[BUG] Auto-update fails for all native installs: release channel pointers (latest/stable) return 403 AccessDenied from GCS

What happened

Auto-update fails on every attempt with install_failed. Running claude update shows the underlying cause:

Current version: 2.1.241
Checking for updates to latest version...
Error: Failed to install native update
TelemetrySafeError: Failed to fetch version from https://downloads.claude.ai/claude-code-releases/latest after 3 attempt(s): Request failed with status code 403

Root cause

The release-channel pointer objects return 403 AccessDenied from GCS, unauthenticated:

$ curl -i https://downloads.claude.ai/claude-code-releases/latest
HTTP/2 403
content-type: application/xml; charset=UTF-8
server: UploadServer
via: 1.1 google

<?xml version='1.0' encoding='UTF-8'?><Error><Code>AccessDenied</Code><Message>Access denied.</Message></Error>

Versioned paths under the same bucket are still public and serve fine:

| Path | Status |
|---|---|
| claude-code-releases/latest | 403 |
| claude-code-releases/stable | 403 |
| claude-code-releases/2.1.241/manifest.json | 200 |
| claude-code-releases/2.1.246/manifest.json | 200 |
| claude-code-releases/2.1.246/darwin-arm64/claude | 200 (sha256 matches manifest) |

So the artifacts are published and readable — only the latest / stable channel pointers are inaccessible. GCS returns 403 AccessDenied rather than 404 when the caller lacks list permission, so those objects may be missing rather than mis-ACL'd. Either way it's server side; nothing on the client can work around it.

Not a local/network issue

• Native install (not npm), claude doctor reports "No installation issues found"
• No proxy / NODE_EXTRA_CA_CERTS / TLS interception in the environment
• No lock files, install dir is user-owned and writable, 452 GiB free
• Same 403 from plain curl outside the CLI, so it is not client code

Impact

Every native-install user is stuck on whatever version they had when this started, with a persistent ✘ Auto-update failed · Run claude doctor banner. claude doctor itself reports no problem, which sends people down the wrong path.

Workaround

Install a specific version manually, bypassing the channel pointer:

V=2.1.246
curl -sSL -o ~/.local/share/claude/versions/$V \
  "https://downloads.claude.ai/claude-code-releases/$V/darwin-arm64/claude"
chmod 755 ~/.local/share/claude/versions/$V
ln -sfn ~/.local/share/claude/versions/$V ~/.local/bin/claude

Verify the sha256 against https://downloads.claude.ai/claude-code-releases/$V/manifest.json first. Version numbers can be discovered from the npm registry (@anthropic-ai/claude-code) since the channel pointer is unreadable.

Environment

• Claude Code 2.1.241 (native), commit c87e2742fc9a
• macOS darwin-arm64, Darwin 25.6.0
• Auto-update channel: latest
• First observed: 2026-08-26