Desktop app cannot access the camera: no NSCameraUsageDescription, so macOS refuses silently and never prompts

What I am trying to do

Use a USB webcam on the Mac as Claude Code's eyes on physical hardware during automated tests (a POS terminal, a receipt printer, a cash drawer, a payment terminal whose screen has no remote capture). Grab one frame on demand, read it as an image.

What happens

Any camera capture launched from a Claude Code session on macOS fails without a prompt.

• imagesnap -w 2 -d "RS Cam" out.jpg → Error: Camera access not granted.
• ffmpeg -f avfoundation -i "0" opens the device, lists pixel formats, then blocks forever.
• The same command in the desktop app's own Terminal panel (user's login shell) → same error.
• System Settings → Privacy & Security → Camera never lists Claude / Claude Code; the pane says "Applications that have requested access to your camera will appear here."
• Photo Booth on the same Mac sees and previews the camera fine.

Why (as far as I can tell)

macOS TCC only prompts for, and grants, camera access to a bundle that declares NSCameraUsageDescription. The app bundle Claude Code runs under here does not declare it, so TCC refuses every request from it and from every process it launches, with no prompt and no entry in the privacy pane. The session's shell is a child of ~/.claude/remote/ccd-cli/<ver> under a Background launchd manager, so there is also no GUI session for a prompt to appear in.

Environment

• macOS Darwin 27.0.0, Apple Silicon Mac mini
• Claude Code desktop app (Code tab), CLI 2.1.281 (~/.claude/remote/ccd-cli/2.1.281)
• Camera: UVC "RS Cam" (VendorID 3034, ProductID 20871), works in Photo Booth and QuickTime

Request

1. Declare NSCameraUsageDescription (and, for the same reason, NSMicrophoneUsageDescription) in the desktop app bundle and any helper that spawns the session, so macOS can show its standard prompt and the user can allow it once in the Camera pane.
2. Make sure sessions run with a responsible process that TCC attributes to that bundle, so a capture from Bash or the Terminal panel inherits the grant.

No elevated or silent access wanted: the normal macOS prompt, once, is exactly right.