v1.0.100 breaks environments where claude.ai is unreachable (install.sh silently fails, SDK bundled binary bypassed) #1242

Describe the bug

v1.0.100 breaks the action on self-hosted runners where claude.ai is unreachable (corporate firewall) but npm packages are available via a registry mirror (e.g. AWS CodeArtifact).

The install.sh download silently fails (curl SSL error, but bash in the pipe exits 0), so the action reports "Claude Code installed successfully". Then v1.0.100's new logic passes the non-existent $HOME/.local/bin/claude path to the SDK, which throws:

ReferenceError: Claude Code native binary not found at /home/sh-runner/.local/bin/claude

Prior to v1.0.100, pathToClaudeCodeExecutable was undefined when not explicitly set, so the SDK fell back to its bundled platform binary (@anthropic-ai/claude-agent-sdk-linux-x64 installed via bun install --production from npm). This worked fine through corporate registry proxies.

The change in PR #1235 was intended to avoid a bun libc resolution bug, but it breaks environments where the native install is impossible and the bundled binary is the only viable path.

To Reproduce

1. Run the action on a self-hosted runner where claude.ai is not reachable (corporate firewall, no direct internet)
2. Ensure npm packages are available via a registry proxy (e.g. AWS CodeArtifact)
3. Use anthropics/claude-code-action@v1 (resolves to v1.0.100+)
4. Observe: install.sh curl fails, action reports success, then SDK throws "native binary not found"

CI log from a broken run:

Installing Claude Code v2.1.114...
Installation attempt 1...
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to claude.ai:443
Claude Code installed successfully
...
SDK execution error: ReferenceError: Claude Code native binary not found at /home/sh-runner/.local/bin/claude

CI log from a working run on v1.0.99 (same environment, same SSL error, but SDK falls back to bundled binary):

Installing Claude Code v2.1.111...
Installation attempt 1...
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to claude.ai:443
Claude Code installed successfully
[review completes successfully in 2m59s]

Expected behavior

When install.sh fails to download or install the native binary, the action should detect this and allow the SDK to fall back to its bundled platform binary (from the npm optional dependency). Two sub-issues:

1. The pipe curl ... | bash masks curl failures — bash receives no input, exits 0, and the action treats it as a successful install. Consider set -o pipefail or verifying the binary exists after install.
2. When the native binary is not available, pathToClaudeCodeExecutable should be left as undefined rather than pointing to a non-existent file, so the SDK can use its bundled binary.

Workflow yml file

name: Claude PR Action

on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  pull_request_review:
    types: [submitted]
  pull_request:
    types: [opened, reopened, ready_for_review]

permissions:
  contents: read
  issues: write
  pull-requests: write
  id-token: write

jobs:
  claude:
    uses: our-org/shared-github-workflows/.github/workflows/claude-pr-review.yml@master
    with:
      review_prompt: "/review-pr"
      show_full_output: true
    secrets:
      CLAUDE_APP_ID: ${{ secrets.CLAUDE_APP_ID }}
      CLAUDE_APP_PRIVATE_KEY: ${{ secrets.CLAUDE_APP_PRIVATE_KEY }}
      CLAUDE_AWS_ROLE_TO_ASSUME: ${{ secrets.CLAUDE_AWS_ROLE_TO_ASSUME }}

The shared workflow uses anthropics/claude-code-action@v1 with use_bedrock: "true".

API Provider

[x] AWS Bedrock

Additional context

• Self-hosted runners (Linux x64, glibc) behind corporate firewall — claude.ai has never been reachable
• npm packages available via AWS CodeArtifact registry proxy — @anthropic-ai/claude-agent-sdk-linux-x64 installs successfully
• Workaround: pin to @v1.0.99 which restores pathToClaudeCodeExecutable: undefined
• The regression was introduced in v1.0.100 (PR fix: pass install.sh binary path to Agent SDK after 0.2.113 bump #1235: "fix: pass install.sh binary path to Agent SDK after 0.2.113 bump")
• The v1.0.100 comment says: "bun may resolve to the wrong libc variant on Linux" — but in our environment the bundled binary works correctly, and a working bundled binary is better than a non-existent native one