Auto-update repeatedly shows 'trying to add a new helper tool' dialog — OSStatus error -60006 (errAuthorizationCanceled)

Description

The macOS dialog "An update is ready to install. Claude is trying to add a new helper tool" appears repeatedly (multiple times per hour) even after clicking OK and entering the admin password each time.

The helper tool never successfully installs:

• Not present in /Library/PrivilegedHelperTools/
• Not registered in the macOS Background Task Manager (sfltool dumpbtm)
• Not visible in System Settings > General > Login Items & Extensions
• Not visible in System Settings > Privacy & Security

Error from ~/Library/Logs/Claude/main.log

[error] Auto-update error: [Error: The operation couldn't be completed. (OSStatus error -60006.)] {
  [message]: 'The operation couldn't be completed. (OSStatus error -60006.)',
  domain: 'NSOSStatusErrorDomain'
}

OSStatus -60006 = errAuthorizationCanceled — the Squirrel auto-updater appears to be canceling its own authorization request (race condition / timing issue), meaning the user's password entry never completes the install. The dialog then reappears on the next update check cycle.

Environment

• macOS Sequoia 15.3 (Darwin 25.3.0)
• Claude desktop app v1.1.9493 (Electron / Squirrel auto-updater)
• Claude Code v2.1.87 (embedded)
• No MDM profiles installed
• SIP enabled
• No third-party security/cleanup tools

Steps to Reproduce

1. Open Claude desktop app on macOS Sequoia
2. Wait for "An update is ready to install. Claude is trying to add a new helper tool" dialog
3. Click OK and enter admin password
4. Observe: dialog reappears within an hour; helper tool is never registered

Expected Behavior

Helper tool installs successfully after one-time password prompt and does not reappear.

Additional Notes

The same dialog also appears simultaneously for VSCode (via Microsoft AutoUpdate), suggesting this may be a broader macOS Sequoia compatibility issue with the AuthorizationExecuteWithPrivileges / Squirrel flow. Switching to autoUpdatesChannel: "stable" reduces frequency but does not fix the underlying error.