Desktop app: git EPERM ('Unable to read current working directory') in session worktrees since ~Aug 10 — kills menu git status/history; FDA does not fix

Summary

Since ~Aug 10 (desktop app bundling claude-code 2.1.234), the desktop app's own git subprocesses fail with fatal: Unable to read current working directory: Operation not permitted in git-worktree session directories. Visible effects: the session list/menu no longer shows git status/history for sessions, and @-mention autocomplete degrades ([file-index-worker] git ls-files failed; falling back to shallow BFS).

Granting Full Disk Access does NOT fix it, which suggests the app's internal sandbox around these workers — not macOS TCC — is the denier.

Environment

• macOS (Darwin 25.5.0), Claude desktop app, bundled claude-code 2.1.234
• Repo at ~/Documents/midgard, sessions in .claude/worktrees/* under it
• git 2.50.1 (Apple Git-155)

Evidence

main.log, hundreds of occurrences per day since 2026-08-10 20:50 (first occurrence):

[warn] [file-index-worker] git ls-files failed; falling back to shallow BFS (deep paths may be missing in @-mention autocomplete): fatal: Unable to read current working directory: Operation not permitted
[error] Git command failed: git hook run --ignore-missing post-checkout -- 0000... 670c1ef2... 1 { code: 128, stderr: 'fatal: Unable to read current working directory: Operation not permitted\n', cwd: '/Users/joe/Documents/midgard/.claude/worktrees/hungry-swanson-2eb7bd' }

Ruling out user-side causes:

• The same git commands succeed from a session's own Bash tool in the same cwd.
• Full Disk Access granted (verified in the system TCC db: kTCCServiceSystemPolicyAllFiles auth_value=2 for com.anthropic.claudefordesktop, com.anthropic.claude-code, and the versioned claude binaries), Documents-folder grants also present, app fully relaunched after granting — errors continue.
• The worktree directory exists and is healthy.
• Additional stale-grant hazard noticed while debugging: some TCC rows are path-pinned to old bundled binaries (e.g. .../claude-code/2.1.51/claude), so per-version binary paths silently shed grants on update.

Expected

Session git status/history in the menu works; the app's git subprocesses can read their cwd in worktrees under the user's Documents folder once permissions are granted — or the internal sandbox profile allowlists the session worktree paths.