Process name in Activity Monitor/ps is the version string (2.1.233), not claude

tl;dr

The installer names the binary after the version, so the version string is the
executable filename. macOS takes the kernel process name from that filename and ignores
argv[0]. Result: every Claude Code process shows up in Activity Monitor, ps -o
ucomm, top, pkill, crash reports, and EDR tooling as 2.1.233.

Fix is a one-line packaging change: put the version in the directory and name the
binary claude.

What happens

$ ps -Ao pid,ucomm | grep 2.1.
26319 2.1.233
27578 2.1.233
27594 2.1.233
36568 2.1.233
36588 2.1.233
37269 2.1.233
37285 2.1.233
39457 2.1.233
39473 2.1.233
85642 2.1.233
85646 2.1.233
85662 2.1.233
85666 2.1.233
93009 2.1.233
93010 2.1.233
13702 2.1.233
26300 2.1.233

$ ps -Ao rss,ucomm | grep '2\.1\.' | awk '{s+=$1; n++} END {print n, s/1024/1024 " GB"}'
16 6.23 GB

Sixteen processes. 6.23 GB resident. Every one of them named after a version number.

Why

The version is the filename, not a directory:

$ ls -la ~/.local/share/claude/versions/
-rwxr-xr-x  1 user  staff  294720528 Aug 13 01:38 2.1.231
-rwxr-xr-x  1 user  staff  306111312 Aug 13 16:31 2.1.232
-rwxr-xr-x  2 user  staff  306981408 Aug 14 15:35 2.1.233

$ file ~/.local/share/claude/versions/2.1.233
Mach-O 64-bit executable arm64

$ ls -la ~/.local/bin/claude
claude -> /Users/user/.local/share/claude/versions/2.1.233

macOS derives p_comm from the executable's filename. argv[0] does not enter into it.

Here is the part that stings. Claude Code ALREADY sets argv[0] well:

$ ps -Ao pid,comm | grep claude
27578 claude bg-pty-host
27594 claude bg-spare
36568 claude bg-pty-host
36588 claude bg-spare

That is good, descriptive, actionable naming. No tool that reads the kernel name will
ever see it. One packaging choice throws away work somebody already did.

Impact

Sort Activity Monitor by memory and you get a stack of identical 2.1.233 rows holding
6 GB. Nothing on screen says what they are, which session owns them, or whether killing
one is safe. You have to drop to a terminal and read full command lines to answer the
exact question Activity Monitor exists to answer.

Everything keyed on process name is broken:

• pkill claude matches nothing.
• Crash reports and sample output are titled with a version number.
• EDR and endpoint security tooling raises alerts naming 2.1.233. The analyst

triaging that alert has no idea what the binary is, and no search that helps.

• The name rotates every release. There is no stable string to allowlist in monitoring,

security policy, or firewall rules. A managed fleet cannot write a durable rule
against a name that changes weekly.

That last one is the real cost. This is not a cosmetic gripe about a tidy process list.
It makes Claude Code unnecessarily expensive to operate on a managed fleet.

Requested changes

1. Put the version in the directory, not the filename.

~/.local/share/claude/versions/2.1.233/claude
~/.local/bin/claude -> ../share/claude/versions/2.1.233/claude

The kernel name becomes claude. Versions still sit side by side, rollback still works,
and Activity Monitor, pkill, crash reports, and security tooling all start working at
once. Installer change only.

2. Give the background roles their own names.

claude beats 2.1.233, but it is still sixteen identical rows. The roles are already
distinct in argv[0]. Make them distinct to the kernel too, by exec'ing each under its
own name or shipping small role binaries:

claude              # interactive session
claude-pty-host     # background pty host
claude-bg-spare     # pre-warmed spare

Then Activity Monitor answers the actual question: what is this, and can I kill it?

Environment

• macOS 15 (Darwin 25.6.0), arm64
• Claude Code 2.1.233, native installer to ~/.local/share/claude/versions/

🤖 Generated with Claude Code