claudeup 6.8.0 → 6.8.1

package/bin/claudeup.js

@@ -11,6 +11,9 @@
  * path. That escape hatch exists because the launcher PREFERS the binary: when
  * a shipped binary cannot start on a given machine, without it claudeup is a
  * hard block rather than a slow start.
+ *
+ * This file must stay self-contained and import only node: builtins. Its tests
+ * copy it into a throwaway tree, where any relative import would not resolve.
  */
 
 import { spawnSync } from "node:child_process";
@@ -18,11 +21,46 @@ import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 import { existsSync } from "node:fs";
+import { constants } from "node:os";
 
 const require = createRequire(import.meta.url);
 const args = process.argv.slice(2);
 const { platform, arch } = process;
 
+const ISSUES_URL = "https://github.com/MadAppGang/magus/issues";
+
+/**
+ * The four signals a person sends on purpose. Everything else is a crash.
+ *
+ * The rule is deliberately inverted from the obvious one. An allowlist of
+ * crash signals leaves holes: SIGABRT is what a Bun/JSC panic raises, which is
+ * exactly the "this binary is broken, use source" case, and it would fall
+ * through the allowlist into the old masked path.
+ */
+const USER_SIGNALS = new Set(["SIGINT", "SIGTERM", "SIGHUP", "SIGQUIT"]);
+
+/**
+ * How long after exec a crash still counts as "it never started".
+ *
+ * An invalid code signature kills the binary in single-digit milliseconds, at
+ * exec, before any output. A `kill -9` against a running TUI, or an OOM kill,
+ * lands seconds later. Without this gate the fix would trade a silent exit 0
+ * for a surprise relaunch of an app the user deliberately killed.
+ */
+const CRASH_FALLBACK_WINDOW_MS = 2000;
+
+/** Shell convention: a signal death is 128 + the signal number. */
+function exitCodeForSignal(signal) {
+	const number = constants.signals[signal];
+	return typeof number === "number" ? 128 + number : 1;
+}
+
+// Set when a binary was found and tried but could not deliver a result. It
+// changes what the source path says if IT then fails: "no prebuilt binary for
+// this platform" is true when none was installed and a flat contradiction when
+// one was just reported as killed.
+let binaryFailed = false;
+
 // 1. Prefer the prebuilt platform binary, unless the source path is forced.
 const forceSource = process.env.CLAUDEUP_NO_BINARY === "1";
 const pkgName = `claudeup-${platform}-${arch}`;
@@ -36,15 +74,53 @@ try {
 }
 
 if (binaryPath && !forceSource) {
+	const startedAt = Date.now();
 	const result = spawnSync(binaryPath, args, { stdio: "inherit" });
-	// A binary that could not be executed AT ALL (ENOENT, EACCES, bad arch)
-	// leaves status null, and `status ?? 0` then reported SUCCESS for a run that
-	// never happened — the worst answer available. Only trust the status when the
-	// process actually ran; otherwise say so and fall through to the source path.
-	if (!result.error) process.exit(result.status ?? 0);
-	console.error(
-		`claudeup: prebuilt binary could not start (${result.error.message}); falling back to source.`,
-	);
+	const elapsedMs = Date.now() - startedAt;
+
+	if (!result.error) {
+		// `status === null` is the authoritative "did not exit normally" marker,
+		// NOT the truthiness of `signal`. Node writes an empty string into
+		// `signal` for a signal it has no name for (Linux real-time signals,
+		// SIGRTMIN+n), and "" is falsy — so branching on the signal would fall
+		// straight back into the `status ?? 0` this release exists to remove.
+		if (result.status !== null) process.exit(result.status);
+
+		const signalName = result.signal || "an unnamed signal";
+		const deliberate =
+			USER_SIGNALS.has(result.signal) ||
+			elapsedMs >= CRASH_FALLBACK_WINDOW_MS;
+		if (deliberate) process.exit(exitCodeForSignal(result.signal));
+
+		binaryFailed = true;
+		// The elapsed time is measured; "before producing any output" is not —
+		// the child ran under stdio: "inherit", so this process never saw its
+		// output and must not claim there was none.
+		console.error(
+			`claudeup: the prebuilt binary was killed by ${signalName} ${elapsedMs}ms after it started.\n` +
+				"\n" +
+				`  binary:   ${binaryPath}\n` +
+				`  platform: ${platform}-${arch}\n` +
+				"\n" +
+				"On macOS this almost always means the binary's code signature is invalid and the\n" +
+				"kernel refused to run it. Confirm with:\n" +
+				"\n" +
+				`  codesign --verify --strict "${binaryPath}"\n` +
+				"\n" +
+				"Falling back to running from source via Bun. To skip the binary permanently:\n" +
+				"  export CLAUDEUP_NO_BINARY=1\n" +
+				"\n" +
+				`Please report this: ${ISSUES_URL}`,
+		);
+		// fall through to the source path
+	} else {
+		// A binary that could not be executed AT ALL (ENOENT, EACCES, bad arch)
+		// also leaves status null. Say so and fall through.
+		binaryFailed = true;
+		console.error(
+			`claudeup: prebuilt binary could not start (${result.error.message}); falling back to source.`,
+		);
+	}
 }
 
 // 2. Fallback: run from source via Bun.
@@ -57,10 +133,38 @@ const bunRun = spawnSync("bun", ["--no-env-file", mainSrc, ...args], {
 	stdio: "inherit",
 });
 if (bunRun.error) {
+	// Two different states reach here, and one message for both is a lie in one
+	// of them. A user who installed claudeup from npm on macOS 27 and has no
+	// Bun hits the FIRST branch — telling them no binary exists for their
+	// platform contradicts the diagnostic printed seconds earlier, and
+	// "use a supported platform" is advice for a problem they do not have.
+	if (binaryFailed) {
+		console.error(
+			`claudeup: the prebuilt binary for ${platform}-${arch} is unusable on this machine, and Bun is not installed to fall back to.\n` +
+				"\n" +
+				"Reinstall to pick up a working binary:\n" +
+				"  npm install -g claudeup@latest\n" +
+				"\n" +
+				"Or install Bun (https://bun.sh) so the source path can run.\n" +
+				`Please report this: ${ISSUES_URL}`,
+		);
+	} else {
+		console.error(
+			`claudeup: no prebuilt binary for ${platform}-${arch}, and Bun is not installed.`,
+		);
+		console.error("Install Bun (https://bun.sh) or use a supported platform.");
+	}
+	process.exit(1);
+}
+// Same masking bug, second site, keyed the same way: `status === null` decides,
+// not the signal. There is no binary here and nowhere left to fall back to, so
+// this reports and exits — no codesign hint, which would be nonsense for a Bun
+// crash.
+if (bunRun.status !== null) process.exit(bunRun.status);
+if (!USER_SIGNALS.has(bunRun.signal)) {
 	console.error(
-		`claudeup: no prebuilt binary for ${platform}-${arch}, and Bun is not installed.`,
+		`claudeup: running from source was killed by ${bunRun.signal || "an unnamed signal"}.\n` +
+			`Please report this: ${ISSUES_URL}`,
 	);
-	console.error("Install Bun (https://bun.sh) or use a supported platform.");
-	process.exit(1);
 }
-process.exit(bunRun.status ?? 0);
+process.exit(exitCodeForSignal(bunRun.signal));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudeup",
-  "version": "6.8.0",
+  "version": "6.8.1",
   "description": "TUI tool for managing Claude Code plugins, MCPs, and configuration",
   "type": "module",
   "main": "src/main.tsx",
@@ -64,8 +64,8 @@
     "typescript": "^5.6.3"
   },
   "optionalDependencies": {
-    "claudeup-darwin-arm64": "6.8.0",
-    "claudeup-darwin-x64": "6.8.0",
-    "claudeup-linux-x64": "6.8.0"
+    "claudeup-darwin-arm64": "6.8.1",
+    "claudeup-darwin-x64": "6.8.1",
+    "claudeup-linux-x64": "6.8.1"
   }
 }

package/scripts/build-binaries.ts

@@ -15,6 +15,10 @@
  *
  * Hard constraint: claudeup pins @opentui 0.1.x — 0.4.x breaks --compile.
  *
+ * Hard constraint: every darwin binary is re-signed and verified here. The
+ * signature --compile leaves behind does not cover the appended bundle, and
+ * macOS 27 kills such a binary at exec. See src/services/binary-signing.ts.
+ *
  * Hard constraint: the two --no-compile-autoload flags below must stay. A Bun
  * standalone executable autoloads .env and bunfig.toml from its CURRENT
  * DIRECTORY by default, and claudeup reads neither on purpose. Bun 1.4.0 dies
@@ -30,6 +34,7 @@ import { $ } from "bun";
 import { mkdir, writeFile, rm } from "node:fs/promises";
 import path from "node:path";
 import pkg from "../package.json";
+import { signAndVerify } from "../src/services/binary-signing.js";
 
 interface Target {
 	os: "darwin" | "linux";
@@ -51,7 +56,11 @@ const entry = path.join(root, "src", "main.tsx");
 // Optional filter: `bun scripts/build-binaries.ts darwin-arm64`
 const only = process.argv[2];
 
-await rm(distRoot, { recursive: true, force: true });
+// Only a full build purges the whole tree. Scoping a filtered build to its own
+// target means `build:binaries linux-x64` on a Linux host does not first wipe
+// dist-binaries/ and then throw on the darwin guard below, leaving the user
+// with neither the old output nor the one target they could actually build.
+if (!only) await rm(distRoot, { recursive: true, force: true });
 
 for (const t of TARGETS) {
 	const id = `${t.os}-${t.cpu}`;
@@ -60,12 +69,28 @@ for (const t of TARGETS) {
 	const pkgName = `claudeup-${id}`;
 	const outDir = path.join(distRoot, pkgName);
 	const binPath = path.join(outDir, "bin", "claudeup");
+
+	// `codesign` is macOS-only, and an unsigned darwin binary is killed at exec
+	// by macOS 27. Building one anywhere else produces an artifact that cannot
+	// be gated, which is precisely how the broken binaries shipped.
+	if (t.os === "darwin" && process.platform !== "darwin") {
+		throw new Error(
+			`Cannot build ${pkgName} on ${process.platform}: darwin binaries must be signed, and codesign exists only on macOS. Build this target on a macOS runner, or name a buildable one: bun run build:binaries linux-x64`,
+		);
+	}
+
+	await rm(outDir, { recursive: true, force: true });
 	await mkdir(path.join(outDir, "bin"), { recursive: true });
 
 	console.log(`Building ${pkgName} (${t.bunTarget})…`);
 	// The --no-compile-autoload flags are load-bearing; see the header.
 	await $`bun build --compile --no-compile-autoload-dotenv --no-compile-autoload-bunfig --target=${t.bunTarget} ${entry} --outfile ${binPath}`;
 
+	// --compile signs the Mach-O, then appends the bundle after it, leaving a
+	// signature that does not cover the file. Re-sign and refuse to continue if
+	// the result does not verify.
+	signAndVerify(t, binPath);
+
 	// Platform package: os/cpu-restricted, ships only the binary, declares NO
 	// `bin` (the main package's launcher resolves and execs bin/claudeup).
 	const platformPkg = {

package/src/__tests__/binary-signing.test.ts

@@ -0,0 +1,120 @@
+/**
+ * `services/binary-signing.ts` — the build-time code-signing gate.
+ *
+ * Why this exists at all: `bun build --compile` emits an ad-hoc,
+ * linker-signed Mach-O and then appends the JavaScript bundle to it. The
+ * signature therefore does not cover the file it ships in. `codesign -v`
+ * reported "code or signature have been modified" on every published claudeup
+ * back to 4.22.0. macOS 27 kills such a binary at exec, with no output, which
+ * is what broke 4.40.0 onward.
+ *
+ * The decision logic lives in `src/` rather than in `scripts/build-binaries.ts`
+ * for one blunt reason: `scripts/test-isolated.ts` only walks `src/`, so a test
+ * placed beside the build script would never be collected and would report
+ * nothing at all.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
+import { appendFileSync, copyFileSync, mkdtempSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+	type Run,
+	needsSigning,
+	signAndVerify,
+} from "../services/binary-signing.js";
+
+/** Records every command instead of running one. */
+function recorder(status = 0) {
+	const calls: Array<[string, string[]]> = [];
+	const run: Run = (cmd, args) => {
+		calls.push([cmd, args]);
+		return { status, stderr: "" };
+	};
+	return { calls, run };
+}
+
+describe("binary-signing", () => {
+	test("T-sign-1: a darwin target is signed ad-hoc, then verified", () => {
+		const { calls, run } = recorder();
+		signAndVerify({ os: "darwin" }, "/out/bin/claudeup", run);
+
+		// Ad-hoc (`--sign -`), not Developer ID: npm-installed files are not
+		// quarantined, so the kernel signature check is the only failing gate.
+		// No Apple account, no CI secrets, no notarization wait.
+		expect(calls).toEqual([
+			["codesign", ["--force", "--sign", "-", "/out/bin/claudeup"]],
+			["codesign", ["--verify", "--strict", "/out/bin/claudeup"]],
+		]);
+	});
+
+	test("T-sign-2: a failing codesign is a hard gate, not a warning", () => {
+		// A release that ships an unverifiable binary is the whole defect. The
+		// build must stop, not print and continue.
+		const signFails: Run = (_cmd, args) =>
+			args[0] === "--force"
+				? { status: 1, stderr: "sign failed" }
+				: { status: 0, stderr: "" };
+		expect(() =>
+			signAndVerify({ os: "darwin" }, "/out/bin/claudeup", signFails),
+		).toThrow();
+
+		const verifyFails: Run = (_cmd, args) =>
+			args[0] === "--verify"
+				? { status: 1, stderr: "verify failed" }
+				: { status: 0, stderr: "" };
+		expect(() =>
+			signAndVerify({ os: "darwin" }, "/out/bin/claudeup", verifyFails),
+		).toThrow();
+	});
+
+	test("T-sign-3: a linux target runs no codesign at all", () => {
+		// `codesign` does not exist off macOS. Running it would fail the linux
+		// leg of the release matrix for no reason.
+		expect(needsSigning({ os: "linux" })).toBe(false);
+		expect(needsSigning({ os: "darwin" })).toBe(true);
+
+		const { calls, run } = recorder();
+		signAndVerify({ os: "linux" }, "/out/bin/claudeup", run);
+		expect(calls).toEqual([]);
+	});
+
+	// darwin-only: the subject is the macOS signature format itself. skipIf, not
+	// a bare early return — both CI jobs run on ubuntu, where a return would
+	// execute zero assertions and report green. The macOS coverage of this
+	// invariant in CI comes from the release matrix, which runs the real
+	// signAndVerify during `build:binaries` on both darwin legs.
+	test.skipIf(process.platform !== "darwin")(
+		"T-sign-4: real codesign rejects a signed file with bytes appended",
+		() => {
+			const dir = mkdtempSync(path.join(os.tmpdir(), "claudeup-signing-"));
+			try {
+				const subject = path.join(dir, "subject");
+				copyFileSync("/bin/echo", subject);
+
+				// Positive control. Without it a passing T-sign-4 would prove only
+				// that codesign fails on this machine for some unrelated reason.
+				expect(() => signAndVerify({ os: "darwin" }, subject)).not.toThrow();
+
+				// Exactly what `bun build --compile` does: append the bundle after
+				// the signature has been written.
+				appendFileSync(subject, "appended-bundle-bytes");
+
+				// Skip the re-sign so the REAL verify judges the corrupted file.
+				const verifyForReal: Run = (cmd, args) => {
+					if (args.includes("--sign")) return { status: 0, stderr: "" };
+					const r = spawnSync(cmd, args, { encoding: "utf8" });
+					return { status: r.status, stderr: r.stderr ?? "" };
+				};
+				// Assert on throwing only. codesign's wording moves between macOS
+				// releases; the verdict does not.
+				expect(() =>
+					signAndVerify({ os: "darwin" }, subject, verifyForReal),
+				).toThrow();
+			} finally {
+				rmSync(dir, { recursive: true, force: true });
+			}
+		},
+	);
+});

package/src/__tests__/launcher-signal.test.ts

@@ -0,0 +1,314 @@
+/**
+ * `bin/claudeup.js` — what the launcher does when the prebuilt binary dies.
+ *
+ * The defect these tests pin: a process killed by a signal leaves
+ * `{status: null, signal: "SIGKILL", error: undefined}`. The launcher's guard
+ * read `error` only, so `status ?? 0` turned every signal death into exit 0.
+ * On macOS 27 an invalid code signature kills the binary at exec, so claudeup
+ * 4.40.0 through 6.8.0 printed nothing and reported success.
+ *
+ * The tests drive the real launcher inside a throwaway tree that mirrors the
+ * npm install layout:
+ *
+ *   <tmp>/package.json                                     ({"type":"module"})
+ *   <tmp>/bin/claudeup.js                                  (a copy of the real file)
+ *   <tmp>/src/main.tsx                                     (stub source path)
+ *   <tmp>/node_modules/claudeup-<plat>-<arch>/bin/claudeup (stub binary)
+ *
+ * `createRequire` inside the copy walks up from <tmp>/bin, so it can never
+ * reach this repo's own installed claudeup-darwin-arm64. That is why the tree
+ * is built rather than NODE_PATH set: NODE_PATH is consulted only AFTER the
+ * node_modules walk fails, so a dev with the real optionalDependency installed
+ * would silently test the shipped binary instead of the stub.
+ *
+ * Each stub appends one line to $CLAUDEUP_TEST_LEDGER. A ledger file gives
+ * ordering and argv forwarding, which an inherited stdio stream cannot. The
+ * source stub's exit code 7 is a value the masked path can never produce, so
+ * `status === 7` alone separates "fell back" from "pretended to succeed".
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
+import {
+	chmodSync,
+	cpSync,
+	existsSync,
+	mkdirSync,
+	mkdtempSync,
+	readFileSync,
+	realpathSync,
+	rmSync,
+	writeFileSync,
+} from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const REAL_LAUNCHER = path.join(
+	import.meta.dir,
+	"..",
+	"..",
+	"bin",
+	"claudeup.js",
+);
+const PKG_SUFFIX = `${process.platform}-${process.arch}`;
+const PKG_NAME = `claudeup-${PKG_SUFFIX}`;
+
+/**
+ * Absolute path to node, resolved once. The "Bun is not installed" tests hand
+ * the launcher a PATH with neither node nor bun on it, so the interpreter
+ * cannot be found by name.
+ */
+const NODE_BIN = spawnSync("sh", ["-c", "command -v node"], {
+	encoding: "utf8",
+}).stdout.trim();
+
+const dirs: string[] = [];
+
+afterEach(() => {
+	for (const dir of dirs.splice(0))
+		rmSync(dir, { recursive: true, force: true });
+});
+
+function sourceStub(action: string): string {
+	return `import { appendFileSync } from "node:fs";
+appendFileSync(
+	process.env.CLAUDEUP_TEST_LEDGER as string,
+	\`SOURCE \${process.argv.slice(2).join(" ")}\\n\`,
+);
+${action}
+`;
+}
+
+function makeTree(
+	opts: {
+		/** Shell the binary stub runs after logging. Omit = package absent. */
+		binaryAction?: string;
+		binaryMode?: number;
+		/** Statement the source stub runs after logging. */
+		sourceAction?: string;
+	} = {},
+): string {
+	const dir = realpathSync(
+		mkdtempSync(path.join(os.tmpdir(), "claudeup-launcher-")),
+	);
+	dirs.push(dir);
+
+	// The launcher is ESM. Without a `type: module` package.json above it, node
+	// parses the copy as CJS and dies on the first `import`.
+	writeFileSync(
+		path.join(dir, "package.json"),
+		JSON.stringify({ name: "claudeup", version: "0.0.0", type: "module" }),
+	);
+
+	mkdirSync(path.join(dir, "bin"));
+	cpSync(REAL_LAUNCHER, path.join(dir, "bin", "claudeup.js"));
+
+	mkdirSync(path.join(dir, "src"));
+	writeFileSync(
+		path.join(dir, "src", "main.tsx"),
+		sourceStub(opts.sourceAction ?? "process.exit(7);"),
+	);
+
+	if (opts.binaryAction !== undefined) {
+		const pkgDir = path.join(dir, "node_modules", PKG_NAME);
+		mkdirSync(path.join(pkgDir, "bin"), { recursive: true });
+		// No "exports" field: the launcher resolves `<pkg>/package.json`, which
+		// an exports map would refuse.
+		writeFileSync(
+			path.join(pkgDir, "package.json"),
+			JSON.stringify({ name: PKG_NAME, version: "0.0.0" }),
+		);
+		const bin = path.join(pkgDir, "bin", "claudeup");
+		writeFileSync(
+			bin,
+			`#!/bin/sh\necho "BINARY $*" >> "$CLAUDEUP_TEST_LEDGER"\n${opts.binaryAction}\n`,
+		);
+		chmodSync(bin, opts.binaryMode ?? 0o755);
+	}
+
+	return dir;
+}
+
+function binaryPathIn(dir: string): string {
+	return path.join(dir, "node_modules", PKG_NAME, "bin", "claudeup");
+}
+
+interface Launch {
+	status: number | null;
+	signal: NodeJS.Signals | null;
+	stderr: string;
+	ledger: string[];
+}
+
+function launch(
+	dir: string,
+	args: string[] = [],
+	env: Record<string, string> = {},
+): Launch {
+	const ledgerPath = path.join(dir, "ledger.txt");
+	const result = spawnSync(
+		NODE_BIN,
+		[path.join(dir, "bin", "claudeup.js"), ...args],
+		{
+			encoding: "utf8",
+			// Nothing may reach a TUI renderer: hand the child an empty stdin.
+			input: "",
+			env: {
+				...process.env,
+				CLAUDEUP_NO_BINARY: "",
+				CLAUDEUP_TEST_LEDGER: ledgerPath,
+				...env,
+			},
+		},
+	);
+	const ledger = existsSync(ledgerPath)
+		? readFileSync(ledgerPath, "utf8")
+				.split("\n")
+				.map((line) => line.trim())
+				.filter(Boolean)
+		: [];
+	return {
+		status: result.status,
+		signal: result.signal,
+		stderr: result.stderr ?? "",
+		ledger,
+	};
+}
+
+describe("launcher: binary killed by a signal", () => {
+	test("T-sig-1: SIGKILL at exec falls back to source and explains why", () => {
+		const dir = makeTree({ binaryAction: "kill -s KILL $$" });
+		const r = launch(dir, ["--version"]);
+
+		// The shipped bug in one line: this was 0.
+		expect(r.status).not.toBe(0);
+		// 7 is the stub source path's code — nothing else can produce it.
+		expect(r.status).toBe(7);
+		expect(r.ledger).toEqual(["BINARY --version", "SOURCE --version"]);
+
+		// A stranded user needs the signal, the file, and a way out.
+		expect(r.stderr).toContain("SIGKILL");
+		expect(r.stderr).toContain(binaryPathIn(dir));
+		expect(r.stderr).toContain("signature");
+		expect(r.stderr).toContain("codesign --verify");
+		expect(r.stderr).toContain("CLAUDEUP_NO_BINARY=1");
+	});
+
+	test("T-sig-2: SIGINT is the user's own Ctrl-C — exit 130, no fallback", () => {
+		const dir = makeTree({ binaryAction: "kill -s INT $$" });
+		const r = launch(dir);
+
+		expect(r.status).toBe(130);
+		expect(r.ledger.some((line) => line.startsWith("SOURCE"))).toBe(false);
+		expect(r.stderr).toBe("");
+	});
+
+	test("T-sig-3: SIGTERM is exit 143, no fallback", () => {
+		const dir = makeTree({ binaryAction: "kill -s TERM $$" });
+		const r = launch(dir);
+
+		expect(r.status).toBe(143);
+		expect(r.ledger.some((line) => line.startsWith("SOURCE"))).toBe(false);
+	});
+
+	test("T-sig-4: SIGABRT is a crash, not a user signal — it must fall back", () => {
+		// The hole an allowlist of crash signals leaves: a Bun/JSC panic aborts,
+		// which is precisely the "binary is broken, use source" case.
+		const dir = makeTree({ binaryAction: "kill -s ABRT $$" });
+		const r = launch(dir);
+
+		expect(r.status).toBe(7);
+		expect(r.ledger.some((line) => line.startsWith("SOURCE"))).toBe(true);
+	});
+
+	test("T-sig-5: a kill seconds in is deliberate — report it, do not relaunch", () => {
+		// A signature kill lands in single-digit milliseconds at exec. A user
+		// running `kill -9` on a live TUI, or an OOM kill, lands much later.
+		// Without the time gate the fix trades a silent exit 0 for a surprise
+		// relaunch of an app the user deliberately killed.
+		const dir = makeTree({ binaryAction: "sleep 3\nkill -s KILL $$" });
+		const r = launch(dir);
+
+		expect(r.status).toBe(137);
+		expect(r.ledger.some((line) => line.startsWith("SOURCE"))).toBe(false);
+	}, 20000);
+
+	test("T-sig-6: an ordinary non-zero exit passes straight through", () => {
+		const dir = makeTree({ binaryAction: "exit 3" });
+		const r = launch(dir);
+
+		expect(r.status).toBe(3);
+		expect(r.ledger.some((line) => line.startsWith("SOURCE"))).toBe(false);
+	});
+
+	test("T-sig-7: no platform package — straight to source, silently", () => {
+		const dir = makeTree();
+		const r = launch(dir);
+
+		expect(r.status).toBe(7);
+		expect(r.ledger).toEqual(["SOURCE"]);
+		expect(r.stderr).not.toContain("could not start");
+	});
+
+	test("T-sig-8: an unexecutable binary still falls back and says so", () => {
+		const dir = makeTree({ binaryAction: "exit 0", binaryMode: 0o644 });
+		const r = launch(dir);
+
+		expect(r.status).toBe(7);
+		expect(r.stderr).toContain("could not start");
+	});
+
+	test("T-sig-9: CLAUDEUP_NO_BINARY=1 skips the binary entirely", () => {
+		// The escape hatch the SIGKILL diagnostic advertises has to work.
+		const dir = makeTree({ binaryAction: "kill -s KILL $$" });
+		const r = launch(dir, [], { CLAUDEUP_NO_BINARY: "1" });
+
+		expect(r.ledger.some((line) => line.startsWith("BINARY"))).toBe(false);
+		expect(r.status).toBe(7);
+	});
+
+	test("T-sig-10: the source path has the same bug, and nowhere to fall back to", () => {
+		const dir = makeTree({
+			sourceAction: 'process.kill(process.pid, "SIGKILL");',
+		});
+		const r = launch(dir);
+
+		expect(r.status).toBe(137);
+		// No binary was involved, so a codesign hint here would be nonsense.
+		expect(r.stderr).not.toContain("codesign");
+	});
+
+	test("T-sig-11: argv reaches both the binary and the fallback unchanged", () => {
+		const dir = makeTree({ binaryAction: "kill -s KILL $$" });
+		const r = launch(dir, ["--version", "--x"]);
+
+		expect(r.ledger).toContain("BINARY --version --x");
+		expect(r.ledger).toContain("SOURCE --version --x");
+	});
+
+	// An empty PATH removes bun, so the source fallback cannot start either.
+	// This is the terminal state for the population the 6.8.1 fix exists for:
+	// claudeup installed from npm on macOS 27, no Bun on the machine.
+	const NO_BUN = { PATH: "" };
+
+	test("T-sig-12: binary crashed AND no Bun — the message must not deny the binary", () => {
+		const dir = makeTree({ binaryAction: "kill -s KILL $$" });
+		const r = launch(dir, ["--version"], NO_BUN);
+
+		expect(r.status).toBe(1);
+		// The contradiction: a binary was found, run, and reported killed
+		// moments earlier. Saying none exists sends the user down a dead end.
+		expect(r.stderr).not.toContain(`no prebuilt binary for ${PKG_SUFFIX}`);
+		expect(r.stderr).toContain("unusable on this machine");
+		expect(r.stderr).toContain("npm install -g claudeup@latest");
+	});
+
+	test("T-sig-13: no binary AND no Bun — that message is still correct, and kept", () => {
+		const dir = makeTree();
+		const r = launch(dir, ["--version"], NO_BUN);
+
+		expect(r.status).toBe(1);
+		expect(r.stderr).toContain(`no prebuilt binary for ${PKG_SUFFIX}`);
+		expect(r.stderr).not.toContain("unusable on this machine");
+	});
+});

package/src/cli/upgrade.ts

@@ -11,6 +11,7 @@
  */
 
 import { spawn } from "node:child_process";
+import { constants } from "node:os";
 
 export async function runUpgradeCommand(): Promise<number> {
 	const { execSync } = await import("node:child_process");
@@ -85,7 +86,12 @@ export async function runUpgradeCommand(): Promise<number> {
 			stdio: "inherit",
 			shell: false, // Avoid shell for security (fixes DEP0190 warning)
 		});
-		proc.on("exit", (code) => resolve(code ?? 0));
+		// `code ?? 0` is the same defect 6.8.1 removed from bin/claudeup.js: a
+		// package manager killed by a signal delivers code null, and reporting
+		// that upgrade as a success is the worst answer available.
+		proc.on("exit", (code, signal) =>
+			resolve(code ?? (signal ? 128 + (constants.signals[signal] ?? 0) : 1)),
+		);
 		proc.on("error", () => resolve(1));
 	});
 }

package/src/services/binary-signing.ts

@@ -0,0 +1,78 @@
+/**
+ * Code-sign a compiled claudeup binary, and refuse to ship one that does not
+ * verify.
+ *
+ * `bun build --compile` produces a Mach-O carrying an ad-hoc, linker-signed
+ * signature (`flags=0x20002(adhoc,linker-signed)`) and then appends the
+ * JavaScript bundle to the end of the file. The signature therefore describes
+ * a shorter file than the one that ships. `codesign -v` has reported
+ * "invalid signature (code or signature have been modified)" on every
+ * published claudeup binary back to 4.22.0.
+ *
+ * macOS 27 refuses to exec such a binary: SIGKILL at startup, no output. The
+ * build never signed anything, so nothing caught it — `codesign` appeared
+ * nowhere in this package.
+ *
+ * Signing is ad-hoc (`--sign -`) rather than Developer ID on purpose: files
+ * installed by npm are not quarantined, so Gatekeeper never evaluates them.
+ * The kernel's signature check is the only gate that was failing, and an
+ * ad-hoc signature satisfies it — with no Apple account, no CI secrets and no
+ * notarization wait.
+ */
+
+import { spawnSync } from "node:child_process";
+
+/** Result of one external command. Injected so the logic is testable. */
+export type Run = (
+	cmd: string,
+	args: string[],
+) => { status: number | null; stderr: string };
+
+const realRun: Run = (cmd, args) => {
+	const result = spawnSync(cmd, args, { encoding: "utf8" });
+	// Fail closed and say why. A missing `codesign` must stop the build, not
+	// quietly skip signing — and the raw ENOENT names neither the binary being
+	// signed nor the reason signing is mandatory.
+	if (result.error) {
+		throw new Error(
+			`Could not run \`${cmd}\` while signing ${args[args.length - 1]}: ${result.error.message}\nSigning is mandatory for darwin binaries — macOS kills an unsigned one at exec.`,
+		);
+	}
+	return { status: result.status, stderr: result.stderr ?? "" };
+};
+
+/**
+ * Only darwin. `codesign` does not exist elsewhere, and no other platform
+ * validates a signature at exec.
+ */
+export const needsSigning = (target: { os: string }): boolean =>
+	target.os === "darwin";
+
+/**
+ * Sign the binary, then verify it. A failing verify THROWS.
+ *
+ * This is a gate, not an advisory. The whole defect being fixed is a release
+ * that shipped a binary whose signature did not match it; a warning here would
+ * reproduce that exactly, one log line louder.
+ */
+export function signAndVerify(
+	target: { os: string },
+	binPath: string,
+	run: Run = realRun,
+): void {
+	if (!needsSigning(target)) return;
+
+	const signed = run("codesign", ["--force", "--sign", "-", binPath]);
+	if (signed.status !== 0) {
+		throw new Error(
+			`codesign --sign failed for ${binPath} (exit ${signed.status})\n${signed.stderr}`,
+		);
+	}
+
+	const verified = run("codesign", ["--verify", "--strict", binPath]);
+	if (verified.status !== 0) {
+		throw new Error(
+			`codesign --verify --strict rejected ${binPath} (exit ${verified.status}).\nRefusing to ship a binary macOS will kill at exec.\n${verified.stderr}`,
+		);
+	}
+}