One read of Claude Documentationclaude-docs-20261016T200709Z
4 pages moved out of 277 read.
Pages moved
4
significant first
Pages read
277
in this capture
Captured
20:07 UTC
Corpus hash
bb3aac9caf5a
corpus-hash
What this read moved
1-4 of 4cowork/changelog Changed · +14 / -0 lines
from line 18
1818
1919 **Code**
2020
21 * Added a Context card to the session rail, to the right of the conversation. On plans with usage limits, the ring under the message box now shows plan usage, and context usage is in this card. If the rail is hidden, use the Show session rail button at top right (not yet in third-party deployments).
22 * Added a session rail to the right of the conversation, with cards including the session's environment, context, connectors, outputs, changes, servers, and background tasks. Right-click a card's header to choose which cards show (not yet in third-party deployments).
23 * Added environments: save a folder, SSH host, cloud environment, or Remote Control machine, with a worktree and branch setting for each folder, and pick one when you start a session. "Save as environment" at the top of a session saves where it started (not yet in third-party deployments).
24 * Added nested sessions in local and SSH sessions: Claude can start a task in a separate session, which appears under the original session in the sidebar and reports back to it. In Settings > Claude Code, choose what happens when you ask for an unrelated task (not yet in third-party deployments).
25 * Added a box at the end of the conversation in local and SSH sessions that shows Claude's plan while it works. When a turn ends, the box can show a short recap with buttons for what to do next (not yet in third-party deployments).
26 * Changed the New session page: choose where Claude runs and which folder to use in the row under the message box, or pick a recent environment from the card on the page. For a Git folder, Branch and Worktree are at the bottom of the folder menu (not yet in third-party deployments).
27 * Changed the sidebar to group sessions by environment, or by folder or repository when there is no saved environment. Custom groups are now called sections (not yet in third-party deployments).
28 * Changed the sidebar's Filter button to Group and sort, which appears when you hover a group heading. Use it to change grouping or sorting, show routines or empty groups, or open View all for archived sessions (not yet in third-party deployments).
29 * Changed pull request controls to appear in the Changes card on the session rail, instead of in a bar above the message box. Each open pull request's menu has Auto-fix, Merge when ready, and auto-archive options (not yet in third-party deployments).
30 * Changed the folder and repository menu to appear in the Environment card on the session rail, next to the branch and Remote Control, instead of in the session's title bar (not yet in third-party deployments).
31 * Changed the row under the message box to hold the permission mode, one menu for model and effort, and the usage ring. The `+` menu and the microphone moved inside the message box (not yet in third-party deployments).
32 * Changed `/btw` in local sessions to open a side chat in a pane beside the session, with a tab for each side chat (not yet in third-party deployments).
33 * Changed permission requests and questions to appear in the conversation instead of above the message box. In local and SSH sessions, suggested tasks appear there too (not yet in third-party deployments).
2134 * Changed the Git operations the app runs for you (the commit and stash around a branch switch, the in-folder branch switch, and the push behind "Continue in cloud") to no longer run repository Git hooks; push Git LFS objects from a terminal before continuing in the cloud.
2235 * Removed the "Get started with Claude Code" checklist from the sidebar.
2336 * Fixed "Rewind to here" failing with "Can’t rewind to this message." on any message but the latest in cloud and self-hosted sessions.
from line 50
3750 **3P**
3851
3952 * Added support in the macOS and Linux apps for SSH sessions carrying on across an app restart, and automatic recovery on every platform when Claude Code on the host is lost mid-task while the app is running: the app restarts it and continues the task, even with nobody at the computer.
53 * (breaking) Changed what a failed `PreToolUse` hook does on Windows computers without Git for Windows: if it sets none of `shell`, `args`, or `onFailure`, it now blocks the tool call. Such a hook runs in PowerShell there, where a command written for Bash can fail, so a hook that matches every tool can block every tool call. This includes hooks in plugins and in Claude Code's managed settings (`managed-settings.json` or the Windows policy registry value), such as one that other software adds. Either install Git for Windows in its default location and then quit and reopen Claude, or put the hook's program in `command` and its arguments in `args`. Add `"onFailure": "block"` if a failed hook should still block the call.
4054 * Changed `claudeAiImport.automatic3pImport` to reinstall, without asking, the optional plugins that a user had switched on from any optional `allowedPluginMarketplaces` entry (GitHub, git, or a URL on any host) with the same source in the old and new organization, not only from the gateway or bootstrap origin. This includes computers that moved organizations before this version, at their first launch with it.
4155 * Changed `mcpPersistentAlwaysAllowEnabled` to also apply to Code sessions on the device, in WSL and over SSH: when it is `false`, MCP tool prompts offer "Allow for this session" instead of "Always allow", and scheduled tasks offer no lasting approval unless `mcpScheduledTaskApprovalLifetimeDays` is one day or more.
4256 * Changed Chat's file-analysis sandbox (`chatAdvancedFileAnalysisEnabled`) to reach the hosts in `coworkEgressAllowedHosts`, for example to install packages. As in Cowork, its commands run without an approval prompt. Before, it had no network access by default. With no list, or an empty one, it still has none.
third-party/claude-desktop/ssh-remote-sessions Changed · +22 / -1 lines
### Account that a remote session runs under ### Git commands fail with Read-only file system
from line 31
3131* The host restarts.
3232* After an update that includes a new remote server, Claude Desktop replaces the host's remote server at a later connection. This ends the engines under the old server. Claude Desktop can put the replacement off while it believes that work is running on that host.
3333* On a Linux or macOS host, 30 days pass without a connection from Claude Desktop to the remote server. The remote server then stops and ends its engines. Requires Claude Desktop 1.52386.0 or later.
34* Someone ends the engine's process on the host. To list or end the engines and the remote server yourself on a Linux or macOS host, see [Files and processes on the remote machine](https://code.claude.com/docs/en/desktop#files-and-processes-on-the-remote-machine). There the engine is called Claude Code, and the remote server the helper.
3435
3536While Claude Desktop is disconnected, the remote server keeps the most recent output of each running engine in a 16 MiB buffer. It drops older output, and the engine keeps running.
3637
from line 45
4445
4546For a task that uses these tools, have the user keep the device awake and connected. For other limits, see [Limits while Desktop is disconnected](https://code.claude.com/docs/en/desktop#limits-while-desktop-is-disconnected).
4647
48### Account that a remote session runs under
49
50On a Linux or macOS host, the remote server and the engine run as the SSH user. Installing and starting them takes no `sudo`. The shell commands and [MCP servers](#where-mcp-servers-run-in-a-remote-session) that the engine starts there also start as the SSH user. Review the SSH user's rights on the host, `sudo` rules included, as you would for a person who runs commands there.
51
4752### Alert the user with hooks on the host
4853
4954A [hook](https://code.claude.com/docs/en/hooks) is a command of yours that the engine runs on the host at a set point in a session. With hooks, the host can tell the user that a turn is waiting at a permission prompt, has finished, or has failed with an API error, including while Claude Desktop is disconnected. To set them up, add this `hooks` key to `~/.claude/settings.json` in the SSH user's home directory on the host before the user starts the session.
from line 305
300305
301306* For hosts behind a bastion, configure a `ProxyJump` or `ProxyCommand`. `ProxyJump` works only when the device's OpenSSH client carries the connection (the default on macOS and Linux). The built-in client refuses it. For the card that the user sees, see [Ask your IT administrator to set sshTransport to system-openssh](#ask-your-it-administrator-to-set-sshtransport-to-system-openssh).
302307* With the device's OpenSSH client, OpenSSH's own host key checking applies. For a host whose key isn't on record yet, where the app can show a prompt, it shows the key's fingerprint, asks the user whether to trust it, and records a trusted key in the user's `known_hosts` file, unless the user's own SSH configuration accepts new keys without asking. The app can't show a prompt on every connection, for example when it reconnects in the background. Distribute the host keys or a host certificate authority to the devices, so that each host's key is on record before users connect. `@cert-authority` entries are honored. A key that differs from the one on record for the host is refused, whatever the entry's `StrictHostKeyChecking` says, unless another setting in the SSH configuration that applies to the host takes that check away, such as `NoHostAuthenticationForLocalhost yes` for a host on a loopback address.
303* With the device's OpenSSH client, you can keep the app from asking users to trust the key of a host that isn't on record yet. Distribute the host keys in the client's system-wide `known_hosts` file, such as `/etc/ssh/ssh_known_hosts`, or distribute a host certificate authority. Then set `StrictHostKeyChecking yes`, for example under `Host *`, in the client's system-wide configuration file, such as `/etc/ssh/ssh_config`, which also governs other uses of that client, such as `git` over SSH. Where the SSH configuration that applies to a host has `StrictHostKeyChecking yes`, Claude Desktop doesn't ask the user to trust such a key, and `ssh` refuses the host if it can't verify the key. A key that differs from the one on record is handled the same way with or without this setting. The setting doesn't bind the user. By OpenSSH's own rules, `ssh` reads the user's `~/.ssh/config` before the system-wide file and keeps the first value it finds for a setting, so a `StrictHostKeyChecking` line there applies in place of yours. `ssh` also accepts a key that the user adds to their own `known_hosts` file, but under `yes` a connection from a terminal doesn't record the key.
308* With the device's OpenSSH client, you can keep the app from asking users to trust the key of a host that isn't on record yet. Distribute the host keys in the client's system-wide `known_hosts` file, such as `/etc/ssh/ssh_known_hosts`, or distribute a host certificate authority. Then set `StrictHostKeyChecking yes`, for example under `Host *`, in the client's system-wide configuration file, such as `/etc/ssh/ssh_config`, which also governs other uses of that client, such as `git` over SSH. Where the SSH configuration that applies to a host has `StrictHostKeyChecking yes`, Claude Desktop doesn't ask the user to trust such a key, and `ssh` refuses the host if it can't verify the key. A key that differs from the one on record is handled the same way with or without this setting. The setting doesn't bind the user. By OpenSSH's own rules, `ssh` reads the user's `~/.ssh/config` before the system-wide file and keeps the first value it finds for a setting, so a `StrictHostKeyChecking` line there applies in place of yours. `ssh` also accepts a key that the user adds to their own `known_hosts` file, but under `yes` a connection from a terminal doesn't record the key. A user who picks a host that `ssh` refuses sees "Couldn't connect to" followed by the host, with [SSH host key verification failed](#ssh-host-key-verification-failed) under **View details**.
304309* With the built-in client, the host's key must already be in the device's `~/.ssh/known_hosts` as a plain entry. The app does not prompt to accept a new key and does not evaluate `@cert-authority` entries, so have users connect once from a terminal before adding the host in the app.
305310* With the built-in client, an identity file protected by a passphrase is skipped, not prompted for. Load it into the SSH agent, or use an unencrypted key. With the device's OpenSSH client, the app asks for the passphrase once the host's key is verified, and skips the key if the user cancels.
306311* With the built-in client, a host reached through a `ProxyCommand` gets the same host key check as a host reached directly. Before Claude Desktop 2.9939.0, the built-in client skipped host key verification for such a host.
from line 338
333338
334339The host's key has changed, or it is not in the device's `~/.ssh/known_hosts` and was not trusted in the app (the built-in client never asks). Connect to the host from a terminal on the device to check and record the current key, then retry.
335340
341With the device's OpenSSH client (the default on macOS and Linux), if `StrictHostKeyChecking yes` applies to the host, connecting from a terminal doesn't record its key. Instead, check the key and add it to the system-wide `known_hosts` file, or give the host a certificate from your host certificate authority (see [SSH configuration on the device](#ssh-configuration-on-the-device)).
342
336343### Ask your IT administrator to set sshTransport to system-openssh
337344
338345The built-in client made the connection, and the host needs the device's OpenSSH client. Where the app can name a step, the card's title gives it, and the card's text gives the cause, either "Claude's built-in SSH library can't connect through a jump host (ProxyJump)." or "Claude's built-in SSH library can't check host keys against a certificate authority or another known\_hosts file."
from line 385
378385`[SESSION_LIMIT]` and `[SFTP_NOT_STARTED]` require Claude Desktop 2.31226.0 or later, and appear only when the device's OpenSSH client makes the connection. `[SESSION_LIMIT]` appears only on macOS and Linux devices. Their cards are titled `<host> allows too few SSH sessions per connection` and `SFTP doesn't start on <host>`.
379386
380387`[CLI_NOT_RUNNABLE]` and `[EXEC_NO_INPUT]` require Claude Desktop 2.37337.0 or later. `[EXEC_NO_INPUT]` appears only on Windows devices where the device's OpenSSH client makes the connection. Their cards are titled `Claude Code didn't run on <host>` and `<host> doesn't pass input to commands run over SSH`. From the same version, the card is titled `Couldn't copy Claude Code to <host>` where the app couldn't put its files on the host, and `Couldn't install Claude Code on <host>` where the engine's install failed, each for a cause with no card of its own.
388
389### Git commands fail with Read-only file system
390
391Git commands fail with this error when the user opens the session in a subfolder of a Git repository, on a Linux host where the sandbox from your policy runs. Git's message then reads, for example, `Unable to create '<path>/.git/index.lock': Read-only file system`. To find out whether the sandbox runs there, see [Sandbox status on the remote host](#sandbox-status-on-the-remote-host).
392
393The sandbox lets shell commands that Claude runs with its Bash tool write in the folder the session was opened in, and the repository's `.git` folder is outside that folder. Of these commands, the ones that write to the `.git` folder fail, such as `git add` and `git commit`. Have the user start a new session at the top of the repository.
394
395<Note>
396 These cases are covered elsewhere:
397
398 * **An `allowedWorkspaceFolders` entry with `mode` set to `ro`**: see [Read-only folders on the remote host](#read-only-folders-on-the-remote-host)
399 * **A message with `unable to unlink old`**: see [A git command fails with `unable to unlink old`](https://code.claude.com/docs/en/sandboxing#a-git-command-fails-with-unable-to-unlink-old)
400 * **The other places that the sandbox lets these commands write to**: see [Filesystem isolation](https://code.claude.com/docs/en/sandboxing#filesystem-isolation) and the `allowedWorkspaceFolders` row under [Applied as managed policy](/docs/third-party/claude-desktop/code#applied-as-managed-policy)
401</Note>
381402
382403## Related
383404
third-party/claude-desktop/claude-api Changed · +1 / -1 lines
from line 18
1818
1919| Setting | Type | Availability | Default | Description |
2020| - | - | - | - | - |
21| <span id="inferenceanthropicapikey" />Claude API key<br />`inferenceAnthropicApiKey` | `string` | MDM + Bootstrap<br />Added in 1.8089.0 | — | Leave blank to fetch a key via browser sign-in, or to supply the key via a credential helper. |
21| <span id="inferenceanthropicapikey" />Claude API key<br />`inferenceAnthropicApiKey` | `string` | MDM + Bootstrap<br />Added in 1.8089.0 | — | Leave blank to sign in with your browser, or to supply the key via a credential helper. |
2222
third-party/claude-desktop/configuration Changed · +1 / -1 lines
from line 161
161161
162162| Setting | Type | Availability | Default | Description |
163163| - | - | - | - | - |
164| <span id="inferenceanthropicapikey" />Claude API key<br />`inferenceAnthropicApiKey` | `string` | MDM + Bootstrap<br />Added in 1.8089.0 | — | Leave blank to fetch a key via browser sign-in, or to supply the key via a credential helper. |
164| <span id="inferenceanthropicapikey" />Claude API key<br />`inferenceAnthropicApiKey` | `string` | MDM + Bootstrap<br />Added in 1.8089.0 | — | Leave blank to sign in with your browser, or to supply the key via a credential helper. |
165165
166166### Bedrock
167167