[BUG] macOS: Claude Desktop can't run hooks/git in TCC-protected folders (~/Documents) — `disclaimer` disclaims TCC responsibility, git getcwd() → "Operation not permitted"

Preflight Checklist

• [x] I have searched existing issues (related: #32584, #42393, #30798, #26981) and none is an open, accurate root-cause report
• [x] This is a single bug report
• [x] I am using the latest version

What's Wrong?

On macOS, Claude Desktop cannot run hooks / git subprocesses for any repo located in a TCC-"protected" folder (~/Documents, and presumably ~/Desktop, ~/Downloads, iCloud Drive). Concretely, creating a new worktree session fails — the WorktreeCreate hook fires but its shell aborts:

WorktreeCreate hook failed: ... shell-init: error retrieving current directory:
  getcwd: cannot access parent directories: Operation not permitted
worktree_hook_failed

Root cause: Claude Desktop runs these subprocesses through Claude.app/Contents/Helpers/disclaimer, which calls responsibility_spawnattrs_setdisclaim() to make the spawned process its own TCC-responsible process — deliberately detaching it from the app's Full Disk Access. The resulting permission-less process can't read the protected parent folder, so git's getcwd() returns EPERM and the operation aborts. Repos outside protected folders are unaffected.

Because the disclaim intentionally strips the grant, granting Full Disk Access to Claude (or anything else) cannot fix it — confirmed by the symptoms in #32584.

Minimal Reproduction (no app UI needed)

DIS="/Applications/Claude.app/Contents/Helpers/disclaimer"

# FAILS — repo inside ~/Documents (TCC-protected)
mkdir -p ~/Documents/_wt_repro && ( cd ~/Documents/_wt_repro && git init -q )
"$DIS" /bin/bash -c 'cd ~/Documents/_wt_repro && git rev-parse --git-common-dir'
#   => fatal: Unable to read current working directory: Operation not permitted

# WORKS — same disclaimed identity, repo OUTSIDE the protected folder
mkdir -p /tmp/_wt_repro && ( cd /tmp/_wt_repro && git init -q )
"$DIS" /bin/bash -c 'cd /tmp/_wt_repro && git rev-parse --git-common-dir'
#   => /tmp/_wt_repro/.git

rm -rf ~/Documents/_wt_repro /tmp/_wt_repro

The helper's role is directly verifiable:

$ nm -u /Applications/Claude.app/Contents/Helpers/disclaimer | grep disclaim
_responsibility_spawnattrs_setdisclaim
$ /Applications/Claude.app/Contents/Helpers/disclaimer
Usage: disclaimer <command> [args...]

Diagnostic note: commands that don't force a real parent-walk getcwd() falsely appear to work even under ~/Documents — cat <abs path>, ls -d, /bin/pwd (uses $PWD), and even python3 -c 'import os; print(os.getcwd())' all succeed. Only git (and /bin/pwd -P) reliably surface the block. Worth knowing so this isn't misdiagnosed as path-specific or intermittent.

What Should Happen?

Worktree creation / hook execution should work for repos under ~/Documents. This is a regression — worktrees in ~/Documents/... created fine until ~late May 2026; the behavior broke after a subsequent desktop update and persists on the current build.

Environment

• macOS 26.5 (25F71), Apple Silicon
• Claude Desktop 1.9659.4 (also reproduced on 1.9659.2)
• Embedded claude-code 2.1.160
• git 2.50.1 (Apple Git-155)
• Repo path: ~/Documents/projects/<name>

Why the usual workarounds don't help

• Full Disk Access (Claude.app): no effect — disclaim detaches the subprocess from the app's identity. The only identity that would count is the disclaimed shell /bin/bash, a SIP-restricted Apple platform binary (com.apple.bash) that can't be granted via System Settings (and granting it would hand every shell on the system full-disk access — the exact thing the disclaim exists to prevent).
• App restart / full system reboot: no effect — this is the disclaim code path, not transient tccd state.
• Reinstall + TCC cleanup: hit-or-miss per #42393.
• Only reliable user-side workaround: move the repo out of ~/Documents (e.g. ~/projects/...).

Suggested Fixes

1. Don't disclaim TCC responsibility for Claude's own worktree-setup git invocations — run them with the same access the session backend already has (the session backend reads ~/Documents fine; only the pre-session worktree/hook path is disclaimed).
2. Failing that, detect a protected-folder repo and surface a clear, actionable error ("move this repo out of ~/Documents / Desktop / Downloads") instead of a raw getcwd: Operation not permitted.

Related

• #32584 — exact match ("disclaimer helper cannot access macOS Documents folder despite Full Disk Access"); closed as duplicate and locked.
• #42393 — open; "Claude Code in Claude Desktop fails to work with local projects (macOS)"; a comment reproduces the identical getcwd EPERM under ~/Documents.
• #30798, #26981 — same disclaimer / EPERM-despite-FDA-after-update family.