[BUG] Auto-update silently installs a broken 500-byte stub when npm allowScripts blocks the postinstall

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?

On a machine where npm's allowScripts policy blocks lifecycle scripts, npm install -g @anthropic-ai/claude-code exits 0 but leaves bin/claude.exe as the 500-byte placeholder stub. The native binary is never put in place, so the CLI is dead.

Auto-update reproduces this on every run, so the install repairs and re-breaks itself indefinitely.

The Windows symptom is misleading. PowerShell reports:

Program 'claude.exe' failed to run: The specified executable is not a valid application for this OS platform.
At C:\Users\<user>\AppData\Local\hermes\node\claude.ps1:14 char:3

That reads as an architecture mismatch and sends you looking in entirely the wrong place. It took several wrong diagnoses before I found the real cause in the stub's own text.

Note this is not --ignore-scripts or --omit=optional user error (as in #50609, closed as not-planned). No flags were passed. The policy is npm's, doing exactly what it is meant to do.

What Should Happen?

Either the install fails loudly when postinstall cannot run, or the binary does not depend on a lifecycle script at all.

The platform binary is already a resolved optionalDependency:

"optionalDependencies": {
  "@anthropic-ai/claude-code-win32-x64": "2.1.222",
  ...
}

npm installs those without running any script. If bin/claude.exe resolved that package directly instead of relying on postinstall: node install.cjs to copy it, this class of failure disappears. That would also close the interrupted-update path in #84051, which reaches the same broken state by a different route.

Exiting 0 with a non-functional binary is the core problem. A blocked postinstall is a known, anticipated condition (the stub's own text names it), so it should not produce a "successful" install.

Error Messages/Logs

npm warn install-scripts 1 package had install scripts blocked because they are not covered by allowScripts:
npm warn install-scripts   @anthropic-ai/claude-code@2.1.221 (postinstall: node install.cjs)
npm warn install-scripts
npm warn install-scripts Run `npm install -g --allow-scripts=@anthropic-ai/claude-code` to allow these scripts once

changed 2 packages in 20s

Contents of the resulting bin/claude.exe (500 bytes):

echo "Error: claude native binary not installed." >&2
echo "Either postinstall did not run (--ignore-scripts, some pnpm configs)" >&2

Healthy binary is 279,014,048 bytes. Broken is 500.

Steps to Reproduce

1. On Windows with npm configured so allowScripts does not cover this package (no flags passed by the user)
2. npm install -g @anthropic-ai/claude-code@latest
3. Install completes, exit 0, warning only
4. claude fails with the OS-platform error above
5. Repair with npm install -g --allow-scripts=@anthropic-ai/claude-code @anthropic-ai/claude-code@latest
6. Wait for auto-update to run. It breaks again identically.

I observed step 6 directly: a manual repair to 2.1.221, then auto-update to 2.1.222 at 12:37, stub back with package.json sharing that timestamp.

Workaround, scoped to this package only:

npm config set allow-scripts=@anthropic-ai/claude-code --location=user

Is this a regression?

Unknown. The stub mechanism predates my install.

Version

2.1.222 (also seen on 2.1.221). Windows 11, npm global prefix outside Program Files.

Related: #84051 reaches the same broken state via an interrupted update rather than a blocked script.