying + re-signing) preserves the Developer ID signature, which the disclaimed process requires to initialize — ad-hoc signing the same binary contents doesn't work.

Suggested Fix

Ship a newer bundled CLI (2.1.101+) with Claude Desktop. Alternatively, identify what changed between 2.1.92 and 2.1.101 in CLI startup that made disclaimed spawns work, and cherry-pick the fix into a 2.1.92 point release if that channel is still in use.

Related

Previously filed anthropics/claude-code#46440 based on an incorrect root cause (OPERON_SANDBOXED_NETWORK leak from Electron). That issue should be closed in favor of this one — the env var is not actually set on affected machines, and the real problem is the disclaimed-spawn bug described above.