macOS: Hardened Runtime blocks Apple Events from child processes (missing com.apple.security.automation.apple-events)

Description

The Claude Code binary (com.anthropic.claude-code) is signed with Hardened Runtime (flags=0x10000(runtime)) but lacks the com.apple.security.automation.apple-events entitlement. This prevents any child process spawned by Claude Code from sending Apple Events to other applications.

Impact

Any MCP server or tool that uses AppleScript, JXA, or osascript fails silently or with permission errors when run from Claude Code's process tree. Affected use cases include:

• OmniFocus MCP (omnifocus-mcp) — cannot read/write OmniFocus tasks via AppleScript
• System Events — cannot query running applications, window positions, etc.
• Finder automation — cannot open files, move items, etc.
• Any custom MCP or Bash tool that shells out to osascript

The same MCP servers work correctly when run from a non-Hardened-Runtime parent (e.g., a plain terminal shell).

Root Cause

When a Hardened Runtime binary spawns child processes, the children inherit the parent's entitlement restrictions. Without com.apple.security.automation.apple-events, macOS blocks all Apple Event dispatch from the entire process tree.

Current entitlements on the binary:

com.apple.security.cs.allow-jit = true
com.apple.security.cs.allow-unsigned-executable-memory = true
com.apple.security.cs.disable-library-validation = true
com.apple.security.device.audio-input = true

Missing:

com.apple.security.automation.apple-events = true

Fix

Add com.apple.security.automation.apple-events to the binary's entitlements plist and re-sign. This entitlement allows sending Apple Events to other apps, which macOS will still gate behind per-app TCC prompts (Accessibility, Automation permissions in System Settings), so the security model is preserved.

Environment

• Claude Code 2.1.119
• macOS (Darwin 25.4.0, arm64)
• Binary: com.anthropic.claude-code, TeamIdentifier Q6L2SF6YDW
• Runtime Version 14.5.0