macOS: desktop-launched Claude Code is silently denied Local Network access and never gets the permission prompt (CLI bundle is LSBackgroundOnly)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?

When Claude Code runs inside the Claude desktop app on macOS, every command it runs is denied Local Network access with EHOSTUNREACH ("No route to host"), and macOS never shows the Local Network permission prompt, so Claude Code never appears in System Settings > Privacy & Security > Local Network and there is nothing to toggle. The same session launched from Terminal.app works fine because it inherits Terminal's grant.

Cause, as far as I can tell:

• The desktop app launches the CLI through Claude.app/Contents/Helpers/disclaimer, which disclaims responsibility, so the CLI's own bundle becomes the responsible app. sudo launchctl procinfo <pid> on a shell spawned by Claude Code confirms it:

``
responsible path = /Users/bm/Library/Application Support/Claude/claude-code/2.1.255/claude.app/Contents/MacOS/claude
``

• That bundle (com.anthropic.claude-code) has LSBackgroundOnly = true in its Info.plist. macOS does not present the Local Network prompt for background-only apps, so access is silently denied and no permission entry is ever created. The bundle does declare NSLocalNetworkUsageDescription, so this is not a missing usage string.

Evidence that it is the Local Network permission and nothing else, from a Claude Desktop-launched session: the default gateway (which macOS exempts) answers ping and TCP, while every other host on the same LAN and every VM on vmnet bridges (UTM and VMware Fusion) returns No route to host despite a valid route and a resolved ARP entry. Tailscale peers are reachable because they go through a tunnel. The identical commands from a Terminal.app-launched claude succeed.

Practical impact: from the desktop app, Claude Code cannot reach local dev servers, VMs, or LAN devices, and the user cannot fix it because the permission UI never gets an entry for it.

What Should Happen?

The first local-network access from a desktop-launched Claude Code session should trigger the macOS Local Network prompt, and Claude Code should then appear in the Local Network privacy pane so the user can allow it. Either drop LSBackgroundOnly from the CLI bundle so macOS will show the prompt for it, or keep network responsibility with Claude.app (which is foreground-capable and already declares NSLocalNetworkUsageDescription).

Error Messages/Logs

$ ping -c1 172.16.159.129
ping: sendto: No route to host

$ nc -zvw3 172.16.159.129 22
nc: connectx to 172.16.159.129 port 22 (tcp) failed: No route to host

$ ping -c1 192.168.1.1        # default gateway, exempt from Local Network gating
1 packets transmitted, 1 packets received, 0.0% packet loss

$ ping -c1 192.168.1.10       # another LAN host
ping: sendto: No route to host

sudo launchctl procinfo on the Bash tool's shell:

responsible path = /Users/bm/Library/Application Support/Claude/claude-code/2.1.255/claude.app/Contents/MacOS/claude

plutil -p .../claude.app/Contents/Info.plist:

"CFBundleIdentifier" => "com.anthropic.claude-code"
"LSBackgroundOnly" => true
"NSLocalNetworkUsageDescription" => "Claude Code connects to servers and devices on your local network when commands you run need to reach them."

Steps to Reproduce

1. On macOS 15 or later, open a Claude Code session from the Claude desktop app (Claude.app 1.40609.1, Claude Code 2.1.255).
2. Ask it to run ping -c1 <any LAN host other than the gateway> or nc -zv <lan host> 22.
3. Observe No route to host, no Local Network prompt, and no Claude entry under System Settings > Privacy & Security > Local Network.
4. Run claude from Terminal.app in the same directory and repeat step 2: it succeeds (after Terminal's own prompt, if not already granted).

Claude Model

Fable 5.1

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.255 (launched by Claude.app 1.40609.1, sandbox disabled for the commands via the Bash tool)

Platform

macOS 27.0 (26A5388g), Apple Silicon