Grep tool broken: vendor/ripgrep not created by install.cjs when ignore-scripts=true in .npmrc

Summary

The Grep tool fails with spawn .../vendor/ripgrep/arm64-darwin/rg ENOENT after a global install when the user's .npmrc has ignore-scripts=true. The install.cjs postinstall script only places the native claude binary — it does not create the vendor/ripgrep/ directory or place an rg binary there, even though the Grep tool expects one at that path.

Environment

• macOS (Darwin 25.3.0, Apple Silicon arm64)
• Node v24.13.1, npm 11.9.0
• Claude Code 2.1.114 (global install via npm install -g @anthropic-ai/claude-code)
• .npmrc has ignore-scripts=true and prefix=~/.npm-global

Steps to reproduce

1. Have ignore-scripts=true in ~/.npmrc
2. npm install -g @anthropic-ai/claude-code
3. Run node ~/.npm-global/lib/node_modules/@anthropic-ai/claude-code/install.cjs manually (since postinstall was skipped)
4. claude --version → works (2.1.114)
5. Use the Grep tool in a Claude Code session → fails:

``
spawn /Users/.../.npm-global/lib/node_modules/@anthropic-ai/claude-code/vendor/ripgrep/arm64-darwin/rg ENOENT
``

What I found

• The native claude binary at node_modules/@anthropic-ai/claude-code-darwin-arm64/claude is a multi-call binary that responds as ripgrep 14.1.1 when invoked as rg (confirmed via copy + rename)
• install.cjs only handles placing the claude binary into bin/claude.exe — it has no code for creating vendor/ripgrep/ or placing an rg copy there
• The Grep tool hardcodes the path vendor/ripgrep/arm64-darwin/rg

Workaround

Manually copy the native binary to the expected vendor path:

mkdir -p ~/.npm-global/lib/node_modules/@anthropic-ai/claude-code/vendor/ripgrep/arm64-darwin
cp ~/.npm-global/lib/node_modules/@anthropic-ai/claude-code/node_modules/@anthropic-ai/claude-code-darwin-arm64/claude \
   ~/.npm-global/lib/node_modules/@anthropic-ai/claude-code/vendor/ripgrep/arm64-darwin/rg

However, this gets wiped every time npm install -g @anthropic-ai/claude-code runs again (npm cleans the package tree and removes files not in the manifest).

Expected behavior

install.cjs should also create vendor/ripgrep/<arch>/rg (or the Grep tool should resolve rg from the platform package directly) so that the Grep tool works after a manual postinstall.

Additional context

• ignore-scripts=true is a recommended security practice — this shouldn't break core tool functionality when combined with the documented manual postinstall workaround
• The user shell also had rg aliased to the vendor path, so system-level ripgrep was also broken