Bundled native addon (image_processor .node) unsigned -- hard-blocked under Windows Smart App Control enforcement, no user workaround

Summary

The bundled native image-processing addon (image_processor.dll, extracted at runtime as %TEMP%\.<hash>-0.node) ships unsigned, while the parent claude.exe is validly signed. On Windows machines with Smart App Control in enforcement mode, this addon is hard-blocked with no click-through override, silently degrading or disabling image handling (pasted screenshots) with no workaround available to the user.

Environment

• Claude Code version: 2.1.212
• OS: Windows 11 Home, build 26200
• Windows Smart App Control: enforcement mode (HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy!VerifiedAndReputablePolicyState = 1)

Root cause

claude.exe is a single-file bundle. At startup it extracts a native napi-rs-compiled addon to %TEMP% (observed as .dafaf7ffe6d75a6f-0.node this session, 1,513,984 bytes, SHA256 47C03A4E8ED0AE4452320302F7FFABF7B82AA0ED6FB41CCD565C9B7846AB15EE) because a bundled executable cannot dlopen/require a native addon from inside itself -- it must land on disk first.

That extracted file carries no Authenticode signature:

Get-AuthenticodeSignature claude.exe        -> Status: Valid
  Signer: CN="Anthropic, PBC", issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
  Valid: 2025-10-14 to 2026-10-21

Get-AuthenticodeSignature .dafaf7ffe6d75a6f-0.node  -> Status: NotSigned

Windows Smart App Control evaluates each executed binary independently against Microsoft's cloud reputation and signing verdict -- it does not inherit trust from the parent process, and does not honor the zone-identifier-based override (Unblock-File) that classic SmartScreen accepts. Because this file is re-extracted fresh (and, per its randomized filename, potentially re-hashed) on every run, it cannot accumulate the reputation an unsigned-but-frequently-run binary might otherwise build over time.

Reproduction

1. Enable Smart App Control (enforcement mode) on Windows 11.
2. Run Claude Code and paste an image into a prompt.
3. Windows Security raises: "此應用程式一部分已封鎖" (part of this application has been blocked) naming the extracted .node file as unverified.
4. No "run anyway" option is offered. The addon does not execute.

Impact

• Confirmed native module: ImageProcessor (embeds png/webp decode via Rust crates), used for handling pasted image input.
• On any machine with Smart App Control enforced, this functionality is either disabled or silently falls back to a degraded path -- we could not confirm from the client side which, since Claude Code gives no visible error when the block occurs.
• No user-side remedy exists: Unblock-File does not apply, no override prompt is shown, and disabling Smart App Control is a one-way change (Microsoft: cannot be re-enabled without a clean OS reinstall). This is a meaningfully higher cost than the classic-SmartScreen case, where a user could at least click through.

Suggested fix

Sign the extracted native addon(s) with the same certificate used for claude.exe, or sign them at build time before bundling so the on-disk artifact carries a valid Authenticode signature identical in trust chain to the parent executable. This is the only remedy that resolves the issue under Smart App Control enforcement, since neither user action nor reputation accrual is available as a workaround.