Capture
One read of Claude Documentation
5 pages moved out of 218 read.
cowork/changelog Changed · +50 / -0 lines
from line 2
> Release notes for Claude Desktop +<Update label="v1.37937.0" description="2026-08-25"> + **General** + + * Added support for legacy Word .doc files, which now open like .docx, and Excel .xlsx and .xls spreadsheets, which now attach as text where they used to be refused. + * Removed sharing of chat artifacts for members of organizations whose admin has turned Artifacts off; links already shared keep working. + * Fixed chat refusing new messages after the weekly Cowork limit was used up. + * Fixed scheduled tasks set to run on both a day of the month and a weekday (for example "the 1st and every Monday") only running when the two coincided; they now run on either day, as their schedule description says. + * Fixed several chat reliability issues: queued messages could disappear or send on their own, a send retried during a service overload could add repeated copies of a message, reopening a chat before the reply arrived could show a false "message wasn't sent" error, and a single failed response could show two error messages. + * Fixed the app sometimes signing you out right after an automatic update. + + **Code** + + * Improved SSH session reliability: fixed connections failing when the configured identity file is a public key (common with 1Password setups), messages sent while the host reconnects are delivered once it is back, a Claude Code upload to the host now rides out a brief network pause, idle sessions no longer show a false "Lost connection" card, reconnecting can ask for a password or one-time code when needed, and a reconnect no longer reports lost output unless it truly could not be recovered. + * Fixed all saved SSH connections disappearing when one stored connection entry was invalid. + * Fixed background cleanup of old session worktrees on Windows sometimes also deleting the contents of folders that NTFS junctions inside the worktree pointed to, such as the main checkout's `node_modules`. + * Fixed removing a claude.ai import run resetting uncommitted work in a session you had started from that import; the session's files are now kept on disk. + * Fixed sessions failing to start for organizations using the `disableSideloadFlags` setting in Claude Code's `managed-settings.json`; sessions now start without the desktop's bundled skills and plugins instead. + * Fixed very high memory use, and a blank or unresponsive window, when opening or reconnecting sessions with very large transcripts or many subagents. + + **Cowork** + + * Added dictation in the Claude in Chrome side panel; allow the microphone once in the extension's settings. + * Fixed "upload failed" errors when staging Google Drive and other cloud-synced files that are not downloaded on your Mac yet; they now download automatically, and clearer messages explain when the sync app needs to be started. + * Fixed a Rename, Delete, or Move dialog left open in a task's header staying open when you switched to another task and acting on the task you switched to; it now closes on switch. + * Fixed only the last file staying attached when several files opened with Claude each needed confirmation. + * Fixed restored Cowork tabs showing a "Try again" error when the app restarted before sessions finished loading, such as right after an update. + * Fixed the tasks and files panel staying open as an empty pane after a restart. + + **3P** + + * Added `mcpToolTimeoutSec`, which sets how long an MCP tool call may run before it times out. Defaults to 180 seconds. + * Added `organizationInstructions`: organization-wide instructions appended to Claude's system prompt in Chat, Cowork, and Code sessions (up to 3,000 characters); settable via device management, a local configuration file, or the bootstrap response. They are guidance the model follows, not an enforced control. + * Added `skipWebFetchPreflight`. When enabled, Code sessions no longer contact api.anthropic.com before fetching a web page, which fixes page fetches failing on networks that block that host. Off by default. + * Added `userPluginMarketplacesEnabled` and `userPluginUploadsEnabled`, which control whether members can add their own plugin marketplaces and upload their own plugins; when off, the add options are hidden and adds are refused. Unset keys change nothing. + * Added Code tab features already available in the standard app: the Files panel with Show in Files, emoji autocomplete and inline prompt suggestions in the composer, interactive MCP app widgets in the conversation, and letting Claude read output from the integrated terminal panel. + * Added cost estimates to the Usage page: `inferenceModelPricingEnabled` shows an estimated cost alongside token counts, priced at Anthropic list price; `inferenceModelPricing` supplies per-model rates and `inferenceModelPricingMultiplier` scales every estimate (a number between 0 and 1). The two rate keys take effect in a future release; until then estimates use list price. Off by default. + * Added suggestions for plugins and skills from your organization's own library in chat. + * Added support for plugin marketplace credential helpers that return a username or `authtype=Bearer`, so marketplaces hosted on Bitbucket Data Center or behind GitLab deploy tokens can authenticate. + * Added the `disableDesktopLocalSessions` setting to Claude Code's `managed-settings.json`, which turns off Code sessions that run on the device itself so the Code tab offers only remote environments such as SSH; the environment menu shows Local greyed out with a "Disabled by your organization" explanation. + * Changed `allowedPluginMarketplaces` (beta): a `url` marketplace hosted on the bootstrap server's own origin can now use `credentialKind: "inferenceCredential"` and is fetched with the same sign-in the app already uses for its bootstrap configuration. + * Changed `builtinToolPolicy` to accept argument-scoped Claude Code permission rules such as `Bash(curl *)` in addition to bare tool names; `WebSearch` and `WebFetch` entries stay bare tool names, and entries that are not usable rules are rejected with a configuration error. + * Changed gateway device-code sign-in to show the signed-in account's email, when the gateway returns one, instead of the computer's login name. + * Changed the Code tab's file pane and git panel to follow the administrator's `allowedWorkspaceFolders` setting. + * Fixed Bedrock sessions behind a proxy that strips the response content type silently re-running every request without streaming, which billed each request twice. + * Fixed Cowork scheduled tasks running on the 200K-context model when the 1M-context row or "Default model" was selected in the task form; the form now labels the 1M row. + * Fixed the built-in Microsoft 365 connector publishing an invalid schema for updating a calendar event's end time. + * Fixed the Microsoft 365 local connector on Windows failing for users with more than one Microsoft work account on the PC. The Reconnect card now opens the Windows account picker and the chosen account is remembered; users of this connector will be asked to reconnect once after this update. + * Fixed the model picker showing a duplicate, mislabeled 1M-context row when `inferenceModels` lists a model both with and without the `[1m]` suffix. +</Update> + <Update label="v1.34493.1" description="2026-08-21"> **General**
office-agents/third-party-platforms Changed · +42 / -10 lines
### Admin feature controls
from line 205
<img src="https://mintcdn.com/claude-ai/-4jzPa4NasvobarI/images/office-agents/architecture/config-discovery.png?fit=max&auto=format&n=-4jzPa4NasvobarI&q=85&s=b6c750272cf3ad9765ec2563af436806" alt="The add-in resolves each configuration key from a bootstrap endpoint, then Entra ID extension attributes, then manifest parameters." width="2398" height="1670" data-path="images/office-agents/architecture/config-discovery.png" /> </Frame> +### Admin feature controls + +The `disabled_features` configuration key turns off individual add-in +features for your users. It travels over the same three channels as every +other key: manifest parameters (comma-separated), Entra ID extension +attributes (comma-separated), or a bootstrap endpoint (JSON array), so it +can apply org-wide from one manifest or vary per user. + +| Slug | Effect | +| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `skills.authoring` | Blocks creating, editing, and uploading skills. Running admin-provisioned skills is unaffected. | +| `thumbs` | Blocks response feedback (thumbs up / down and the follow-up prompt). | +| `addin.access` | Kill switch: the add-in refuses to run. | +| `file.upload` | Blocks attaching files to the conversation. | +| `web_search` | Removes the built-in web search and web fetch tools, whose queries are served by Anthropic's search provider, along with the user-facing web search toggle. Code execution is unaffected. | + +Unknown slugs are ignored, so setting a slug from a newer add-in version +on an older deployment is safe. + +Disabling `web_search` pairs with the `mcp_servers` key: attach your own +search tool from a server inside your network, and with the built-in +search disabled the model uses the tool you provide. This keeps search +queries on infrastructure you control. + +For document-scoped control, such as disabling a feature only on files +carrying certain sensitivity labels, use the `access_policies` key +instead; a statement without a resource behaves exactly like +`disabled_features`. The setup wizard's +`/claude-for-msft-365-install:manifest` and +`/claude-for-msft-365-install:access-policies` commands document both +keys in full. + ### Deploy to Outlook Outlook requires a separate manifest file from Excel, PowerPoint, and
from line 759
| Publisher | Anthropic, PBC (verified publisher) | | Supported account types | Accounts in any organizational directory | -The add-in uses the following redirect URIs for sign-in. Each one exists -for a specific sign-in path, and none of them receives a Microsoft -access token in the URL. +The add-in uses the following redirect URIs with this application. Each +one exists for a specific Microsoft sign-in path, and none of them +receives a Microsoft access token in the URL. -| Redirect URI | Platform | Purpose | -| -------------------------------------------- | ----------------------- | ---------------------------------------------------------------------------------------- | -| `https://pivot.claude.ai/auth/callback` | Web | admin consent confirmation page, receives `admin_consent` and `tenant` only | -| `https://pivot.claude.ai/msal-redirect.html` | Single-page application | MSAL response bridge for Office on the web, where the host cannot broker tokens natively | -| `brk-multihub://pivot.claude.ai` | Single-page application | Nested App Authentication broker on Office desktop and Mac | -| `https://pivot.claude.ai/auth/3p` | Web | legacy entry from earlier builds, not used by current builds, scheduled for removal | +| Redirect URI | Platform | Purpose | +| -------------------------------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `https://pivot.claude.ai/auth/callback` | Web | admin consent confirmation page, receives only `admin_consent` and `tenant` from Microsoft. Google sign-in for Vertex AI reuses this URI for its [OAuth authorization-code redirect](#oauth-authorization-code-redirects) | +| `https://pivot.claude.ai/msal-redirect.html` | Single-page application | MSAL response bridge for Office on the web, where the host cannot broker tokens natively | +| `brk-multihub://pivot.claude.ai` | Single-page application | Nested App Authentication broker on Office desktop and Mac | +| `https://pivot.claude.ai/auth/3p` | Web | legacy entry from earlier builds, not used by current builds, scheduled for removal | ### Verify this in your own environment
third-party/claude-desktop/configuration Changed · +122 / -34 lines
from line 78
| <span id="inferencecustomheaders" />Custom inference headers<br />`inferenceCustomHeaders` | `object` | MDM + Bootstrap | — | Extra headers on every inference request — routing and tenant headers only (org IDs, Bedrock Guardrails). No credentials; use the credential helper for tokens. Previously named `inferenceGatewayHeaders`. | | <span id="inferencesessionlifetimesec" />Sign-in session lifetime<br />`inferenceSessionLifetimeSec` | `integer` | MDM + Bootstrap | — | How long a sign-in stays valid under your IdP’s session policy. Shows a re-authenticate banner before it expires. | | <span id="inferencecredentialhelper" />Helper script<br />`inferenceCredentialHelper` | `string` | MDM + Bootstrap | — | Absolute path to an executable that prints the credential, optionally with per-request headers. | -| <span id="inferencecredentialhelperttlsec" />Helper script TTL<br />`inferenceCredentialHelperTtlSec` | `integer` | MDM + Bootstrap | `3600` | Helper output is cached for this many seconds. Re-runs at the next session start after expiry. Defaults to `3600`. | +| <span id="inferencecredentialhelperttlsec" />Helper script TTL<br />`inferenceCredentialHelperTtlSec` | `integer` | MDM + Bootstrap | `3600` | Helper output is cached for this many seconds; once it expires the helper re-runs without a relaunch (before the next turn when set above 120). Defaults to `3600`. | | <span id="inferencecredentialhelpertimeoutsec" />Credential helper timeout<br />`inferenceCredentialHelperTimeoutSec` | `integer` | MDM + Bootstrap | `60` | Maximum wait for the helper executable to finish. Raise this if the helper opens a browser for interactive sign-in. Defaults to `60`. Range: 1–600. | | <span id="inferencecredentialhelpersilentrefreshenabled" />Re-run helper for silent refresh<br />`inferenceCredentialHelperSilentRefreshEnabled` | `boolean` | MDM + Bootstrap | `true` | On credential expiry, re-run the helper (CLAUDE\_HELPER\_CONTEXT=mid-session-refresh) to recover silently. Turn off if the helper can’t run non-interactively. Defaults to `true`. | | <span id="usercontentrendererurl" />Artifact preview iframe origin<br />`userContentRendererUrl` | `string` | MDM + Bootstrap | — | HTTPS origin of the user-content-renderer deployment used for artifact and file previews. Defaults to the commercial host when unset. |
from line 222
### Models -| Setting | Type | Availability | Default | Description | -| ----------------------------------------------------------------------------------- | ---------- | --------------- | ------- | --------------------------------------------------------------------------------------------------------------------- | -| <span id="modeldiscoveryenabled" />Model discovery<br />`modelDiscoveryEnabled` | `boolean` | MDM + Bootstrap | — | Auto-populate the model picker from the provider at launch. | -| <span id="modelprefer1mcontext" />Default to 1M context<br />`modelPrefer1mContext` | `boolean` | MDM + Bootstrap | — | When a user has no saved selection, start the picker on the 1M-context variant of the default model if it offers one. | -| <span id="inferencemodels" />Model list<br />`inferenceModels` | `object[]` | MDM + Bootstrap | — | Override the auto-discovered model list. First entry is the default. | +| Setting | Type | Availability | Default | Description | +| ---------------------------------------------------------------------------------------------------- | ---------- | --------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| <span id="modeldiscoveryenabled" />Model discovery<br />`modelDiscoveryEnabled` | `boolean` | MDM + Bootstrap | — | Auto-populate the model picker from the provider at launch. | +| <span id="modelprefer1mcontext" />Default to 1M context<br />`modelPrefer1mContext` | `boolean` | MDM + Bootstrap | — | When a user has no saved selection, start the picker on the 1M-context variant of the default model if it offers one. | +| <span id="inferencemodels" />Model list<br />`inferenceModels` | `object[]` | MDM + Bootstrap | — | Override the auto-discovered model list. First entry is the default. | +| <span id="inferencemodelpricingenabled" />Show estimated cost<br />`inferenceModelPricingEnabled` | `boolean` | MDM + Bootstrap | — | Show an estimated cost on the Usage page, at Anthropic list price for any model without a rate below. | +| <span id="inferencemodelpricingmultiplier" />Price multiplier<br />`inferenceModelPricingMultiplier` | `number` | MDM + Bootstrap | — | Scales every estimated cost (0.85 = 85% of the price); between 0 and 1. Takes effect in a future release; until then turns are estimated at list price. Range: 0–1. | +| <span id="inferencemodelpricing" />Model pricing<br />`inferenceModelPricing` | `object[]` | MDM + Bootstrap | — | Per-model rates replacing Anthropic list price in the Usage page’s estimate. Takes effect in a future release; until then turns are estimated at list price. | <AccordionGroup> <Accordion title="modelDiscoveryEnabled details">
from line 251
[{"name": "claude-sonnet-5", "supports1m": true}, "claude-opus-4-8"] ``` + `"claude-sonnet-5[1m]"` is shorthand for the same entry. When an ID is listed both bare and with `[1m]` (as a gateway lists it), the picker shows one model with a 1M variant; put `labelOverride` on the bare entry (a label on the `[1m]` spelling is ignored there); tier-tagged entries are not folded. + **Default to 1M context** (`prefer1m`) makes the 1M-context variant the default picker selection when this entry is the default model (the first entry); users can still switch to the standard variant, and an explicit user pick is always kept. No effect without `supports1m`. Under dynamic discovery (no explicit list), the equivalent flat key in the **Models** group applies instead: ```json theme={null}
from line 280
| `anthropicFamilyTier` | `enum` | — | Which Claude tier this model stands in for. Pins the bare alias (e.g. ‘opus’) and, for opus/fable, the refusal fallback. One of: `sonnet`, `opus`, `haiku`, `fable`, `mythos`. | | `isFamilyDefault` | `boolean` | — | When several models share a tier alias, marks this one as the model the alias resolves to. Otherwise the first listed wins. | </Accordion> + + <Accordion title="inferenceModelPricingEnabled details"> + Off unless set: the Usage page shows token counts only, since the app cannot know your negotiated provider rates. `true` turns on a USD estimate priced at Anthropic's published list price; `inferenceModelPricingMultiplier` and `inferenceModelPricing` refine it and each also turns the estimate on by itself. Claude Code performs the calculation, so the same figures appear in its own cost reporting for Code sessions. Model IDs Claude Code cannot map to a Claude model (an opaque gateway alias, an inference-profile ARN it cannot resolve) are left out of the estimate until `inferenceModelPricing` gives them a rate. A machine-level Claude Code managed `modelPricing` (MDM / managed-settings.json / server-managed) takes precedence over all three keys. + </Accordion> + + <Accordion title="inferenceModelPricingMultiplier details"> + Mirrors Claude Code's managed `modelPricing.multiplier`: a number in (0, 1] applied to every computed cost, whether the model was priced at Anthropic list price or by an `inferenceModelPricing` row — use it for a flat contracted discount. Setting it also turns the Usage page's estimate on. Takes effect in a future release, once Desktop bundles a Claude Code version that reads it; until then turns are estimated at Anthropic list price. Ignored when a machine-level Claude Code managed `modelPricing` is present. + </Accordion> + + <Accordion title="inferenceModelPricing details"> + Each row replaces Anthropic list price for one model in the Usage page's estimate, in USD per million tokens (`inputPerMtok`, `outputPerMtok`, `cacheReadPerMtok`, `cacheWritePerMtok` — all four required; `cacheWritePerMtok` prices both 5-minute and 1-hour cache writes); any row also turns the estimate on. Mirrors Claude Code's managed `modelPricing.overrides`, and `name` is matched the same way: a built-in Claude model ID (e.g. `claude-sonnet-4-6`, or its Bedrock, Vertex, or Foundry ID) covers every dated and provider spelling of that model; any other value — a gateway alias, an inference-profile ARN — matches that exact ID only (case-insensitive) and wins over a built-in row. An ID Claude Code cannot map to a Claude model at all gets no estimate until a row here prices it. `inferenceModelPricingMultiplier` still applies on top of a row. These rates take effect in a future release, once Desktop bundles a Claude Code version that reads them; until then turns are estimated at Anthropic list price. + + ```json theme={null} + {"inferenceModelPricingEnabled": true, "inferenceModelPricingMultiplier": 0.9, "inferenceModelPricing": [{"name": "claude-sonnet-4-6", "inputPerMtok": 2.4, "outputPerMtok": 12, "cacheReadPerMtok": 0.24, "cacheWritePerMtok": 3}]} + ``` + + These are estimates for visibility, not an invoice; your provider bills at its own rates. A machine-level Claude Code managed `modelPricing` (MDM / managed-settings.json / server-managed) takes precedence over this table. + + | Field | Type | Default | Description | + | ------------------- | -------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------- | + | `name` | `string` | — | A model ID from the list above, or any other ID or alias your provider serves. A built-in Claude ID also covers its dated and provider forms. | + | `inputPerMtok` | `number` | — | USD per million input tokens. | + | `outputPerMtok` | `number` | — | USD per million output tokens. | + | `cacheReadPerMtok` | `number` | — | USD per million prompt-cache read tokens. | + | `cacheWritePerMtok` | `number` | — | USD per million prompt-cache write tokens (5-minute and 1-hour writes alike). | + </Accordion> </AccordionGroup> ### Vertex
from line 383
### Workspace -| Setting | Type | Availability | Default | Description | -| -------------------------------------------------------------------------------------------------- | ---------- | ---------------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | -| <span id="disabledbuiltintools" />Disabled built-in tools<br />`disabledBuiltinTools` | `string[]` | MDM + Bootstrap | — | Built-in tools removed from Cowork. | -| <span id="disablebundledskills" />Disable bundled skills and workflows<br />`disableBundledSkills` | `boolean` | MDM + Bootstrap | — | Disables Claude Code’s bundled skills and workflows (deep-research and similar). Use where WebFetch/WebSearch aren’t available. | -| <span id="skillcreationenabled" />Allow user-created skills<br />`skillCreationEnabled` | `boolean` | MDM + Bootstrap | — | Allow users to create and upload their own skills. When off, the creation and upload surfaces are hidden and the agent’s skill-creation tools are disabled. | -| <span id="builtintoolpolicy" />Built-in tool policy<br />`builtinToolPolicy` | `object` | MDM + Bootstrap | — | Per-tool approval policy for built-in tools. “ask” requires user approval before each call; “allow” is the default. | -| <span id="automodeenabled" />Allow Auto mode<br />`autoModeEnabled` | `boolean` | MDM + Bootstrap | `false` | Offer Auto mode in the Cowork and Code permission selectors. Claude decides which actions need approval. Defaults to `false`. | -| <span id="toolsearchenabled" />Enable tool search<br />`toolSearchEnabled` | `boolean` | MDM + Bootstrap | `false` | Load MCP tool schemas on demand (tool search) instead of inlining every schema into context. Defaults to `false`. | -| <span id="allowedworkspacefolders" />Allowed workspace folders<br />`allowedWorkspaceFolders` | `object[]` | MDM + Bootstrap | — | Folders where Claude may work. Applies to both Cowork and Code sessions. Leave unset for unrestricted access. | -| <span id="coworkegressallowedhosts" />Allowed egress hosts<br />`coworkEgressAllowedHosts` | `string[]` | MDM + Bootstrap | — | Hostnames the agent’s tools may reach from Cowork and Code sessions. Also surfaced under Egress Requirements. | -| <span id="requirecoworkfullvmsandbox" />Require full VM sandbox<br />`requireCoworkFullVmSandbox` | `boolean` | MDM + Bootstrap · Deprecated | `false` | Runs tools inside an isolated VM instead of the host. Stronger isolation; slower file access and no host-process tools. Defaults to `false`. | +| Setting | Type | Availability | Default | Description | +| -------------------------------------------------------------------------------------------------------------------- | ---------- | ---------------------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| <span id="userpluginmarketplacesenabled" />Allow user-added plugin marketplaces<br />`userPluginMarketplacesEnabled` | `boolean` | MDM + Bootstrap | — | Allow users to add plugin marketplaces themselves. When off, the add-marketplace surfaces are hidden and in-app adds are refused. | +| <span id="userpluginuploadsenabled" />Allow user-added plugins<br />`userPluginUploadsEnabled` | `boolean` | MDM + Bootstrap | — | Allow users to add their own plugins. When off, every in-app option for adding one is hidden and uploads that still reach the app are refused. | +| <span id="disabledbuiltintools" />Disabled built-in tools<br />`disabledBuiltinTools` | `string[]` | MDM + Bootstrap | — | Built-in tools, or argument-scoped permission rules such as Read(\*\*/.env), denied in Cowork and Code. | +| <span id="disablebundledskills" />Disable bundled skills and workflows<br />`disableBundledSkills` | `boolean` | MDM + Bootstrap | — | Disables Claude Code’s bundled skills and workflows (deep-research and similar). Use where WebFetch/WebSearch aren’t available. | +| <span id="skillcreationenabled" />Allow user-created skills<br />`skillCreationEnabled` | `boolean` | MDM + Bootstrap | — | Allow users to create and upload their own skills. When off, the creation and upload surfaces are hidden and the agent’s skill-creation tools are disabled. | +| <span id="builtintoolpolicy" />Built-in tool policy<br />`builtinToolPolicy` | `object` | MDM + Bootstrap | — | Approval policy per built-in tool or argument-scoped rule such as Bash(curl \*). “ask” requires user approval before each matching call; “allow” is the default. | +| <span id="automodeenabled" />Allow Auto mode<br />`autoModeEnabled` | `boolean` | MDM + Bootstrap | `false` | Offer Auto mode in the Cowork and Code permission selectors. Claude decides which actions need approval. Defaults to `false`. | +| <span id="toolsearchenabled" />Enable tool search<br />`toolSearchEnabled` | `boolean` | MDM + Bootstrap | `false` | Load MCP tool schemas on demand (tool search) instead of inlining every schema into context. Defaults to `false`. | +| <span id="skipwebfetchpreflight" />Skip WebFetch domain check<br />`skipWebFetchPreflight` | `boolean` | MDM + Bootstrap | — | Skip Claude Code’s WebFetch domain lookup against api.anthropic.com in Code sessions. Off by default; turn on when that host is blocked. | +| <span id="allowedworkspacefolders" />Allowed workspace folders<br />`allowedWorkspaceFolders` | `object[]` | MDM + Bootstrap | — | Folders where Claude may work. Applies to both Cowork and Code sessions. Leave unset for unrestricted access. | +| <span id="coworkegressallowedhosts" />Allowed egress hosts<br />`coworkEgressAllowedHosts` | `string[]` | MDM + Bootstrap | — | Hostnames the agent’s tools may reach from Cowork and Code sessions. Also surfaced under Egress Requirements. | +| <span id="requirecoworkfullvmsandbox" />Require full VM sandbox<br />`requireCoworkFullVmSandbox` | `boolean` | MDM + Bootstrap · Deprecated | `false` | Runs tools inside an isolated VM instead of the host. Stronger isolation; slower file access and no host-process tools. Defaults to `false`. | +| <span id="organizationinstructions" />Organization instructions<br />`organizationInstructions` | `string` | MDM + Bootstrap | — | Appended to Claude’s system prompt in Chat, Cowork, and Code. Guidance the model follows, not an enforced control. Up to 3,000 characters. | <AccordionGroup> + <Accordion title="userPluginMarketplacesEnabled details"> + When on (default), users can add plugin marketplaces from the plugin browser. Set to `false` to block user marketplace adds: the add-marketplace surfaces are hidden, and the app refuses adds that still reach it (deep links, stale UI). + + This is a feature-availability control enforced in the app, not a data boundary: marketplaces already registered on the user's machine (or registered outside the app, for example by the Claude Code CLI or by editing Claude Code's plugin files) are not removed or blocked by this key. Marketplaces provisioned by your organization (`allowedPluginMarketplaces`) are unaffected. + + This key applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set `disableDeploymentModeChooser` so the app stays in third-party mode. + </Accordion> + + <Accordion title="userPluginUploadsEnabled details"> + When on (default), users can upload plugin files and create plugins with Claude. Set to `false` to stop users adding plugins of their own: every in-app option for doing so is hidden, and the app refuses uploads that still reach it. + + This is a feature-availability control enforced in the app, not a data boundary: plugins already installed (or placed on disk outside the app) are not removed or blocked by this key. Plugins from organization-provisioned marketplaces and the organization plugins directory are unaffected. + + This key applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set `disableDeploymentModeChooser` so the app stays in third-party mode. + </Accordion> + + <Accordion title="disabledBuiltinTools details"> + Each entry is a Claude Code tool name (`Bash`, `Read`, `Write`, `Edit`, `Glob`, `Grep`, `NotebookEdit`, `WebFetch`, `WebSearch`, `Task`, `TodoWrite`, `TaskCreate`, `TaskUpdate`, `TaskGet`, `TaskList`, `TaskStop`, `Skill`, `REPL`, `JavaScript`, `AskUserQuestion`, `ToolSearch`, `SendUserMessage`) or an argument-scoped [permission rule](https://code.claude.com/docs/en/permissions#permission-rule-syntax) for one of them (any except `WebSearch` and `WebFetch`, which take the bare name only) — for example `Bash(curl *)`, `Read(//etc/**)`, or `Edit(**/*.env)`. A bare name covers every call to the tool (`Tool(*)` means the same and is stored as the bare name); an argument-scoped rule covers only matching calls and is evaluated by Claude Code's own rule matcher, in every permission mode including Auto and bypass. Claude Code matches a scope for `Bash(…)` (a command pattern) and for file-path patterns written as `Read(…)` (matched for every file-reading tool: `Read`, `Grep`, `Glob`) or `Edit(…)` (every file-editing tool: `Edit`, `Write`, `NotebookEdit`) — it does not consult a path pattern written against any other file tool; other tools take the bare name or Claude Code's generic `Tool(<field>:<pattern>)` form. `WebFetch` and `WebSearch` are whole-tool only: per-host web access is a single control, the egress host settings (`coworkEgressAllowedHosts`), which the Cowork sandbox and Code sessions both enforce, and web search runs server-side at the inference provider where no host list applies — a scoped `WebFetch(…)` or `WebSearch(…)` entry is not a usable rule here (the deny list still hands a scoped `WebFetch(…)` entry to Code sessions as written; Cowork never sees it). An entry Claude Code would not enforce as written raises a configuration warning. + + Argument-scoped `Bash(…)` rules apply to Code sessions and to Cowork sessions running inside the VM sandbox (`requireFullVmSandbox`); Cowork otherwise runs shell commands through a sandboxed `bash` workspace tool that honors the bare name only. Cowork sessions inside the VM sandbox see connected folders at sandbox paths (`/sessions/…/mnt/<folder>/…`), so a file pattern spelled as a host absolute path (`Read(//Users/**)`) does not match there — write patterns that must hold in every Cowork mode folder-relative or `**/`-anchored (`Read(**/secrets/**)`, `Edit(**/*.env)`), or use a read-only `allowedWorkspaceFolders` entry. In Code side chats, and in Cowork sessions that run tools on the host, an **ask** entry on a file tool (`Read`, `Write`, `Edit`, `Glob`, `Grep`) blocks matching calls instead of prompting; Code sessions and VM-sandboxed Cowork sessions show the approval prompt. An **ask** entry, bare or argument-scoped, also turns off the app's remembered “always allow” choices for that whole tool, so each prompted call to it is confirmed individually. Argument-scoped rules reach sessions through Claude Code's managed-settings channel, so Claude Code managed settings delivered any other way — server-managed settings from the Claude admin console or a gateway, an MDM profile, or a [managed-settings file](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) — replace the argument-scoped **ask** rules (and any deny rule whose pattern contains `)` followed by a space or comma) unless that source sets `parentSettingsBehavior` to `"merge"`; bare names and other deny rules are enforced either way. + + The argument-scoped syntax requires the Claude Desktop release it first shipped in or newer — hold off deploying argument-scoped entries until your whole fleet is on that build (note `disableAutoUpdates` pins builds): an older build passes an argument-scoped **deny** entry through to Claude Code unchanged, but drops an argument-scoped **ask** entry as an unknown key — recorded there as a managed-configuration error (which, until that client updates, also blocks WSL sessions on Windows) — and the tool runs at its default (no prompt). + + An entry that is not a usable rule at all (a lowercase tool name, an unbalanced parenthesis, a scoped `WebFetch(…)` or `WebSearch(…)`) is also kept — the deny-list is served exactly as written — and raises a configuration warning. + </Accordion> + <Accordion title="skillCreationEnabled details"> When on (default), users can create new skills and upload skill files in the app. Set to `false` to block user skill creation: the skill-creation and upload surfaces are hidden (the `skill_creation` feature is served as blocked by the organization), and the agent's skill-creation tools (saving skills from a conversation, skill proposals) are not offered in sessions — the same effect as turning off the **User-created skills** organization setting available to claude.ai enterprise admins.
from line 433
</Accordion> <Accordion title="builtinToolPolicy details"> - `ask-session` is accepted for compatibility and treated as `ask`. To remove a tool entirely, use **Disabled built-in tools** instead. + Each entry is a Claude Code tool name (`Bash`, `Read`, `Write`, `Edit`, `Glob`, `Grep`, `NotebookEdit`, `WebFetch`, `WebSearch`, `Task`, `TodoWrite`, `TaskCreate`, `TaskUpdate`, `TaskGet`, `TaskList`, `TaskStop`, `Skill`, `REPL`, `JavaScript`, `AskUserQuestion`, `ToolSearch`, `SendUserMessage`) or an argument-scoped [permission rule](https://code.claude.com/docs/en/permissions#permission-rule-syntax) for one of them (any except `WebSearch` and `WebFetch`, which take the bare name only) — for example `Bash(curl *)`, `Read(//etc/**)`, or `Edit(**/*.env)`. A bare name covers every call to the tool (`Tool(*)` means the same and is stored as the bare name); an argument-scoped rule covers only matching calls and is evaluated by Claude Code's own rule matcher, in every permission mode including Auto and bypass. Claude Code matches a scope for `Bash(…)` (a command pattern) and for file-path patterns written as `Read(…)` (matched for every file-reading tool: `Read`, `Grep`, `Glob`) or `Edit(…)` (every file-editing tool: `Edit`, `Write`, `NotebookEdit`) — it does not consult a path pattern written against any other file tool; other tools take the bare name or Claude Code's generic `Tool(<field>:<pattern>)` form. `WebFetch` and `WebSearch` are whole-tool only: per-host web access is a single control, the egress host settings (`coworkEgressAllowedHosts`), which the Cowork sandbox and Code sessions both enforce, and web search runs server-side at the inference provider where no host list applies — a scoped `WebFetch(…)` or `WebSearch(…)` entry is not a usable rule here (the deny list still hands a scoped `WebFetch(…)` entry to Code sessions as written; Cowork never sees it). An entry Claude Code would not enforce as written raises a configuration warning. + + Argument-scoped `Bash(…)` rules apply to Code sessions and to Cowork sessions running inside the VM sandbox (`requireFullVmSandbox`); Cowork otherwise runs shell commands through a sandboxed `bash` workspace tool that honors the bare name only. Cowork sessions inside the VM sandbox see connected folders at sandbox paths (`/sessions/…/mnt/<folder>/…`), so a file pattern spelled as a host absolute path (`Read(//Users/**)`) does not match there — write patterns that must hold in every Cowork mode folder-relative or `**/`-anchored (`Read(**/secrets/**)`, `Edit(**/*.env)`), or use a read-only `allowedWorkspaceFolders` entry. In Code side chats, and in Cowork sessions that run tools on the host, an **ask** entry on a file tool (`Read`, `Write`, `Edit`, `Glob`, `Grep`) blocks matching calls instead of prompting; Code sessions and VM-sandboxed Cowork sessions show the approval prompt. An **ask** entry, bare or argument-scoped, also turns off the app's remembered “always allow” choices for that whole tool, so each prompted call to it is confirmed individually. Argument-scoped rules reach sessions through Claude Code's managed-settings channel, so Claude Code managed settings delivered any other way — server-managed settings from the Claude admin console or a gateway, an MDM profile, or a [managed-settings file](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) — replace the argument-scoped **ask** rules (and any deny rule whose pattern contains `)` followed by a space or comma) unless that source sets `parentSettingsBehavior` to `"merge"`; bare names and other deny rules are enforced either way. + + The argument-scoped syntax requires the Claude Desktop release it first shipped in or newer — hold off deploying argument-scoped entries until your whole fleet is on that build (note `disableAutoUpdates` pins builds): an older build passes an argument-scoped **deny** entry through to Claude Code unchanged, but drops an argument-scoped **ask** entry as an unknown key — recorded there as a managed-configuration error (which, until that client updates, also blocks WSL sessions on Windows) — and the tool runs at its default (no prompt). + + An entry that is not a usable rule at all (a lowercase tool name, an unbalanced parenthesis, a scoped `WebFetch(…)` or `WebSearch(…)`) is dropped and recorded as a configuration error, like any other unreadable managed value. `ask-session` is accepted for compatibility and treated as `ask`. To remove a tool or deny a rule entirely, use **Disabled built-in tools** instead. </Accordion> <Accordion title="autoModeEnabled details">
from line 458
Claude Desktop otherwise suppresses **all** of Claude Code's experimental beta features on 3P deployments (it pins `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1` into session environments, because strict gateways reject unrecognized beta headers and fields). Enabling this key lifts that suppression, so other experimental betas — for example, on gateway- and Foundry-backed deployments, `context_management` request fields on models that support them — are re-enabled as well. This matches the request surface terminal Claude Code presents through the same gateway by default. Leave unset to keep the conservative default. </Accordion> + <Accordion title="skipWebFetchPreflight details"> + Before fetching a page, Claude Code's WebFetch tool asks `api.anthropic.com` whether the domain is on Anthropic's content blocklist, and refuses the fetch if that lookup cannot complete. Third-party deployments route inference elsewhere and often block `api.anthropic.com` at the firewall; with the lookup on, every WebFetch in Code sessions then fails with "Unable to verify if domain … is safe to fetch", and where the host is reachable, every fetched hostname is sent to Anthropic. (Cowork sessions fetch through the app's own allowlisted fetch and never run this lookup.) + + Off (default): the lookup runs as it does today, so `api.anthropic.com` must be reachable from users' machines for Code-session WebFetch to work (listed under Egress Requirements). Set to `true` when users' machines cannot reach `api.anthropic.com` (corporate firewall, government network) or you do not want fetched hostnames sent there: Code sessions then fetch without the lookup and never contact that host for it. This is the same `skipWebFetchPreflight` setting Claude Code reads from its own [managed-settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) file; the app passes it to every session it starts. To restrict which domains Claude may fetch, use `coworkEgressAllowedHosts` or `builtinToolPolicy` instead. + </Accordion> + <Accordion title="allowedWorkspaceFolders details"> Paths can reference `~` and these environment variables, expanded per user: `%OneDrive%`, `%OneDriveCommercial%`, `%OneDriveConsumer%`, `%APPDATA%`, `%LOCALAPPDATA%`, `%USERNAME%`, `%XDG_DOCUMENTS_DIR%`. The set is fixed; an entry that references any other `%VAR%`, or one that is unset on the device, is ignored.
from line 479
<Accordion title="coworkEgressAllowedHosts details"> Applies to **both** Cowork and Code. In Cowork it governs the sandbox's web fetch, shell commands, and package installs. In Code sessions it is [translated into Claude Code's network sandbox allowlist](https://claude.com/docs/third-party/claude-desktop/code#applied-as-managed-policy); a separately deployed Claude Code managed-settings file on the endpoint takes precedence by default. - Does **not** apply to Web Search, which runs server-side at your inference provider rather than from the sandbox. + Does **not** apply to Web Search, which runs server-side at your inference provider rather than from the sandbox. Per-host control for the agent's web access lives here; to turn `WebFetch` or `WebSearch` off entirely, or to require approval for each call, list the bare tool name in `disabledBuiltinTools` or `builtinToolPolicy`. Only affects **tool calls**. Inference and MCP traffic are covered by their own allowlists elsewhere. When unset, only the inference endpoint is reachable from the sandbox; the agent's package installs (pip/npm) and web fetches will fail with a 403.
from line 489
Hosts you add here also need to be open on your network firewall, on the listed ports. See **Egress Requirements** for the full allowlist. </Accordion> + + <Accordion title="organizationInstructions details"> + Free-text instructions from your organization that Claude Desktop appends, in a clearly delimited block, after its own system prompt in **Chat**, **Cowork**, and **Code** (every chat, task, and Code session, including the sub-agents they spawn): for example house style, data-handling rules, or topics to decline. The model is told these instructions come from the organization's administrator and take priority over a user's personal preferences. + + This is guidance the model follows, not an enforced control: like any system-prompt text it steers the model's behavior and is usually honored, but it does not guarantee an outcome and is not a substitute for the restriction keys (tool policy, egress allowlist, folder allowlist). The app's own system prompt is never replaced or shortened by this key; in Code sessions it is added after Claude Code's own prompt and any `CLAUDE.md` instructions still apply. + + Read from the app's loaded configuration when a session starts; a changed value generally takes effect for sessions started after the next app launch. Leading and trailing whitespace is trimmed; an empty string is treated as unset. Maximum 3,000 characters; a longer value is rejected (the key is ignored with a configuration error) rather than truncated. Line breaks are preserved when the value is delivered as JSON, a bootstrap response, a `.mobileconfig` profile, or a `.reg` file; the Group Policy (ADMX) and Intune text box for this setting is single-line. + </Accordion> </AccordionGroup> ## Connectors
from line 541
| <span id="managedmcpservers" />Managed MCP servers<br />`managedMcpServers` | `object[]` | MDM + Bootstrap | — | Org-pushed MCP servers: remote (HTTP/SSE) or local (stdio command). May embed bearer tokens. | | <span id="mcppersistentalwaysallowenabled" />Allow persistent tool approvals<br />`mcpPersistentAlwaysAllowEnabled` | `boolean` | MDM + Bootstrap | `true` | Offer the persistent “Always allow” approval options for MCP tools. Disable to keep tool approvals per-call or session-scoped only. Defaults to `true`. | | <span id="islocaldevmcpenabled" />Allow user-added MCP servers<br />`isLocalDevMcpEnabled` | `boolean` | MDM + Bootstrap | `true` | Local stdio servers added via the Developer settings. Remote servers come from the managed list above or organization plugins. Defaults to `true`. | +| <span id="mcptooltimeoutsec" />MCP tool call timeout<br />`mcpToolTimeoutSec` | `integer` | MDM + Bootstrap | — | Per-call timeout for MCP tool calls, in seconds. Default 180 (3 minutes). Range: 60–3600. | <AccordionGroup> <Accordion title="managedMcpServers details">
from line 602
This key governs the chat and Cowork surfaces. Code sessions use a separate permission path this key does not cover — govern Code tool approvals with per-tool `toolPolicy` entries, whose `blocked` and `ask` values are forwarded there. </Accordion> + + <Accordion title="mcpToolTimeoutSec details"> + Sets the per-call timeout the agent applies to every MCP tool call; a call that runs longer fails with a timeout error the model can see. Cowork and chat sessions default to 180 seconds. Code sessions have no desktop-imposed MCP tool timeout today, so setting this key introduces one there as well. The desktop's own request deadlines toward MCP servers — the managed servers above and, where `isLocalDevMcpEnabled` permits them, user-added local servers — follow this value so they never cut a call short first; while the key is unset, calls to user-added local servers are additionally limited to 60 seconds by the desktop. Values outside 60–3600 are rejected at parse time (the error is listed in the diagnostics report) and the defaults apply. + + The timeout is global (there is no per-server or per-tool form), so size it for the slowest tool you need to complete: long-running tools on one server extend the window during which a stuck call on any server holds its turn. Cowork's built-in shell tool runs under the same cap: a single command's `timeout_ms` (itself limited to 600 seconds) cannot exceed this value. + </Accordion> </AccordionGroup> ## Telemetry & updates
from line 807
</Accordion> <Accordion title="allowedPluginMarketplaces details"> - | Field | Type | Default | Description | - | ------------------------ | -------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | `source` | `string` | — | Where the marketplace is fetched from: a GitHub repository (set repo), any Git remote (set url), or a hosted marketplace.json file (set url). One of: `github`, `git`, `url`. | - | `repo` | `string` | — | GitHub repository in owner/repo form. Case-insensitive. | - | `ref` | `string` | — | Commit SHA, branch, or tag. Leave empty to track the default branch. | - | `path` | `string` | — | Folder within the repository that contains the marketplace, when it isn’t at the root. | - | `expectedName` | `string` | — | Rejects the marketplace if its manifest name differs. | - | `installationPreference` | `enum` | — | Whether users install plugins themselves or get them automatically. One of: `available`, `auto_install`, `required`. | - | `credentialKind` | `enum` | — | How fetches authenticate: anonymously, with the user’s git credentials, via a helper executable, or as inference does (url sources the gateway hosts). One of: `anonymous`, `userGit`, `credentialHelper`, `inferenceCredential`. | - | `credentialHelper` | `string` | — | Executable that prints an access token for this marketplace. | - | `url` | `string` | — | HTTPS Git remote of the marketplace repository (git), or direct HTTPS URL of a hosted marketplace.json file (url). | - | `manifestSha256` | `string` | — | SHA-256 of the exact marketplace.json to accept. Required when Installation is auto\_install or required; a served manifest with any other digest is refused. | + | Field | Type | Default | Description | + | ------------------------ | -------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | + | `source` | `string` | — | Where the marketplace is fetched from: a GitHub repository (set repo), any Git remote (set url), or a hosted marketplace.json file (set url). One of: `github`, `git`, `url`. | + | `repo` | `string` | — | GitHub repository in owner/repo form. Case-insensitive. | + | `ref` | `string` | — | Commit SHA, branch, or tag. Leave empty to track the default branch. | + | `path` | `string` | — | Folder within the repository that contains the marketplace, when it isn’t at the root. | + | `expectedName` | `string` | — | Rejects the marketplace if its manifest name differs. | + | `installationPreference` | `enum` | — | Whether users install plugins themselves or get them automatically. One of: `available`, `auto_install`, `required`. | + | `credentialKind` | `enum` | — | How fetches authenticate: anonymously, with the user’s git credentials, via a helper executable, or as the app does to its gateway or bootstrap server (url). One of: `anonymous`, `userGit`, `credentialHelper`, `inferenceCredential`. | + | `credentialHelper` | `string` | — | Executable that prints an access token for this marketplace. | + | `url` | `string` | — | HTTPS Git remote of the marketplace repository (git), or direct HTTPS URL of a hosted marketplace.json file (url). | + | `manifestSha256` | `string` | — | SHA-256 of the exact marketplace.json to accept. Required when Installation is auto\_install or required; a served manifest with any other digest is refused. | </Accordion> </AccordionGroup>
from line 853
</Accordion> <Accordion title="bootstrapHeaders details"> - Static headers sent on every request to the bootstrap config URL — for a service-account credential (`Authorization: Basic …`, an API key header) or a routing/tenant header. When either this or the headers helper script is set and no separate `bootstrapOidc` provider is configured, the app treats the headers as sufficient auth and does not require a per-user sign-in for the bootstrap fetch. Header values are masked in diagnostics and telemetry. For a rotating token, use the headers helper script instead. + Static headers sent on every request to the bootstrap config URL — for a service-account credential (`Authorization: Basic …`, an API key header) or a routing/tenant header. When either this or the headers helper script is set and no separate `bootstrapOidc` provider is configured, the app treats the headers as sufficient auth and does not require a per-user sign-in for the bootstrap fetch. These headers (and the helper script's below) also accompany requests to a plugin marketplace this server hosts on its own origin (`allowedPluginMarketplaces` with `credentialKind: "inferenceCredential"`). Header values are masked in diagnostics and telemetry. For a rotating token, use the headers helper script instead. </Accordion> <Accordion title="bootstrapHeadersHelper details">
third-party/claude-desktop/configuration-changelog Changed · +52 / -0 lines
from line 4
Configuration keys by Claude Desktop release. Each section lists keys added in that release, with the MDM key name (for plist/registry deployment) and the equivalent JSON shape (for local-file or bootstrap remote configuration). +<Update label="v1.37937.0" description="2026-08-25"> + <div className="cfg-keys"> + | MDM key | Type | Description | + | -------------------------------------------------------------------------------------------------------------- | ---------- | ------------------------------------ | + | [`inferenceModelPricingEnabled`](/docs/third-party/claude-desktop/configuration#inferencemodelpricingenabled) | `boolean` | Show estimated cost | + | [`inferenceModelPricingMultiplier`](/docs/third-party/claude-desktop/configuration#inferencemodelpricingmultiplier) | `number` | Price multiplier | + | [`inferenceModelPricing`](/docs/third-party/claude-desktop/configuration#inferencemodelpricing) | `object[]` | Model pricing | + | [`userPluginMarketplacesEnabled`](/docs/third-party/claude-desktop/configuration#userpluginmarketplacesenabled) | `boolean` | Allow user-added plugin marketplaces | + | [`userPluginUploadsEnabled`](/docs/third-party/claude-desktop/configuration#userpluginuploadsenabled) | `boolean` | Allow user-added plugins | + | [`mcpToolTimeoutSec`](/docs/third-party/claude-desktop/configuration#mcptooltimeoutsec) | `integer` | MCP tool call timeout | + | [`skipWebFetchPreflight`](/docs/third-party/claude-desktop/configuration#skipwebfetchpreflight) | `boolean` | Skip WebFetch domain check | + | [`organizationInstructions`](/docs/third-party/claude-desktop/configuration#organizationinstructions) | `string` | Organization instructions | + </div> + + **JSON (e.g. for non-MDM users or Bootstrap):** + + ```json theme={null} + { + "models": { + "pricing": { + "enabled": "<boolean>", + "multiplier": "<number>", + "models": [ + { + "name": "<string>", + "inputPerMtok": "<number>", + "outputPerMtok": "<number>", + "cacheReadPerMtok": "<number>", + "cacheWritePerMtok": "<number>" + } + ] + } + }, + "plugins": { + "userPluginMarketplacesEnabled": "<boolean>", + "userPluginUploadsEnabled": "<boolean>" + }, + "mcp": { + "toolTimeoutSec": "<integer>" + }, + "workspace": { + "skipWebFetchPreflight": "<boolean>", + "organizationInstructions": "<string>" + } + } + ``` + + **Changed:** + + * `builtinToolPolicy` accepts argument-scoped Claude Code permission rules such as `Bash(curl *)` or `Edit(**/*.env)` as keys, in addition to bare tool names; `WebSearch` and `WebFetch` take the bare name only, and a key that is not a usable rule is dropped with a configuration error. Deploy argument-scoped entries once your whole fleet is on this release: an older build drops an argument-scoped `ask` entry as an unknown tool, so that tool runs without a prompt. +</Update> + <Update label="v1.34493.1" description="2026-08-21"> No configuration changes in this release. </Update>
third-party/claude-desktop/bootstrap Changed · +1 / -1 lines
from line 385
</Accordion> <Accordion title="bootstrapHeaders details"> - Static headers sent on every request to the bootstrap config URL — for a service-account credential (`Authorization: Basic …`, an API key header) or a routing/tenant header. When either this or the headers helper script is set and no separate `bootstrapOidc` provider is configured, the app treats the headers as sufficient auth and does not require a per-user sign-in for the bootstrap fetch. Header values are masked in diagnostics and telemetry. For a rotating token, use the headers helper script instead. + Static headers sent on every request to the bootstrap config URL — for a service-account credential (`Authorization: Basic …`, an API key header) or a routing/tenant header. When either this or the headers helper script is set and no separate `bootstrapOidc` provider is configured, the app treats the headers as sufficient auth and does not require a per-user sign-in for the bootstrap fetch. These headers (and the helper script's below) also accompany requests to a plugin marketplace this server hosts on its own origin (`allowedPluginMarketplaces` with `credentialKind: "inferenceCredential"`). Header values are masked in diagnostics and telemetry. For a rotating token, use the headers helper script instead. </Accordion> <Accordion title="bootstrapHeadersHelper details">