Native auto-update invalidates TCC grants, breaking headless/cron-triggered automation

Summary

Claude Code's native macOS component auto-updates even when autoUpdates: false is set (config shows a separate autoUpdatesProtectedForNative: true flag that overrides this). Each native update installs a fresh versioned bundle at:

~/Library/Application Support/Claude/claude-code/<version>/claude.app

macOS TCC (Files & Folders / iCloud Drive access, and Automation control of other apps like Mail/System Events) ties its permission grants to the exact binary path. Because every native update changes that path, every update silently invalidates all prior TCC grants for Claude Code, even though the stable launcher at ~/.local/bin/claude never moves and the bundle identifier (com.anthropic.claude-code) and code signature (Team ID) stay constant.

Impact

This specifically breaks unattended/headless automation — e.g. a launchd job that runs claude -p "..." on a schedule with nobody at the keyboard:

1. Native component silently updates overnight.
2. The next scheduled headless run executes under the new, never-approved binary.
3. Any action requiring a TCC-gated permission (iCloud Drive file access, or AppleEvents to another app like Mail) tries to show a permission dialog.
4. With no interactive session, the dialog can never be answered — the underlying AppleEvent/file call hangs indefinitely (observed: 2–15+ minutes) rather than failing fast with a clear error.
5. The run only succeeds again once a human happens to be at the machine and manually clicks "Allow" on the new version's prompt — at which point a fresh version-numbered entry (2.1.219, 2.1.220, 2.1.221, …) has already piled up as an orphaned grant in System Settings, since the old one pointed at a now-deleted path.

Observed over several days of a real headless workflow (a launchd-triggered skill that fetches newsletters from Mail.app via AppleScript): repeated silent failures/hangs correlating exactly with native version bumps, resolved only by manual intervention.

Expected behavior

One of:

• Native updates respect autoUpdates: false like the rest of the CLI, so the binary path (and thus TCC identity) stays stable unless the user opts in to updating, or
• TCC identity is kept stable across native updates regardless of the versioned install path (e.g. via a fixed helper/xpc binary that doesn't move, or by re-exec'ing through a stable symlink TCC can key off), or
• At minimum, TCC-gated calls made in a non-interactive/headless context (no TTY, no user session) should fail fast with a clear, loggable error instead of hanging indefinitely waiting on a dialog that can never be answered.

Environment

• macOS (Darwin 25.5.0)
• Claude Code CLI, versions observed: 2.1.218–2.1.221 across several days
• Trigger: launchd StartCalendarInterval jobs invoking claude -p non-interactively