Sandbox breaks TLS for Go binaries using macOS Security.framework (gh, brew, etc.)

Bug description

As of Claude Code v2.1.107, the command sandbox breaks TLS certificate verification for Go binaries that use the macOS Security.framework for TLS (e.g. gh, brew). Commands like curl that use LibreSSL/OpenSSL continue to work fine.

Error

$ gh auth status
Get "https://api.github.com/user": tls: failed to verify certificate: x509: OSStatus -26276

OSStatus -26276 is errSecInvalidCertAuthority — the Security.framework cannot verify the certificate chain, likely because the sandbox restricts keychain or Security.framework API access.

Reproduction

1. Install gh via Homebrew on macOS
2. Authenticate normally (gh auth login)
3. Open Claude Code v2.1.107
4. Run any gh command (e.g. gh auth status, gh api user)
5. Observe TLS failure

Key observations

• curl works fine (uses LibreSSL, not Security.framework)
• gh fails (Go binary, links against Security.framework for TLS)
• brew info also fails to fetch from APIs (same root cause)
• otool -L /opt/homebrew/bin/gh confirms it links against /System/Library/Frameworks/Security.framework/Versions/A/Security
• Setting SSL_CERT_FILE does not help because Go ignores it when using the native macOS TLS backend
• Unsetting proxy env vars (HTTPS_PROXY, etc.) does not help
• The issue started today with the update to v2.1.107; gh v2.89.0 (installed April 6) was working in previous Claude Code versions

Environment

• macOS 26.4.1 (Darwin 25.4.0, arm64)
• Claude Code v2.1.107
• gh v2.89.0 (Homebrew)

Workaround

Using curl directly against APIs works since it does not use Security.framework. No practical workaround exists for gh itself within the sandbox.