This release includes 3 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+8 more
Affected surfaces
Summary
AI summaryclaude update is patched to redirect into clawgod-aware install scripts, removing destructive macOS and Windows behavior.
Full changelog
Highlights
This release neutralizes claude update (which was actively destructive on both macOS and Windows under clawgod), strips three stale install-source paths that were pinning users to old versions, and removes cli.cjs's drift detection — all manifestations of one underlying assumption (that upstream's install/update flow would keep our world up to date) that no longer held.
claude update was breaking installs in two distinct ways
Under the clawgod launcher, upstream's detectInstallType() returns unknown because our wrapper hides cli.cjs from its path heuristics. The "unknown installation" fallback then did very different — and equally broken — things on each platform:
- macOS: extracted Anthropic's bun runtime from the new native binary and overwrote
~/.bun/bin/bunwith it (an Apr-19 mtime stable build). That silently downgraded the user's Bun, and clawgod's launcher hardcodes that path — so the next launch ofclaude --versionblew up withTypeError: Expected CommonJS module to have a function wrapper. If you weren't messing around with Bun's internals, this is a bug in Bun. The error was misleading: nothing was wrong with cli.original.cjs, it just needed Bun ≥ what it was compiled with. - Windows:
claude updatewrote the new binary somewhere outside~/.local/share/claude/versions/, reportedSuccessfully updated from 2.1.119 to 2.1.121, and thenclaude --versionshowed2.1.119. clawgod's drift detection scannedversions/(which still had only the initial 2.1.119), found nothing to update, and the upgrade was a complete no-op.
The fix patches claude update itself so it redirects into install.{sh,ps1} — the single source of truth for clawgod-aware upgrades. No more unknown fallback, no more touching ~/.bun/bin/bun. The redirect prints a 3-line banner before continuing, and the third line points at bash ~/.clawgod/install.sh --uninstall for users who'd rather drop clawgod and use vanilla claude update directly.
PowerShell 5.1's quirks needed to be accounted for in the redirect's Windows path:
Invoke-WebRequest -UseBasicParsingreturnsbyte[]for.Contenton PS 5.1 (returnsstringon PS 7), soiex (iwr ...).Contentthrows Cannot convert System.Byte[] to System.String. Switched toInvoke-RestMethod(irm), which returns string in both versions.- PS 5.1's
iwrreads only the IE proxy settings — notHTTPS_PROXY/HTTP_PROXYenv. The redirect now reads env explicitly and passes via-Proxy, working in both versions. - The PowerShell payload is shipped via
-EncodedCommand(UTF-16LE base64) to bypass CLI argument-quoting hell entirely.
Stale install-source detection removed
Three detection paths were silently keeping users pinned to whatever version they had on the day they first installed clawgod:
~/.local/share/claude/versions/and%LOCALAPPDATA%\Programs\claude-code— these only ever grow on a vanilla Claude install. With clawgod patching outclaude update, they become write-once: pick from them and you're frozen on first-install version forever.claude.orig/claude.orig.exebackups — they're a frozen snapshot from initial install, kept so--uninstallcan restore vanilla Claude. Using them as a fresh install source guarantees stale binaries.
Detection now always routes to the chain that actually carries current versions: npm-global → bun-global → npm registry fallback. The npm-registry path was already there as last-resort; it's now the default for users who don't have a recent global install.
cli.cjs's drift detection removed
The wrapper used to scan ~/.local/share/claude/versions/ on every launch and re-patch if it found a newer binary than what was stamped in .source-version. With nothing legitimately writing new versions to that directory under clawgod (Anthropic's claude update is now patched out), drift detection had nothing real to detect — but it could and did retract a fresher version that install.{sh,ps1} had just pulled from npm registry, putting users into an infinite re-patch loop on every launch. Gone.
Install-time Bun sanity check
Anthropic builds Claude with Bun's canary channel (currently 1.3.14), while bun.sh's stable still ships 1.3.13 — so a freshly-downloaded Bun fails on cli.original.cjs out of the box. Rather than letting install.{sh,ps1} complete and leaving a launcher that panics on first invocation, we now load cli.cjs --version once before writing the launcher; if Bun panics with the function-wrapper error, install fails fast with a multi-line message that names the version mismatch, points at bun upgrade --canary (which pulls from GitHub Releases — not visible on bun.sh's download page), and special-cases scoop, where the bun shim refuses self-replace and the user has to scoop uninstall bun before going via bun.sh.
Release workflow
.github/workflows/release.yml gets FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" for parity with compat-daily.yml. Project policy: never run JS-based actions (actions/checkout, etc.) on Node 20 across any of our workflows.
Verified
- Daily CI run
25044012815on a freshubuntu-latestagainst v1.1.1's install.sh: 24 patches applied / 0 failed against Anthropic v2.1.121, sanity check passes,claude --versionprints2.1.121 (Claude Code)exit 0. - Local macOS arm64: clean re-install, sanity check passes, no drift / re-patch logs,
claude --versionis a single line. - Windows arm64 (user reproduction with
pwsh.exe+ scoop bun 1.3.13): pre-fixclaude updateleft the user pinned to 2.1.119 with no error; post-fix.\install.ps1reaches the sanity check and fails fast with the upgrade-bun guidance, exactly as designed.
Install
macOS / Linux:
curl -fsSL https://github.com/0Chencc/clawgod/releases/latest/download/install.sh | bash
Windows (PowerShell):
irm https://github.com/0Chencc/clawgod/releases/latest/download/install.ps1 | iex
Existing v1.1.0 / earlier users: the redirect lives in cli.original.cjs, which is only refreshed on the next clawgod self-install. If you're on v1.1.0 with no redirect installed yet, claude update will still take the broken upstream path one last time. Run the install one-liner above (or bash ~/.clawgod/install.sh from a clone) once — afterwards claude update will redirect into self-update for all subsequent upgrades.
Closes: #51
Full changelog: https://github.com/0Chencc/clawgod/compare/v1.1.0...v1.1.1
Breaking Changes
- Removes destructive `claude update` behavior on macOS and Windows by redirecting to `install.{sh,ps1}`.
- Strips three stale install‑source paths (`~/.local/share/claude/versions/`, `%LOCALAPPDATA%\Programs\claude-code`, and `claude.orig` backups) that pinned users to old versions.
- Removes cli.cjs drift detection which caused infinite re‑patch loops.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About clawgod
All releases →Related context
Beta — feedback welcome: [email protected]