Home Docs Claude Documentation

One capture · claude-docs

One read of Claude Documentationclaude-docs-20261103T190707Z

6 pages moved out of 281 read.

Pages moved 6 significant first

Pages read 281 in this capture

Captured 3 Nov 2026 19:07 UTC

Corpus hash b52d17314f32 corpus-hash

What this read moved

1-6 of 6

third-party/claude-desktop/status-line Changed · +60 / -13 lines

### Status line scripts on Windows

from line 56

5656* **macOS profile or Windows registry**: write the value as a [JSON string](https://claude.com/docs/third-party/claude-desktop/configuration-format.md#value-types-in-a-profile-or-registry-policy)

5757* **Bootstrap server**: the key applies after the user approves it in a dialog, unless the device [trusts the server's values without prompting](https://claude.com/docs/third-party/claude-desktop/bootstrap.md#keys-that-require-user-consent)

5858

59If one configuration serves several operating systems, such as a bootstrap server's response, add `platformOverrides` with a `command` under `win32` (Windows), `darwin` (macOS), or `linux`. In a macOS profile, a Windows registry policy, or the [Linux configuration file](https://claude.com/docs/third-party/claude-desktop/configuration-format.md#the-linux-configuration-file), set only `command`. Versions before 4.16336.0 reject the whole key and show no status line, so add `platformOverrides` only after every device has updated. The top-level `command` is required and runs on any system you don't list:

61```json theme={null}

62{

63 "sessionStatusLine": {

64 "command": "/opt/example/bin/status-line",

65 "platformOverrides": {

66 "win32": { "command": "C:\\Program Files\\Example\\status-line.ps1" }

67 }

68 }

69}

70```

5972**3. Restart Claude Desktop and check the line**

6073

6174Quit and reopen Claude Desktop, then open an existing session, or start a new one and send a message. The line appears above the message box.

6275

76On Claude Desktop 4.16336.0 or later, if [`inferenceModelPricingEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#inferencemodelpricingenabled) is also on, the status line replaces the "Session cost (estimate)" line.

6378## Write the status line program

6479

6580Claude Desktop starts the status line program with no arguments and no window, as the user who runs Claude Desktop.

6681

67* **File type**: on macOS and Linux, an executable file, such as a compiled program or a script that starts with `#!`. On Windows, an `.exe` file or a `.ps1`, `.cmd`, or `.bat` script. A `.ps1` script runs in Windows PowerShell, not PowerShell 7.

82* **File type**: on macOS and Linux, an executable file, such as a compiled program or a script that starts with `#!`. On Windows, an `.exe` file or a `.ps1`, `.cmd`, or `.bat` script.

6883

6984* **Input**: one line of JSON on standard input, with the session ID and the model. A field with no value is left out, so handle a missing `model`.

7085

from line 87

7287 {"session_id":"local_1f0c2a9e-7b3d-4c58-9a16-5e2d8b40c7f3","model":{"id":"claude-sonnet-4-5","display_name":"Claude Sonnet 4.5"}}

7388 ```

7489

75* **Output**: the first non-empty line of standard output, up to 200 characters. Markup and links show as plain text. A line wider than the message box ends in "…" and shows in full on hover.

90* **Output**: the first non-empty line of standard output, read as UTF-8, up to 200 characters. Markup and links show as plain text. A line wider than the message box ends in "…" and shows in full on hover.

7691

77* **Colors**: text is gray by default. ANSI codes `31` to `36` and `91` to `96` show red, green, yellow, blue, magenta, and cyan, in shades that fit the light or dark theme, and `0` or `39` returns to gray. Other colors show gray, and codes such as bold have no effect.

92* **Colors**: text is gray by default. ANSI codes `31` to `36` and `91` to `96` show red, green, yellow, blue, magenta, and cyan, and `0` or `39` returns to gray. Other colors show gray, and codes such as bold have no effect.

7893

7994* **Paths**: the working directory is `/` (`System32` on Windows). `PATH` is `/usr/bin:/bin:/usr/sbin:/sbin`, or the System32, Windows, and Windows PowerShell folders on Windows, so call other tools by their full path.

8095

81* **Environment**: the app's variables, minus `ANTHROPIC_*`, `CLAUDE_*`, `ELECTRON_*`, and variables that make an interpreter load code, such as `PYTHONPATH`.

96* **Environment**: the app's variables, minus `ANTHROPIC_*`, `CLAUDE_*`, `ELECTRON_*`, `GIT_*`, and variables that change which code a program loads, such as `PYTHONPATH` or `LD_LIBRARY_PATH`.

8297

83* **Time limit**: 10 seconds, after which Claude Desktop stops the program and anything it started. On Windows, the time PowerShell takes to start counts toward the limit.

98* **Time limit**: 10 seconds, after which Claude Desktop stops the program and anything it started.

8499

100### Status line scripts on Windows

101

102A `.ps1` script runs in Windows PowerShell, not PowerShell 7.

103

104* **Execution policy**: if Group Policy allows only signed scripts, sign the `.ps1` script with a certificate that each device trusts, and add it to each device's Trusted Publishers store. If Group Policy turns scripts off, use a `.cmd` or `.exe` file.

105* **Encoding**: a script must print UTF-8, or characters outside ASCII can show as "�" or "?". In a `.ps1` script, set UTF-8 output in the first statement, as the [Windows sample](#sample-status-line-programs) does, and save the file as UTF-8 with BOM. In a `.cmd` or `.bat` script, put `chcp 65001 >nul` right after `@echo off`, and save the file as UTF-8 without BOM.

106

85107### Sample status line programs

86108

87Both samples print a budget line, `■■■■■■■■□□ 82% of $500 used this month`. The macOS and Linux sample reads its numbers from a file that your own scheduled job keeps up to date. The Windows sample prints fixed numbers and shows how a PowerShell script prints UTF-8, reads the input, and writes the escape character.

109Both samples print a budget line, `■■■■■■■■□□ 82% of $500 used this month`.

88110

89111> [tab] macOS and Linux

90112>

from line 169

147169

148170There's no timer, so new data shows the next time one of these happens.

149171

150If the program fails, prints nothing, or takes longer than 10 seconds, the line disappears and the user sees no error. The next successful run brings the line back.

172If the program exits with a code other than 0, prints nothing, or takes longer than 10 seconds, the line disappears and the user sees no error. The next successful run brings the line back.

151173

152174## Troubleshoot a missing status line

153175

154Search `main.log` in the [logs directory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#where-data-lives) on the user's device for `sessionStatusLine`. One entry can stand for many failures of the same kind, and the entries don't include the program's output.

176Search `main.log` in the [logs directory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#where-data-lives) on the user's device for `sessionStatusLine`. Claude Desktop doesn't log every failure of the same kind, so restart it after each fix. The entries don't include the program's output.

155177

178* **`Failed to parse managed config`** or **`was not applied`**: Claude Desktop rejected the whole key. A `Failed to parse` entry says what is wrong. A version before 4.16336.0 logs `sessionStatusLine.platformOverrides ignored`, so update that device.

156179* **`was not run`**: fix the cause the entry gives, such as a folder that users can write to or a Windows path outside `Program Files`

157* **`ended with exit code 127`**: a command that the script runs wasn't found, so call each tool by its full path

158* **`was stopped after 10 seconds`**: the program hit the [time limit](#write-the-status-line-program). On Windows, a `.ps1` script can be slow to start in the first minutes after Claude Desktop first launches. If the line appears after a later turn ends or the app regains focus, nothing needs fixing.

180* **`ended with exit code`**: any code other than 0 hides the line, even if the program printed one

181 * **macOS and Linux**: code 127 means that a command the script runs wasn't found, so call each tool by its full path

182 * **Windows**: a `.ps1` script that an [execution policy](#status-line-scripts-on-windows) blocks ends with code 1

183* **`was stopped after 10 seconds`**: the program hit the [time limit](#write-the-status-line-program). On Windows, a `.ps1` script can be slow to start for a few minutes after a user first opens Claude Desktop, and a `.cmd` or `.exe` file starts faster. If the line appears after a later turn ends or the app regains focus, nothing needs fixing.

159184* **No entry**: the program printed nothing, which isn't logged, or the key hasn't reached the app. Restart Claude Desktop and check [which configuration source applies](https://claude.com/docs/third-party/claude-desktop/configuration-format.md#which-configuration-source-applies-on-a-device).

185

186To see the program's own error messages, run it in a new terminal window with Claude Desktop's working directory and `PATH`:

187

188> [tab] macOS and Linux

189>

190> ```bash theme={null}

191> cd /

192> echo '{"session_id":"test"}' | env -i HOME="$HOME" PATH=/usr/bin:/bin:/usr/sbin:/sbin /opt/example/bin/status-line

193> echo "exit code: $?"

194> ```

195

196> [tab] Windows

197>

198> Paste these lines into PowerShell. They start a `.ps1` script with Claude Desktop's options and module path:

199>

200> ```powershell theme={null}

201> Set-Location "$env:SystemRoot\System32"

202> $env:PATH = "$env:SystemRoot\System32;$env:SystemRoot;$env:SystemRoot\System32\WindowsPowerShell\v1.0"

203> $env:PSModulePath = "$env:SystemRoot\System32\WindowsPowerShell\v1.0\Modules;$env:SystemRoot\System32\WindowsPowerShell\v1.0\Modules"

204> '{"session_id":"test"}' | powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Program Files\Example\status-line.ps1"

205> "exit code: $LASTEXITCODE"

206> ```

160207

third-party/claude-desktop/web-tools Changed · +23 / -2 lines

#### Unset allowlist in Code sessions

from line 160

160160

161161* **Web Fetch**: each host you list becomes a Claude Code `WebFetch` allow rule. The key doesn't block a fetch to another host. In Auto mode, which new Code sessions start in by default, and in bypass permissions mode, Claude Code doesn't ask the user before that fetch. For the other modes, see [WebFetch tool behavior](https://code.claude.com/docs/en/tools-reference#webfetch-tool-behavior).

162162* **Web Fetch controls**: to have the user approve every fetch, set `WebFetch` to `"ask"` in [`builtinToolPolicy`](https://claude.com/docs/third-party/claude-desktop/configuration#builtintoolpolicy), which also applies in Cowork and Chat. To remove the tool, see [Disabling web tools](#disabling-web-tools).

163* **Shell commands**: commands that run in [Claude Code's sandbox](https://claude.com/docs/third-party/claude-desktop/code.md#applied-as-managed-policy) reach only the hosts you list, and no host while the key is unset or empty. On Windows, and on Linux without Claude Code's sandbox dependencies, shell commands run unsandboxed and can reach any host your network allows. To keep Code off such devices, see [Disabling Code](https://claude.com/docs/third-party/claude-desktop/code.md#disabling-code). For SSH hosts, see [Sandbox status on the remote host](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md#sandbox-status-on-the-remote-host).

163* **Shell commands**: commands that run in [Claude Code's sandbox](https://claude.com/docs/third-party/claude-desktop/code.md#applied-as-managed-policy) reach only the hosts you list, and no host while the list is empty. For a key that isn't set, see [Unset allowlist in Code sessions](#unset-allowlist-in-code-sessions). On Windows, and on Linux without Claude Code's sandbox dependencies, shell commands run unsandboxed and can reach any host your network allows. To keep Code off such devices, see [Disabling Code](https://claude.com/docs/third-party/claude-desktop/code.md#disabling-code). For SSH hosts, see [Sandbox status on the remote host](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md#sandbox-status-on-the-remote-host).

164164

165While the key is unset, Claude Desktop turns on Claude Code's sandbox, including on a device that you set up yourself, for example with your own API key. On a device where the sandbox runs, the **Local sandbox** and **Strict sandbox mode** switches under **Settings > Claude Code** are on and locked, and the app says that your organization manages them. To let shell commands reach a host, add it to `coworkEgressAllowedHosts` in your configuration. On a device that you set up yourself, open the [in-app configuration window](https://claude.com/docs/third-party/claude-desktop/in-app-configuration.md), go to **Capabilities**, add the host under **Allowed egress hosts**, click **Apply Changes**, and then click **Save & Restart**.

165#### Unset allowlist in Code sessions

166

167The [in-app configuration window](https://claude.com/docs/third-party/claude-desktop/in-app-configuration.md) shows `coworkEgressAllowedHosts` as **Allowed egress hosts**, an unset key as **Not set**, and an empty list (`[]`) as **Allow none**. Where [Claude Code's sandbox](https://claude.com/docs/third-party/claude-desktop/code.md#applied-as-managed-policy) doesn't run, such as a Code session on Windows, shell commands run unsandboxed and can reach any host your network allows, whatever the key holds. To keep Code off those devices, see [Disabling Code](https://claude.com/docs/third-party/claude-desktop/code.md#disabling-code).

168

169When you deliver configuration through the Enterprise Admin Console, a bootstrap server, or a [managed source](https://claude.com/docs/third-party/claude-desktop/configuration-format.md#where-claude-desktop-reads-configuration-on-a-device) such as an MDM profile, an unset key turns on Claude Code's sandbox. Where the sandbox runs, shell commands in it reach no host, and the **Local sandbox** and **Strict sandbox mode** toggles under **Settings > Claude Code** are on and locked. To let shell commands reach a host, add it to `coworkEgressAllowedHosts` in your configuration.

170

171> [!WARNING]

172>

173> On a device whose only configuration is the local configuration file, including a file that you copy to the device with a script, an unset key doesn't turn on the sandbox by itself. Unless [`blockReadsOutsideWorkingDirectories`](https://claude.com/docs/third-party/claude-desktop/configuration#blockreadsoutsideworkingdirectories) is `true`, Claude Desktop doesn't limit the hosts that shell commands in Code sessions reach. Enrolling the device in MDM doesn't change that. What counts is a [managed source](https://claude.com/docs/third-party/claude-desktop/configuration-format.md#where-claude-desktop-reads-configuration-on-a-device) for Claude Desktop itself.

174>

175> To turn the sandbox on with no host allowed, set `coworkEgressAllowedHosts` to `[]` in the file. The device's user can edit the file, so to hold the setting, deliver the configuration from a managed source.

176

177If you set up the device yourself in the in-app configuration window ([single-machine setup](https://claude.com/docs/third-party/claude-desktop/installation.md#single-machine-setup)) and left **Allowed egress hosts** at **Not set**, go to **Settings > Claude Code** and check the **Local sandbox** toggle:

178

179* **The toggle is unlocked**: Code sessions follow your own Claude Code settings. While the toggle is off, shell commands run unsandboxed, and the session's permission mode and permission rules decide whether Claude Code asks you before it runs one. In Auto mode, the default for new Code sessions where the model supports it, a safety classifier decides instead of asking you. To run a local session's commands in the sandbox, turn on the toggle.

180* **The toggle is on and locked**: something else keeps the sandbox on, for example:

181 * **A [managed source](https://claude.com/docs/third-party/claude-desktop/configuration-format.md#where-claude-desktop-reads-configuration-on-a-device) on the device**: shell commands reach no host

182 * **Block reads outside working directories** turned on: shell commands reach no host

183 * **Allowed workspace folders** set, with neither of the other two: Claude Desktop doesn't limit the hosts, and [Claude Code's sandbox](https://code.claude.com/docs/en/sandboxing) decides which ones shell commands reach

184* **The toggle is missing, or is off and can't be changed**: the sandbox doesn't run on the device, so shell commands in local sessions run unsandboxed

185

186For what a list of hosts does, see [How the egress allowlist applies in Code sessions](#how-the-egress-allowlist-applies-in-code-sessions). To change the list, open the in-app configuration window, go to **Capabilities**, edit **Allowed egress hosts**, click **Apply Changes**, and then click **Save & Restart**. Removing the last host leaves **Allow none** selected, which allows no host. To unset the key again, select **Not set** once the list is empty.

166187

167188## Disabling web tools

168189

third-party/claude-desktop/code Changed · +1 / -1 lines

from line 50

5050| `userPluginMarketplacesEnabled` | When `false`, a `strictKnownMarketplaces` allowlist. See [Controlling user extensions](https://claude.com/docs/third-party/claude-desktop/extensions.md#controlling-user-extensions) for what the key does. |

5151| `builtinToolPolicy`, argument-scoped rules such as `Bash(curl *)` | A `permissions.ask` rule for each rule set to `"ask"`. |

5252

53The network and filesystem sandboxes apply on macOS, and on Linux devices and [SSH hosts](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md#managed-configuration-on-the-remote-host) with Claude Code's [sandbox dependencies](https://code.claude.com/docs/en/sandboxing) installed. Claude Code doesn't sandbox shell commands on Windows devices, and on a Linux device or SSH host without the dependencies commands run unsandboxed. When `coworkEgressAllowedHosts` contains `*` and `allowedWorkspaceFolders` is unset, Claude Desktop turns on neither sandbox. In all of these cases, `blockReadsOutsideWorkingDirectories` still confines Claude's file tools but can only ask the user to approve shell commands that read outside the working directories or that Claude Code can't verify. For what a remote session shows, see [Sandbox status on the remote host](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md#sandbox-status-on-the-remote-host).

53The network and filesystem sandboxes apply on macOS, and on Linux devices and [SSH hosts](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md#managed-configuration-on-the-remote-host) with Claude Code's [sandbox dependencies](https://code.claude.com/docs/en/sandboxing) installed. Claude Code doesn't sandbox shell commands on Windows devices, and on a Linux device or SSH host without the dependencies commands run unsandboxed. When `coworkEgressAllowedHosts` contains `*` and `allowedWorkspaceFolders` is unset, Claude Desktop turns on neither sandbox. In all of these cases, `blockReadsOutsideWorkingDirectories` still confines Claude's file tools but can only ask the user to approve shell commands that read outside the working directories or that Claude Code can't verify. On a device whose only configuration is the local configuration file, an unset `coworkEgressAllowedHosts` can also leave both sandboxes off. See [Unset allowlist in Code sessions](https://claude.com/docs/third-party/claude-desktop/web-tools.md#unset-allowlist-in-code-sessions). For what a remote session shows, see [Sandbox status on the remote host](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md#sandbox-status-on-the-remote-host).

5454

5555> [!WARNING]

5656>

third-party/claude-desktop/data-storage Changed · +1 / -1 lines

from line 184

184184In the window, users can clean up their own inactive sessions on the device, except pinned ones:

185185

186186* **Chats and Cowork tasks**: the app deletes them, including runs of scheduled tasks. It also deletes their outputs and their copies of attached files in the [application-data directory](#where-data-lives). For a chat, the app also deletes the live artifacts (interactive pages) that Claude created in the chat. Other files stay, such as the live artifacts of a Cowork task or of a [home-screen conversation that is a Cowork session](https://claude.com/docs/third-party/claude-desktop/unified-claude.md), the rest of `~/Claude/`, and files in folders that the user connected. The live artifacts of chats deleted before Claude Desktop 4.16336.0 stay too.

187* **Code sessions**: the app removes their [Git worktrees](https://code.claude.com/docs/en/worktrees) and, if the user chooses, deletes the sessions with their conversations

187* **Code sessions**: the app removes their [Git worktrees](https://code.claude.com/docs/en/worktrees) that have no uncommitted changes, except those it can't safely remove, such as a worktree that another session uses. It removes worktrees with uncommitted changes only if the user selects the **Also remove** checkbox, and then those changes are lost. If the user chooses, the app also deletes the sessions with their conversations, but not a session whose worktree stays.

188188

189189Users can't undo these deletions.

190190

third-party/claude-desktop/models Changed · +1 / -1 lines

from line 58

5858

5959With this entry, the picker shows `acme-claude-sonnet` with the controls of Claude Sonnet 5: its effort levels in Chat, Cowork, and Code, and its **Thinking** switch in Chat and Cowork. The model starts at Claude Sonnet 5's recommended level, and `defaultModelEffort` and `maxEffort` still apply. Claude Desktop still sends `name` to your provider. Through an LLM gateway, sessions also assume Claude Sonnet 5's [context window](https://claude.com/docs/third-party/claude-desktop/gateway.md#context-window-and-compaction).

6060

61If the ID contains a Claude model version, write the version with hyphens and set `behavesAs` to that same model. Whatever `behavesAs` says, sessions treat `acme-claude-sonnet-4.6` as Claude Sonnet 4 and send no effort level, but treat `acme-claude-sonnet-4-6` as Claude Sonnet 4.6. If the ID routes to a different model, use an ID without a version.

61If the ID contains a Claude model version, set `behavesAs` to that same model. If the ID routes to a different model, use an ID without a version. Whatever `behavesAs` says, sessions treat both `acme-claude-sonnet-4-6` and `acme-claude-sonnet-4.6` as Claude Sonnet 4.6. Before Claude Desktop 4.16336.0, sessions treat `acme-claude-sonnet-4.6` as Claude Sonnet 4 and send no effort level. Until every device runs Claude Desktop 4.16336.0 or later, write the model version with hyphens, such as `acme-claude-sonnet-4-6`.

6262

6363To check a value, go to **Help > Troubleshooting > Generate Diagnostic Report**, click **Export to file**, and open the saved `.zip` file:

6464

third-party/claude-desktop/ssh-remote-sessions Changed · +1 / -1 lines

from line 249

249249

250250### Sandbox status on the remote host

251251

252Claude Desktop asks Claude Code on the host whether the [sandbox](https://claude.com/docs/third-party/claude-desktop/code.md#applied-as-managed-policy) from your Claude Desktop policy is turned on and running there. If `coworkEgressAllowedHosts` contains `*` and `allowedWorkspaceFolders` is unset, your policy has no sandbox, and Claude Desktop doesn't ask. Requires Claude Desktop 2.26454.0 or later.

253253

254254The answer is Claude Code's own report, and Claude Desktop compares only part of it with your policy:

255255