[Bug] Auto-update invalidates macOS TCC folder access grants for protected directories

Bug Description
Auto-update silently loses macOS TCC access to protected folders (Downloads/Desktop/Documents)

What's wrong: After Claude Code auto-updated overnight, it suddenly could no longer read or write ~/Downloads — every access failed with Operation not permitted (EPERM). Nothing on my side changed: I didn't touch any setting, the OS wasn't updated, and the terminal app was never restarted. The only thing that changed was the Claude Code binary.

Root cause (confirmed by diagnosis): The claude binary is signed with its own TCC identity (Identifier=com.anthropic.claude-code, Team Q6L2SF6YDW, hardened runtime, and it declares TCC-relevant entitlements such as com.apple.security.automation.apple-events and com.apple.security.device.audio-input). Because of this, macOS TCC treats claude as its own subject — it does not inherit the host terminal's (e.g. iTerm's) "Files and Folders → Downloads" grant. Each auto-update installs a new versioned binary at ~/.local/share/claude/versions/<ver> with a new cdhash, which no longer matches the TCC decision recorded for the previous build, so TCC denies. Since a CLI can't present the consent dialog, it fails silently instead of prompting the user.

Evidence:

• uptime: no reboot in 84 days → OS unchanged, so it wasn't an OS update revalidating TCC.
• TCC.db mtime unchanged (predated the breakage) → the permission DB wasn't reset.
• ls -l ~/.local/share/claude/versions/2.1.210 → binary written at the exact time things broke (auto-update).
• Host terminal (iTerm) had "Downloads Folder" enabled in Files and Folders the whole time — irrelevant, because Claude is a separate TCC subject.
• Reading ~/Library/Application Support/com.apple.TCC/TCC.db returned authorization denied → TCC enforcing against com.anthropic.claude-code.

Environment: macOS 15.7.4 (build 24G517), Claude Code 2.1.210, launched from iTerm2.

Workaround that fixed it: tccutil reset SystemPolicyDownloadsFolder com.anthropic.claude-code, then access the folder once — grant is re-established (no prompt shown, no manual panel entry needed). Note the "Files and Folders" pane has no +, so users can't add Claude manually there; the only alternative is Full Disk Access, which is too broad for most users.

Expected behavior / suggestions:

• TCC folder grants should survive auto-updates (e.g. keep the responsible-process attribution stable, or don't let the cdhash change invalidate an existing user grant).
• If a protected-folder access is denied and no prompt can be shown, surface an actionable message (e.g. "Downloads access was denied by macOS; run tccutil reset SystemPolicyDownloadsFolder com.anthropic.claude-code") instead of a bare Operation not permitted.

Environment Info

• Platform: darwin
• Terminal: iTerm.app
• Version: 2.1.210
• Feedback ID: 2ec7fb01-7c7b-4d0f-aab7-af12f89d4b70

Errors

[]