computer-use request_access fails after CLI auto-update: helper bundle is only provisioned by the desktop app for its bundled runtime version

Preflight Checklist

• [x] I have searched existing issues: this is the root cause behind #50735 (closed as not planned), where I posted the same trace as a comment.
• [x] Reproduced on the latest native CLI (2.1.263).

What's Wrong?

The built-in computer-use MCP fails request_access with macOS Screen Recording permission(s) are still not granted, although Screen Recording and Accessibility are granted to Claude.app, iTerm and the browser, and the desktop app's own Computer use (Settings → Computer use) shows both as Granted and works.

The gate is not a TCC problem. The CLI's computer-use gate looks for a per-version helper store at ~/Library/Application Support/Claude/claude-code/<running CLI version>/ (.verified sentinel + claude.app helper bundle, bundle id com.anthropic.claude-code). That store is written by the desktop app, not by the CLI: the provisioning code lives in the app's app.asar (findInstalledBinaryPath(storageDir, version, ".verified"), a hashing writer for .verified, a [CCD] Binary preflight: .verified log line). The app bundles its own Claude Code runtime and provisions only that version: app 1.46388.4 ships claude-code/0.3.260 ↔ CLI 2.1.260, so only 2.1.260/ exists in the store. The native CLI auto-updates independently (2.1.263 on 2026-09-06), and from that moment the gate looks for 2.1.263/, finds nothing, and reports a misleading Screen Recording error.

What Should Happen?

One of:

• (a) the CLI's computer-use gate accepts the app-managed helper regardless of the CLI's own version (the helper is the app's runtime and works fine), or
• (b) the CLI provisions its own helper on update, or
• (c) at minimum, the error says helper bundle missing for <version> instead of a TCC permission error.

Error Messages/Logs

mcp__computer-use__request_access
→ macOS Screen Recording permission(s) are still not granted

$ claude --version
2.1.263
$ ls ~/Library/Application\ Support/Claude/claude-code/
2.1.260
$ ls ~/.local/share/claude/versions/
2.1.260  2.1.263

Steps to Reproduce

1. Install the Claude desktop app (1.46388.4) and the native CLI; enable computer use in the app. The app provisions ~/Library/Application Support/Claude/claude-code/2.1.260/.
2. Let the CLI auto-update to 2.1.263 (or any version newer than the app's bundled runtime).
3. Start a CLI session and call request_access from the computer-use MCP.
4. Observe the Screen Recording error despite valid TCC grants.

Things that do NOT provision a helper for the running CLI version (all tried): /mcp disable computer-use + /mcp enable computer-use (with and without the stale dir present), claude install, a fresh interactive claude start, a claude -p … run, toggling "Enable computer use" off/on in the desktop app, relaunching the desktop app. Copying the 2.1.260 claude.app + .verified into a 2.1.263/ directory is rejected (the sentinel is version-specific). claude doctor reports no issues.

Claude Model

N/A (tool gating, model-independent)

Is this a regression?

Yes. Works whenever the CLI version equals the desktop app's bundled runtime version.

Last Working Version

2.1.260 (the app-provisioned version; running ~/.local/share/claude/versions/2.1.260 directly still works)

Claude Code Version

2.1.263 (native install)

Platform

macOS

Operating System

macOS 26 (Darwin 25.6.0)

Terminal/Shell

iTerm2 / zsh

Additional Information

Workaround for anyone hitting this: run the session on the app-bundled CLI version, e.g. ~/.local/share/claude/versions/2.1.260 --resume <session-id>, or launch the session from the desktop app's Claude Code view (which spawns the bundled runtime). Full trace also posted as a comment on #50735.