A new macOS-only sandbox setting that permits sandboxed commands to send Apple Events — required for open, osascript, and browser-based auth flows that open URLs.
Usage
// In user or managed settings (not project settings)
{
"sandbox": {
"allowAppleEvents": true
}
}
Details
Only honored from user, managed/policy, or CLI --settings settings. Project settings (.claude/settings.json and .claude/settings.local.json) are explicitly ignored.
Security warning: Enabling this removes code-execution isolation. Sandboxed commands can launch other applications unsandboxed with no user prompt, and can script running apps (e.g. Terminal) subject to the user's per-app TCC automation consent.
Default: false.
Evidence
Setting schema (search for "macOS only: Allow sandboxed commands to send Apple Events") — allowAppleEvents field at line ~46966
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeAdded sandbox.allowAppleEvents opt-in setting that lets sandboxed commands send Apple Events on macOS
