macOS: Full Disk Access / TCC prompts reappear on every auto-update (per-version binary path)

macOS: TCC / Full Disk Access prompts reappear on every auto-update (per-version binary path)

Environment

• Claude Code 2.1.201 (native installer, ~/.local/share/claude/versions/<ver>)
• macOS (Apple Silicon), terminal: Ghostty
• Heavy background-session usage (~10 concurrent bg agents)

What happens

Almost every day — after an auto-update and/or after a background worker crash+respawn
([worker crashed (exit 1 — exit_with_message) — respawning…]) — macOS shows a burst of
~6 TCC permission dialogs (Documents, Downloads, Desktop, App data, file-provider, media
library). With ~10 sessions this repeats per session and is very disruptive.

Root cause (from the local TCC database)

TCC grants are keyed to the exact binary path, and each Claude Code version installs to a
new path:

~/.local/share/claude/versions/2.1.199
~/.local/share/claude/versions/2.1.200
~/.local/share/claude/versions/2.1.201   <- ~/.local/bin/claude symlink repoints here

~/Library/Application Support/com.apple.TCC/TCC.db contains a separate row per version
for each folder scope, e.g. kTCCServiceSystemPolicyDocumentsFolder | .../versions/2.1.201.
So every auto-update is a brand-new "app" to macOS and re-prompts for all file scopes.

The Full Disk Access pane confirms it: ~20 entries literally named 2.1.183 … 2.1.201, all
toggled off, one per past version.

Granting Full Disk Access to the terminal (Ghostty) does not help: background workers
run detached from the terminal, so macOS attributes the file access to the claude binary
itself (its per-version path), not to the responsible parent app.

The changelog note around v2.1.153 ("background agents keep their permission grants across
upgrades") does not hold here — grants are path-scoped per version, not identity-scoped.

Expected

A granted file/automation permission should persist across auto-updates, so users grant once.

Possible fixes (any one would resolve it)

1. Stable code signature / designated requirement. Sign the binary so all versions share a

stable code requirement; TCC then matches by identity, not path, and grants survive updates.

1. Stable executable path. Have TCC-relevant access originate from a fixed path (a stable

launcher/bundle) rather than versions/<ver>/…, so the resolved path never changes.

1. Inherit the responsible parent. Ensure background workers run under the terminal's (or a

stable Claude Code app's) TCC responsibility, so an existing Full Disk Access grant covers them.

Secondary

The frequent worker crashed (exit 1 — exit_with_message) — respawning… on background
sessions (multiple concurrent bg agents) is what makes the re-prompting a daily event; a note on
its cause / how to reduce respawns would help too.