Following up on #21157, which made shellenv.sh sandbox-compatible by using lsof instead of ps, this change addresses another sandbox issue in brew.sh.

The here-string syntax triggers a warning:

/opt/homebrew/Library/Homebrew/brew.sh: line 60: cannot create temp file for here document: Operation not permitted

This occurs because here-strings (<<<) internally create temporary files, which many sandboxes restrict for security reasons.

Changes

Replaces the here-string version parsing with IFS-based word splitting:

# Before
IFS=. read -r -a MACOS_VERSION_ARRAY <<<"${HOMEBREW_MACOS_VERSION}"

# After
IFS=.
MACOS_VERSION_ARRAY=($HOMEBREW_MACOS_VERSION)
unset IFS

This produces identical results without requiring temp file creation.

Testing

Verified that brew shellenv runs without warnings when executed under sandbox-runtime and that version parsing continues to work correctly.

I used https://github.com/anthropic-experimental/sandbox-runtime below, which is what Claude Code uses internally for its sandboxing. It uses Seatbelt on macOS.

Before

srt brew shellenv

/opt/homebrew/Library/Homebrew/brew.sh: line 60: cannot create temp file for here document: Operation not permitted
export HOMEBREW_PREFIX="/opt/homebrew";
# ...

After

srt ./bin/brew shellenv

export HOMEBREW_PREFIX="/opt/homebrew";
# ...

References

• Related: shellenv: prefer lsof to ps to read the command for a process #21157 (sandbox-compatible shell detection)