macOS: auto-update triggers repeated, unlabeled "<version> would like to access data from other apps" TCC prompt

Description

On macOS, every Claude Code auto-update triggers a native "\<version\> would like to access data from other apps" permission dialog (kTCCServiceSystemPolicyAppData) — sometimes multiple times per update (observed up to 3 prompts on a single update).

The dialog labels the requesting app by its version number (e.g. "2.1.236") rather than "Claude Code", which is confusing and looks untrustworthy to users.

Root cause (confirmed via log stream on com.apple.TCC during a live auto-update)

The installed CLI is a bare, un-bundled Mach-O executable at:

~/.local/share/claude/versions/<version>/

with ~/.local/bin/claude symlinked to it. It has no Info.plist/app bundle, so macOS displays the raw path segment ("2.1.236") in place of an application name in the TCC prompt.

During an auto-update, the updater relaunches the CLI as a new child process (different PID) from the same binary path, while the previous process is still tearing down. Because both belong to the same on-disk path but are distinct processes, macOS's TCC layer treats this as one process reaching into another's data and raises an AppleEvents/AppData-class Automation prompt.

Log excerpt from tccd (log stream --predicate 'subsystem == "com.apple.TCC"') at the moment of the prompt:

2026-09-16 16:50:05.000 tccd AUTHREQ_CTX: function=TCCAccessRequest, service=kTCCServiceSystemPolicyAppData, preflight=no, query=1
2026-09-16 16:50:05.000 tccd AUTHREQ_ATTRIBUTION: responsible={identifier=com.anthropic.claude-code, pid=74046, binary_path=/Users/<user>/.local/share/claude/versions/2.1.236}, accessing={identifier=com.anthropic.claude-code, pid=74080, binary_path=/Users/<user>/.local/share/claude/versions/2.1.236}, requesting={identifier=com.apple.sandboxd, pid=583}
2026-09-16 16:50:05.001 tccd AUTHREQ_SUBJECT: subject=/Users/<user>/.local/share/claude/versions/2.1.236
2026-09-16 16:50:05.007 tccd AUTHREQ_PROMPTING: service=kTCCServiceSystemPolicyAppData, subject=Sub:{/Users/<user>/.local/share/claude/versions/2.1.236}

A second, distinct parent/child pid pair (74044→74079) triggered the same class of prompt seconds later in the same update cycle — matching user reports of getting the dialog 2-3 times per update.

Why it never stops recurring

TCC's grant for kTCCServiceSystemPolicyAppData is keyed to the literal binary path, which is ~/.local/share/claude/versions/<version>. Since every update installs a new version directory, the path changes every time, so any previously granted permission does not carry forward — the dialog reappears on every single update, indefinitely.

Impact

• Confusing/unlabeled system dialog on every auto-update (shows a bare version string, not "Claude Code")
• Recurs indefinitely — never resolvable by the user granting permission once
• Makes users think something suspicious/unsigned is asking for access (the binary IS properly Developer-ID signed — codesign -dv shows Identifier=com.anthropic.claude-code, Authority=Developer ID Application: Anthropic PBC — but the TCC dialog doesn't reflect that trust)

Suggested fixes

1. Ship the macOS CLI as (or launch it from) a proper .app bundle with a stable Info.plist bundle identifier/name, so TCC prompts show "Claude Code" instead of a version string, and — more importantly — so grants key off the stable bundle identity rather than a path that changes every release.
2. Alternatively/additionally, restructure the updater so the relaunch doesn't require the new process to reach into the old process's data/state across the update boundary (e.g. exit fully before the new version starts, rather than an overlapping handoff).

Environment

• macOS (Darwin 25.6.0 / Sequoia)
• Claude Code CLI installed via ~/.local/bin/claude symlink to ~/.local/share/claude/versions/<version> (non-Homebrew, non-npm-global install)
• Reproduced across consecutive versions 2.1.234 → 2.1.235 → 2.1.236