#14215 macOS arm64: published binary has an invalid code signature, killed by kernel at exec (exit 137)

Summary

The published @cline/cli-darwin-arm64 binary has an invalid code signature. macOS on Apple Silicon requires a valid signature to exec, so the kernel SIGKILLs the process immediately. cline dies with zsh: killed and exit code 137 before any application code runs.

Environment


cline	3.0.62
package	`@cline/[email protected]`
macOS	27.0 (26A428)
arch	arm64 (Apple Silicon)
node	v24.18.0
npm	11.16.0

Reproduce

Directly from the registry tarball, nothing modified:

npm pack @cline/cli-darwin-arm64
tar xzf cline-cli-darwin-arm64-3.0.62.tgz
codesign -v -vvv package/bin/cline
./package/bin/cline --version

tarball sha256: 491b1c06a29b76896b1a421450a6ce202ccb5eddc9adfdb0c792190553d73b37

Actual

package/bin/cline: invalid signature (code or signature have been modified)
In architecture: arm64

exit=137        # 128 + 9 = SIGKILL, no output, no stack trace

Signature details:

Identifier=a.out
Format=Mach-O thin (arm64)
CodeDirectory v=20400 size=693054 flags=0x20002(adhoc,linker-signed) hashes=21655+0 location=embedded
CDHash=f3309838ca62270b6e3f898de565eca34cc271cb
Signature=adhoc
TeamIdentifier=not set

Expected

The binary execs and prints its version.

Cause

The signature is adhoc, linker-signed, and the sealed page hashes no longer match the file contents. The executable was modified after it was signed.

This is the expected result of post-processing a Bun single-file executable (appending/injecting the JS payload) after the linker has signed it. Any byte written after signing invalidates the seal.

Fix

Re-sign as the final build step, after all post-processing:

codesign --force --sign - <binary>

Verified against the pristine registry binary above:

codesign --force --sign - package/bin/cline
./package/bin/cline --version
# 3.0.62

Additional notes

Recurs on every install and every self-update. The updater writes a fresh binary with the same broken signature, so an install that was manually repaired starts failing again after an update.
bin/.cline is a hard link to node_modules/@cline/cli-darwin-arm64/bin/cline. codesign replaces the file rather than patching in place, which splits the link. Any workaround must sign both paths, otherwise the resolver in bin/cline can still fall through to the broken copy.
postinstall.mjs does not sign (it only chmods), so it does not mitigate this.