bun install --production strips execute bits from vendored binaries
(bun bug). The Claude Agent SDK ships rg binaries in:
node_modules/@anthropic-ai/claude-agent-sdk/vendor/ripgrep/
{x64,arm64}-{linux,darwin}/rg
{x64,arm64}-win32/rg.exe
After bun --production, all of these lose +x, causing EACCES when the
SDK tries to spawn ripgrep. The fix is a targeted find(1) that restores
+x on the rg binaries immediately after bun install.
Design notes:
- -type f excludes symlinks (symlink attack safety, no || true needed)
- -name "rg" naturally excludes rg.exe on Windows (find returns nothing,
chmod never called — safe and correct on all platforms)
- .node audio-capture files use dlopen, not exec — no +x needed there
- Fails loudly if the binary path is missing (no || true) so a SDK
packaging change is immediately visible rather than silently broken
Fixes#1140
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
