Auto-updater: two concurrent sessions race on the npm-global install and delete the claude package (dangling symlink, 'command not found')

Environment: Claude Code 2.1.266, npm-global install (npm install -g @anthropic-ai/claude-code) under Homebrew node; npm 11.12.1; Node 25.9.0; macOS 26.x (Darwin 25.6.0), Apple Silicon.

What happened
Two Claude Code sessions launched ~90 ms apart (one interactive session in one project dir, one
in another dir with a different CLAUDE_CONFIG_DIR). Each started its own background auto-update:
npm install --global @anthropic-ai/claude-code@2.1.266. Both npm runs "retired" the live package
dir to the same temp path (/opt/homebrew/lib/node_modules/@anthropic-ai/.claude-code-2DTsDk1V).
One run ended with error process terminated / error signal SIGHUP / exit 1; the other logged
exit 0 / info ok. Afterward /opt/homebrew/lib/node_modules/@anthropic-ai/ was empty and
/opt/homebrew/bin/claude was a dangling symlink, so every new shell got
claude: command not found until a manual npm install -g @anthropic-ai/claude-code@2.1.266.

Expected
The updater should take a lock (or skip when another update is already in flight) so two
concurrent sessions cannot clobber the shared global install.

Repro

1. npm-global install of Claude Code, auto-updates enabled, a newer version available.
2. Start two claude sessions at the same moment (e.g. a shell alias in one terminal while

another session boots).

1. Observe two npm install --global debug logs with near-identical timestamps in ~/.npm/_logs/

and a missing package dir afterward.

Evidence

• ~/.npm/_logs/2026-09-09T14_02_34_904Z-debug-0.log and …14_02_34_992Z-debug-0.log

(both install --global @anthropic-ai/claude-code@2.1.266); preceding
npm view @anthropic-ai/claude-code@latest version --prefer-online log at 14_02_33.

• Symlink mtime 07:05:03 PDT; reinstall 07:08.
• npm v11.12.1, Node v25.9.0, macOS Darwin 25.6.0 (Apple Silicon), Claude Code 2.1.266.