Repeated macOS 26 (Tahoe) "App Data" TCC prompts for standalone CLI binary

Environment

• macOS 26 (Tahoe), Darwin 25.5.0 (Apple Silicon)
• Claude Code standalone CLI 2.1.216 at ~/.local/share/claude/versions/2.1.216
• Claude desktop app with bundled claude-code 2.1.215 at ~/Library/Application Support/Claude/claude-code/2.1.215
• Session running inside the Claude desktop app (Cowork)

Symptom

The OS repeatedly shows the new macOS 26 App Data consent dialog — "'2.1.216' wants to access data from other apps" (kTCCServiceSystemPolicyAppData) — during normal Claude Code sessions. Observed 10+ prompts in 25 minutes, roughly one per assistant turn, including turns with no tool calls.

What we verified (tccd unified log)

• Every prompt is service=kTCCServiceSystemPolicyAppData with subject /Users/<user>/.local/share/claude/versions/2.1.216 (sometimes responsible process is the Homebrew node that hosts the harness).
• Each user response DOES persist: every AUTHREQ_PROMPTING is followed within seconds by a TCCDEvent: type=Create record. Prompts still keep recurring — apparently one consent per (client binary × target app) pair, with the target app masked (<private>) in both the dialog and the log, so it looks like the same popup forever.
• Granting Full Disk Access to the versioned CLI binary does not suppress this category (verified: prompts continue with FDA active). Granting FDA to the desktop app bundle doesn't help either, since TCC attributes responsibility to the CLI binary / node, not the app bundle.
• Because the TCC subject is the per-version file (versions/2.1.216), every auto-update resets all accumulated consents and the prompt cycle starts over (2.1.215 → 2.1.216 reproduced this).

Likely trigger

The standalone CLI reads/writes session state under the desktop app's container (~/Library/Application Support/Claude/...) each turn; macOS 26 classifies this as cross-app data access.

Suggested fixes

• Give the CLI a stable, signed code identity that survives version bumps (stable path or proper code signing identifier), so TCC grants persist across updates.
• When running inside the desktop app, route session-state access so the responsible process is the desktop app bundle (which the user can grant once), or move shared state out of the app's protected container.

🤖 Generated with Claude Code