One read of Claude Documentation

 
 > Release notes for Claude Desktop
 
+<Update label="v1.32885.1" description="2026-08-18">
+  **General**
+
+  * Added message queueing during Research: a message sent while a Research run is in progress is queued and sent when the report is ready.
+  * Fixed 1Password credential requests failing when Claude in Chrome is signed in from more than one browser profile.
+  * Fixed a crash on Windows when installing an update while a background update check was still running, and fixed update installs repeatedly failing after a newer update replaced one already staged.
+  * Fixed a message sent immediately after stopping a reply sometimes being put back into the input box instead of sending.
+  * Fixed reloading or reopening a temporary chat rebuilding the page a moment after it loads, which could discard text typed early.
+  * Fixed the computer-use permission prompts in Cowork and Claude Code sessions accepting a keyboard shortcut aimed at the message box or another surface, and added a brief delay so a send keystroke that lands just as the prompt appears cannot approve it.
+
+  **Code**
+
+  * Fixed automatic continuation after a rate limit firing into the imported-session confirmation prompt or a stale sign-in state, and it now waits out the server's limit reset and sends a clearer continuation message.
+  * Fixed inline bash commands being silently captured as input by a previous command still waiting for a response, such as an interactive login; a stuck command is now noted in the transcript and cleared before the next command runs.
+  * Fixed messages sent from one session to another sometimes being silently dropped, which left the sending session showing a thinking state for many minutes.
+  * Fixed slow session starts for people with MCP servers configured in `~/.claude.json`.
+  * Fixed the Code tab wrongly asking you to install Git on Macs that have Apple's Command Line Tools but not Xcode.
+  * Fixed worktree sessions failing with a "path contains control characters" error when a `WorktreeCreate` hook prints status output before the path.
+
+  **Cowork**
+
+  * Fixed an occasional "Something went wrong" error when a session's question card from Claude changed to a new set of questions.
+  * Fixed Claude sometimes reporting a file as saved when it had been written to a temporary location you could not open.
+  * Fixed Cowork failing to start on Intel Macs.
+
+  **3P**
+
+  * Added `bootstrapHeaders` and `bootstrapHeadersHelper` for authenticating the bootstrap configuration fetch with a service-account credential, the supported replacement for embedding `user:password@` in `bootstrapUrl` (rejected since 1.32352.0): `bootstrapHeaders` is a set of static headers sent on every fetch, and `bootstrapHeadersHelper` is the absolute path of an executable that prints headers as JSON, for a rotating token; helper output is merged over the static headers. When either is set and no `bootstrapOidc` provider is configured, the headers count as sufficient authentication for the fetch and no per-user sign-in is required for it; a per-user sign-in bearer, when also present, still wins on `Authorization`. Header values are masked in diagnostics, and both keys are accepted only from device management or a local configuration file.
+  * Added the option to sign in to claude.ai directly from the import wizard to fetch your data export, with no manual zip download needed.
+  * Changed new Cowork sessions to store Claude Code transcripts under a short fixed folder name, now that the bundled Claude Code (2.1.234) supports it, further shortening file paths on Windows; existing sessions are unchanged.
+  * Changed organization plugin delivery: when the organization plugins endpoint is removed from your configuration, the plugins it had installed are removed from members' devices, as already happens for a removed plugin marketplace.
+  * Fixed admin-configured plugin marketplaces and organization plugins not re-syncing until the next periodic refresh after signing in or after a delayed configuration fetch applied.
+</Update>
+
 <Update label="v1.32352.1" description="2026-08-18">
   **General**
 

 
   **3P**
 
-  * **Breaking:** Managed-config URL settings now reject values that embed credentials (`https://user:password@host…`). Configurations that relied on this fail to load until the credentials are removed; use `bootstrapHeaders` / `bootstrapHeadersHelper` (arriving in an upcoming release) to send authentication instead.
+  * **Breaking:** Managed-config URL settings now reject values that embed credentials (`https://user:password@host…`). Configurations that relied on this fail to load until the credentials are removed; use `bootstrapHeaders` / `bootstrapHeadersHelper` (available from 1.32885.1) to send authentication instead.
   * Added `claudeAiImport.exportEnabled`. With it and `claudeAiImport.enabled` both `true`, users can export this computer's chats, Cowork tasks, and Code sessions from Settings > Import & export as a zip that another install can import. Off by default.
   * Added a `url` source for `allowedPluginMarketplaces` (beta): a hosted `marketplace.json` that delivers plugins as zip archives over HTTPS, with no git on the device. Set `manifestSha256` to pin the exact manifest; it is required for automatically installed plugins.
   * Added `inferenceCredential` as a `credentialKind` for `allowedPluginMarketplaces` (beta): a `url` marketplace hosted on your inference gateway is fetched with the same credential the app already uses for inference.

 | <span id="bootstrapenabled" />Use bootstrap config<br />`bootstrapEnabled`                           | `boolean` | MDM only     | `true`  | Fetch and apply the URL above at launch. Turn off to keep the URL saved but skip the fetch. Defaults to `true`.                                                                                           |
 | <span id="bootstrapurl" />Bootstrap config URL<br />`bootstrapUrl`                                   | `string`  | MDM only     | —       | HTTPS endpoint that returns a per-user JSON config overlay. Values from the response override local settings and become read-only.                                                                        |
 | <span id="bootstrapoidc" />Bootstrap OIDC parameters<br />`bootstrapOidc`                            | `object`  | MDM only     | —       | When set, the bootstrap request sends a Bearer token from a browser sign-in (authorization-code-with-PKCE).                                                                                               |
+| <span id="bootstrapheaders" />Bootstrap request headers<br />`bootstrapHeaders`                      | `object`  | MDM only     | —       | HTTP headers sent on every bootstrap config fetch. Use this instead of embedding user:pass@ in the URL.                                                                                                   |
+| <span id="bootstrapheadershelper" />Bootstrap headers helper script<br />`bootstrapHeadersHelper`    | `string`  | MDM only     | —       | Absolute path to an executable that prints a JSON object of bootstrap request headers. Merged over the static headers; the helper wins.                                                                   |
 | <span id="trustbootstrapdelivery" />Trust bootstrap-delivered settings<br />`trustBootstrapDelivery` | `boolean` | MDM only     | `false` | Skip the per-user consent prompt for sign-in targets, inference endpoints, helper scripts, and connectors the bootstrap server delivers. Defaults to `false`. Previously named `trustBootstrapLocalExec`. |
 
 <AccordionGroup>

     | `scopes`                          | `string`  | —       | Space-separated; the token’s audience must match what your bootstrap server validates.                                                                     |
     | `redirectPort`                    | `integer` | —       | Fixed loopback port for the sign-in redirect ([http://127.0.0.1:PORT/callback](http://127.0.0.1:PORT/callback)). Leave unset to use a free port each time. |
     | `additionalRedirectReferrerHosts` | `string`  | —       | Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.         |
+  </Accordion>
+
+  <Accordion title="bootstrapHeaders details">
+    Static headers sent on every request to the bootstrap config URL — for a service-account credential (`Authorization: Basic …`, an API key header) or a routing/tenant header. When either this or the headers helper script is set and no separate `bootstrapOidc` provider is configured, the app treats the headers as sufficient auth and does not require a per-user sign-in for the bootstrap fetch. Header values are masked in diagnostics and telemetry. For a rotating token, use the headers helper script instead.
+  </Accordion>
+
+  <Accordion title="bootstrapHeadersHelper details">
+    Absolute path to an executable that prints a single JSON object of HTTP headers on stdout, e.g. `{"Authorization": "Bearer …"}`. The app runs it (no arguments; output cached for a few minutes) before each bootstrap config fetch and merges the result over **Bootstrap request headers** (the helper wins on conflict). Use this instead of embedding `user:pass@` in the bootstrap URL, or when the bootstrap server needs a rotating token from a secrets manager. When either this or the static headers are set and no separate `bootstrapOidc` provider is configured, the app treats them as sufficient auth and does not require a per-user sign-in for the bootstrap fetch. If a per-user sign-in also runs (`bootstrapOidc` or the server’s own device-code flow), that Bearer token wins on `Authorization`.
   </Accordion>
 </AccordionGroup>
 

     | `readOnly`                              | `boolean`  | —       | Offer only read tools — the server registers no write tools at all.                                                                                                                                     |
     | `transport`                             | `enum`     | —       | How the app connects: Streamable HTTP or legacy SSE for remote servers, or a local command over stdio. One of: `http`, `sse`, `stdio`.                                                                  |
     | `url`                                   | `string`   | —       | HTTPS endpoint of the remote MCP server.                                                                                                                                                                |
-    | `oauth`                                 | `object`   | —       | OAuth settings for a remote server: true to auto-register a client, or an object with a pre-registered client ID, tenant, and scope.                                                                    |
+    | `oauth`                                 | `object`   | —       | OAuth for a remote server: true to auto-register a client, a pre-registered client ID with tenant and scope, or mode “hosted” for an Anthropic-signed identity.                                         |
     | `oauth.clientId`                        | `string`   | —       | OAuth client ID from your IdP app registration. Leave unset to auto-register (dynamic client registration) and only narrow scopes.                                                                      |
     | `oauth.clientSecret`                    | `string`   | —       | Only for IdPs whose token endpoint requires a client secret (e.g. Box). Leave blank for PKCE-only public clients.                                                                                       |
     | `oauth.clientSecretHelper`              | `string`   | —       | Executable that prints the client secret on stdout. Overrides the inline value.                                                                                                                         |

 | <span id="bootstrapenabled" />Use bootstrap config<br />`bootstrapEnabled`                           | `boolean` | MDM only     | `true`  | Fetch and apply the URL above at launch. Turn off to keep the URL saved but skip the fetch. Defaults to `true`.                                                                                           |
 | <span id="bootstrapurl" />Bootstrap config URL<br />`bootstrapUrl`                                   | `string`  | MDM only     | —       | HTTPS endpoint that returns a per-user JSON config overlay. Values from the response override local settings and become read-only.                                                                        |
 | <span id="bootstrapoidc" />Bootstrap OIDC parameters<br />`bootstrapOidc`                            | `object`  | MDM only     | —       | When set, the bootstrap request sends a Bearer token from a browser sign-in (authorization-code-with-PKCE).                                                                                               |
+| <span id="bootstrapheaders" />Bootstrap request headers<br />`bootstrapHeaders`                      | `object`  | MDM only     | —       | HTTP headers sent on every bootstrap config fetch. Use this instead of embedding user:pass@ in the URL.                                                                                                   |
+| <span id="bootstrapheadershelper" />Bootstrap headers helper script<br />`bootstrapHeadersHelper`    | `string`  | MDM only     | —       | Absolute path to an executable that prints a JSON object of bootstrap request headers. Merged over the static headers; the helper wins.                                                                   |
 | <span id="trustbootstrapdelivery" />Trust bootstrap-delivered settings<br />`trustBootstrapDelivery` | `boolean` | MDM only     | `false` | Skip the per-user consent prompt for sign-in targets, inference endpoints, helper scripts, and connectors the bootstrap server delivers. Defaults to `false`. Previously named `trustBootstrapLocalExec`. |
 
 <AccordionGroup>

     | `scopes`                          | `string`  | —       | Space-separated; the token’s audience must match what your bootstrap server validates.                                                                     |
     | `redirectPort`                    | `integer` | —       | Fixed loopback port for the sign-in redirect ([http://127.0.0.1:PORT/callback](http://127.0.0.1:PORT/callback)). Leave unset to use a free port each time. |
     | `additionalRedirectReferrerHosts` | `string`  | —       | Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.         |
+  </Accordion>
+
+  <Accordion title="bootstrapHeaders details">
+    Static headers sent on every request to the bootstrap config URL — for a service-account credential (`Authorization: Basic …`, an API key header) or a routing/tenant header. When either this or the headers helper script is set and no separate `bootstrapOidc` provider is configured, the app treats the headers as sufficient auth and does not require a per-user sign-in for the bootstrap fetch. Header values are masked in diagnostics and telemetry. For a rotating token, use the headers helper script instead.
+  </Accordion>
+
+  <Accordion title="bootstrapHeadersHelper details">
+    Absolute path to an executable that prints a single JSON object of HTTP headers on stdout, e.g. `{"Authorization": "Bearer …"}`. The app runs it (no arguments; output cached for a few minutes) before each bootstrap config fetch and merges the result over **Bootstrap request headers** (the helper wins on conflict). Use this instead of embedding `user:pass@` in the bootstrap URL, or when the bootstrap server needs a rotating token from a secrets manager. When either this or the static headers are set and no separate `bootstrapOidc` provider is configured, the app treats them as sufficient auth and does not require a per-user sign-in for the bootstrap fetch. If a per-user sign-in also runs (`bootstrapOidc` or the server’s own device-code flow), that Bearer token wins on `Authorization`.
   </Accordion>
 </AccordionGroup>
 

 
 Configuration keys by Claude Desktop release. Each section lists keys added in that release, with the MDM key name (for plist/registry deployment) and the equivalent JSON shape (for local-file or bootstrap remote configuration).
 
+<Update label="v1.32885.1" description="2026-08-18">
+  <div className="cfg-keys">
+    | MDM key                                                                                      | Type     | Description                     |
+    | -------------------------------------------------------------------------------------------- | -------- | ------------------------------- |
+    | [`bootstrapHeaders`](/docs/third-party/claude-desktop/configuration#bootstrapheaders)             | `object` | Bootstrap request headers       |
+    | [`bootstrapHeadersHelper`](/docs/third-party/claude-desktop/configuration#bootstrapheadershelper) | `string` | Bootstrap headers helper script |
+  </div>
+
+  **JSON (e.g. for non-MDM users or Bootstrap):**
+
+  ```json theme={null}
+  {
+    "bootstrap": {
+      "headers": "<object>",
+      "headersHelper": "<string>"
+    }
+  }
+  ```
+
+  **Changed:**
+
+  * `managedMcpServers[].oauth` accepts a new `mode` value, `hosted`: the app signs in to that MCP server with an Anthropic-hosted client identity (Anthropic vouches for the client on each token request) instead of a client you register yourself, pinned to the exact issuer URL(s) you list in `authorizationServer`; it requires the Claude.ai sign-in and is available once the hosted signer is enabled for your organization.
+</Update>
+
 <Update label="v1.32352.1" description="2026-08-18">
   No configuration changes in this release.
 </Update>

 
   **Changed:**
 
-  * **Breaking:** Managed-config URL settings now reject values that embed credentials (`https://user:password@host…`). Configurations that relied on this fail to load until the credentials are removed; use `bootstrapHeaders` / `bootstrapHeadersHelper` (arriving in an upcoming release) to send authentication instead.
+  * **Breaking:** Managed-config URL settings now reject values that embed credentials (`https://user:password@host…`). Configurations that relied on this fail to load until the credentials are removed; use `bootstrapHeaders` / `bootstrapHeadersHelper` (available from 1.32885.1) to send authentication instead.
   * `allowedPluginMarketplaces[].source` (beta) accepts a new `url` value: a hosted `marketplace.json` whose plugins are zip archives, fetched over HTTPS with no git on the device; set `url` to the manifest address (`repo`, `ref`, and `path` do not apply).
   * `allowedPluginMarketplaces[].credentialKind` (beta) accepts a new `inferenceCredential` value, for `url` marketplaces on the inference gateway's own origin: fetches carry the same bearer credential the app already sends the gateway for inference.
 </Update>