One read of Claude Code CLIclaude-code-20261030T223701Z
2 pages moved out of 228 read.
Pages moved
2
significant first
Pages read
228
in this capture
Captured
22:37 UTC
Corpus hash
9f3677229a62
corpus-hash
What this read moved
1-2 of 2desktop Changed · +44 / -15 lines
##### Create another machine ##### Stop using a machine ##### Remove an entry ##### Replace the host
from line 1589
15891589>
15901590> Connections from a command require Claude Desktop v3.6556.0 or later on macOS or Linux, signed in with a Claude account. Administrators can [distribute commands to a team](#distribute-commands-to-your-team).
15911591
1592Each entry is one connection, with one host at a time. Desktop runs the command only when you create the connection or [replace its host](#replace-the-host), not each time you connect. To keep two machines at once, add a second entry.
1592Desktop runs the command only when you create the connection or [create another machine](#create-another-machine), not each time you connect. Each entry is one connection, which points at the host that Desktop last saved from the entry's command.
15931593
15941594> [!WARNING]
15951595>
15961596> Desktop doesn't stop or delete machines. Each of these keeps running, and can keep costing money, until you delete it with your tool:
15971597>
1598> * A host that you replaced
1599> * The host of an entry that you removed from the file, or whose `id` you changed
1598> * A machine that an entry pointed at before you [created another](#create-another-machine)
1599> * The machines of an entry that you removed from the file, or whose `id` you changed
16001600> * A machine that your command made without Desktop saving its host, for example in these cases:
16011601> * The command fails or runs out of time
16021602> * Desktop can't use the printed host, another connection already uses it, or your organization doesn't allow it
from line 1621
16211621
16221622| Field | Value |
16231623| :- | :- |
1624| `id` | Up to 64 ASCII letters, digits, `.`, `_`, and `-`, starting with a letter or digit. Use an `id` that no other entry in `sshHostCommands` or [`sshConfigs`](#pre-configure-ssh-connections-for-your-team) has. Desktop keeps the connection's host under it, so if you change it, the connection starts over with no host and the old machine keeps running. |
1624| `id` | Up to 64 ASCII letters, digits, `.`, `_`, and `-`, starting with a letter or digit. Use an `id` that no other entry in `sshHostCommands` or [`sshConfigs`](#pre-configure-ssh-connections-for-your-team) has. Desktop keeps the connection's host under it, so if you change it, the connection starts over with no host, its machines keep running, and Desktop can [still connect to them](#remove-an-entry). |
16251625| `name` | The connection's name in the environment selector, up to 200 characters on one line |
16261626| `command` | A program and its arguments, as [Write the command](#write-the-command) describes |
16271627| `sshIdentityFile` | Path to your private key, such as `~/.ssh/id_ed25519`. Leave it out to use your SSH configuration or SSH agent. |
from line 1674
16741674
16751675Keep host key checking on for these hosts, and keep a `known_hosts` file for them. If `StrictHostKeyChecking` is `no` or `accept-new` and `UserKnownHostsFile` is also `/dev/null` or `none`, nothing records the key. When your tool then reuses a name, you can connect to a different machine without a warning.
16761676
1677##### Replace the host
1677A reused name also matters with nobody at the computer, because Desktop connects to these hosts on its own. For example, it delivers a message that you sent while the host was unreachable, once the host answers. Even with host key checking on, the message can reach the name's new machine in these cases, so [stop using a machine](#stop-using-a-machine) before it's deleted:
16781678
1679Once Dev box has a host, the selector lists Dev box among your SSH connections, and **Create Dev box** becomes **Replace Dev box's host**. If that item isn't in the list, look under **More**.
1679* You, your command, or another program added the new key to `known_hosts` or removed the old key's line, as your command does if it adds host keys
1680* Your tool's machines share a host key
1681* Your tool's machines share a certificate authority that `known_hosts` trusts
1682* You or your administrator set `KnownHostsCommand` or `VerifyHostKeyDNS yes`, so SSH accepts keys from outside `known_hosts`
16801683
1681Select it when the machine is gone or you want a fresh one. On the new-session page, the message that says Desktop can't reach the host offers it too. Desktop runs the command again, and new sessions use the new host.
1684##### Create another machine
16821685
1683* **A new host**: the item is gray for 10 minutes after Desktop saves a host, because a new machine can take a while to start. While a new host doesn't answer, the new-session page keeps trying to connect for those 10 minutes.
1684* **Sessions on the old host**: they stay on it, and Desktop doesn't connect to that host unless you add it back. To continue one, open the session and select **Add SSH connection**. Desktop fills in the old host. Save it as a connection of its own.
1686Your sessions on earlier machines keep working after you select **Create another Dev box**, and new sessions use the new machine. Select the item in the environment selector to make a fresh machine or to replace one that is gone. On the new-session page, the message that says Desktop can't reach the host offers it too.
16851687
1688* **Sessions on earlier machines**: continue them from the sidebar, because the selector lists Dev box's current machine and not the earlier ones. Desktop can connect to their machines on its own, for example when Desktop starts, so [stop using a machine](#stop-using-a-machine) when you're done with it.
1689* **A host replaced before Claude Desktop v4.4212.0**: those versions show **Replace Dev box's host** and stop connecting to the replaced host. To continue a session on that host, open the session, select **Add SSH connection**, and save the connection that Desktop fills in. Update Desktop before you replace another host.
1690* **New sessions on two machines**: add a second entry to [`sshHostCommands`](#create-an-ssh-connection-from-a-command)
1691* **A new host that doesn't answer yet**: leave the new-session page open for up to 10 minutes while it keeps trying to connect. If the host still doesn't answer, select **Create another Dev box** in the page's message.
1692* **Another machine soon after**: after several runs of the command within an hour, confirm each further run in the dialog that Desktop opens, which shows the command
1693
1694##### Stop using a machine
1695
1696To stop Desktop from connecting on its own to a machine that a command made, archive every session on the machine:
1697
16981. Find the machine's sessions in the sidebar. A session's [details panel](#see-session-details) shows the host that it runs on.
16992. [Archive each session](#archive-a-session), and leave it archived.
17003. If you haven't created another machine from the same `sshHostCommands` entry since you made this one, [create one](#create-another-machine) or [remove the entry](#remove-an-entry) too. Until then, the machine is the entry's saved connection, and Desktop can connect to it when you open the new-session page with that connection selected.
17014. Delete any other SSH connection to the machine in the app, or remove its [`sshConfigs`](#pre-configure-ssh-connections-for-your-team) entry.
17025. Quit and reopen Desktop, which closes its connection to the machine and ends its attempts to reach it.
17036. Delete the machine with your tool.
1704
1705##### Remove an entry
1706
1707After you remove an entry from the settings file or change its `id`, the sessions on its machines stay, so Desktop can still connect to those machines. It can do so with nobody at the computer, for example to rejoin a session's running process or to deliver a message that was waiting to be sent. To stop that, archive the sessions, as [Stop using a machine](#stop-using-a-machine) describes.
1708
1709If you're an administrator and removed a managed entry, your users' sessions stay too, and each user has to archive their own. To block the entry's machines yourself, set an [`sshHostAllowlist`](#restrict-which-ssh-hosts-users-can-connect-to) that matches the hosts your users still need and not the machines' hostnames. You can do that only where a pattern tells the two apart.
1710
16861711##### Distribute commands to your team
16871712
16881713To give your team a connection, set `sshHostCommands` in Claude Code's [managed settings](https://code.claude.com/docs/en/managed-settings.md) file or MDM policy on each computer, not in the desktop app's own [device management policy](#device-management-policies). Users see your entries alongside their own, and the app offers no way to edit or remove an entry, theirs or yours.
from line 1733
17081733* **The `id`**: if a user's `sshHostCommands` entry has your `id`, only yours works. If any other SSH connection has it, such as one in a user's `sshConfigs`, your entry is gray. Pick an `id` that users are unlikely to choose.
17091734* **The program**: give its full path, because Desktop looks up a bare name on each user's own `PATH`. The program runs as the user, with the variables that their login shell exports.
17101735* **Users' own entries**: Desktop treats a user's entry like a [hook](https://code.claude.com/docs/en/hooks.md), because both run a program on the computer. To allow only your entries, set [`strictPluginOnlyCustomization`](https://code.claude.com/docs/en/settings-reference#strictpluginonlycustomization) to `["hooks"]`, or add `"hooks"` to its list. You also stop Claude Code hooks from user, project, and local settings, with no way to keep them. If you set that key or [`allowManagedHooksOnly`](https://code.claude.com/docs/en/settings-reference#allowmanagedhooksonly) to `true` instead, you block more, as each key's entry lists.
1711* **Every entry**: to turn off your entries too, set [`disableAllHooks`](https://code.claude.com/docs/en/settings-reference#disableallhooks) in managed settings. If you set [`disableDesktopLocalSessions`](https://code.claude.com/docs/en/settings-reference#disabledesktoplocalsessions), or an `sshHostAllowlist` that allows no host, the selector lists no **Create** or **Replace** items.
1736* **Every entry**: to turn off your entries too, set [`disableAllHooks`](https://code.claude.com/docs/en/settings-reference#disableallhooks) in managed settings. If you set [`disableDesktopLocalSessions`](https://code.claude.com/docs/en/settings-reference#disabledesktoplocalsessions), or an `sshHostAllowlist` that allows no host, the selector lists no **Create** or **Create another** items.
17121737* **Where the locks count**: for these entries, Desktop reads `allowManagedHooksOnly`, `strictPluginOnlyCustomization`, and `disableAllHooks` from server-managed settings and from the computer's own file or policy, and applies the stricter result. Every entry stays gray until Desktop has checked claude.ai for server-managed settings, even if your organization has none.
17131738* **Allowed hosts**: if you set [`sshHostAllowlist`](#restrict-which-ssh-hosts-users-can-connect-to), make sure that a pattern matches each hostname that your tool prints, and leave `user@` out of the pattern. Desktop checks the printed name only after the command has run, so a machine that the list refuses already exists, and the user has to delete it with your tool. At each connection, the resolved `HostName` has to match too.
17141739
from line 1741
17161741
17171742##### If a command is missing or gray
17181743
1719The environment selector lists no **Create** or **Replace** item in these cases:
1744The environment selector lists no **Create** or **Create another** item in these cases:
17201745
17211746* **The file**: `~/.claude/settings.json` has [invalid JSON or a value that the schema rejects](https://code.claude.com/docs/en/settings.md#fix-a-broken-settings-file), you misspelled the key, or you put it in a project's settings. Fix the file.
17221747* **Platform and account**: you use Windows, or a [third-party provider](https://code.claude.com/docs/en/third-party-integrations.md) instead of a Claude account. Add each host as an [SSH connection](#ssh-sessions) yourself.
from line 1752
17271752
17281753* **A mistake in the entry**: fix the field or the command that the message names. If the `id` is in use, give the entry another one.
17291754* **A broken settings file**: while your own settings file is broken, your administrator's entries may be gray, with a message that names the file. [Fix the file](https://code.claude.com/docs/en/settings.md#fix-a-broken-settings-file).
1730* **A new host**: you can [replace a host](#replace-the-host) once it's 10 minutes old.
1755* **A new host**: [**Create another**](#create-another-machine) is gray for one minute after Desktop saves a host. Select it after that minute. Before Claude Desktop v4.4212.0, **Replace Dev box's host** is gray for 10 minutes.
17311756* **Hooks are off or restricted**: your own entries work only where your own hooks can run. Remove `disableAllHooks` from your settings, or ask your administrator.
17321757* **Settings are still loading**: every entry is gray until Desktop has loaded your organization's [server-managed settings](https://code.claude.com/docs/en/server-managed-settings.md), usually a few seconds after launch. If the entries stay gray, check your connection to claude.ai.
17331758
from line 1967
19421967```
19431968
19441969Replace the placeholder with your claude.ai organization ID, shown in [claude.ai admin settings](https://claude.ai/admin-settings/organization). It's the same ID that Claude Code's [`forceLoginOrgUUID`](https://code.claude.com/docs/en/settings-reference#forceloginorguuid) setting takes. For macOS and Windows samples that set this key, see [Deploy the Claude Desktop policy](https://claude.com/docs/cowork/hipaa-setup#deploy-the-claude-desktop-policy) in the Cowork guide for HIPAA-ready organizations.
1970
1971> [!WARNING]
1972>
1973> Check the `forceLoginOrgUUID` value before you deploy it. If the ID isn't your organization's, people in your organization can't use Claude Desktop unless they also belong to an organization with that ID. To recover, deploy the correct ID and have them restart Claude Desktop.
19451974
19461975If you set `forceLoginMethod` and `forceLoginOrgUUID` in Claude Code's [managed settings](https://code.claude.com/docs/en/managed-settings.md), you don't change the Claude Desktop sign-in screen.
19471976
claude-tag Changed · +1 / -1 lines
This page is larger than the 256 KiB this site keeps, so one side of the diff below stops where the stored text does.
Nothing in the body moved in this read. What changed is above.