[Bug] macOS Gatekeeper rejection + TCC permissions reset on every Claude Code update

Bug Description
macOS: "ClaudeCode.app is damaged" after auto-update + TCC permissions reset on every version Environment: macOS Tahoe 26.7.1 (25G241), MacBook Air M5, Claude Code 2.1.289 (native installer, ~/.local/bin/claude) 1) "damaged" Gatekeeper error after auto-update macOS updated to 26.7.1 at 09:18; Claude Code auto-updated to 2.1.289 at 09:30. Launching claude showed: "Claude.app is damaged... This file was downloaded on an unknown date." The versioned binary itself is fine: codesign --verify --strict versions/2.1.289 → valid, spctl → accepted, Notarized Developer ID (Q6L2SF6YDW). But the locally assembled wrapper ~/.local/share/claude/ClaudeCode.app (Contents/MacOS/claude is a hard link to versions/2.1.289) fails assessment: spctl -a -vv ClaudeCode.app → "code has no resources but signature indicates they must be present" The new binary carried com.apple.quarantine, so Gatekeeper assessed the bundle and rejected it. Workaround: xattr -dr com.apple.quarantine "$(readlink -f "$(which claude)")" 2) macOS privacy (TCC) permissions re-prompt after every update TCC records the client by versioned path instead of a stable bundle identity, so each update is treated as a new app and every permission is asked again (Desktop, Documents, Downloads, Media, iCloud Drive, Automation). Stale entries pile up in System Settings > Privacy & Security for deleted versions: versions/2.1.283 (AppleEvents → com.apple.Terminal, App Data), 2.1.284, 2.1.285, 2.1.286 (App Data) * Old binaries are removed from disk, but the permission rows remain and can't be removed individually from the UI. Expected: updates keep a stable signed identity (e.g. a properly signed bundle at a fixed path), no quarantine on auto-updated binaries, and permissions persist across versions like other signed apps.

Environment Info

• Platform: darwin
• Terminal: xterm-256color
• Version: 2.1.289
• Feedback ID: 87ddafb5-73c2-42df-81bb-0837ca95d022