One read of Claude Documentationclaude-docs-20261106T193706Z
10 pages moved out of 281 read.
Pages moved
10
significant first
Pages read
281
in this capture
Captured
19:37 UTC
Corpus hash
07d445f02eaa
corpus-hash
What this read moved
1-10 of 10government/account/overview Changed · +3 / -3 lines
from line 12
1212
1313## What's here
1414
15<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-05-your-account-usage-limits-and-getting-help.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=691f1dc9497295c364c0e8f81020b942" aria-label="Video walkthrough: Your account, usage limits, and getting help" />
15<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gRdviWIlfWMOOdqO/images/government/videos/user-05-your-account-usage-limits-and-getting-help-v3.mp4?fit=max&auto=format&n=gRdviWIlfWMOOdqO&q=85&s=51cbb68408f3ca928c1c4266f54b313f" aria-label="Video walkthrough: Your account, usage limits, and getting help" />
1616
17Video: Your account, usage limits, and getting help (1 min 57 s). Narrated with an AI-generated voice, with on-screen captions.
17Video: Your account, usage limits, and getting help (1 min 54 s). Narrated with an AI-generated voice, with on-screen captions.
1818
1919> [accordion] Transcript
2020>
21> Your account pages are in the web portal. In a browser, open your agency's Claude for Government address and sign in. Account shows your email, organization, role, and seat tier, all read-only.
21> Your account pages are in the web portal. In a browser, open your agency's Claude for Government address followed by /gateway, and sign in. Account shows your email, organization, role, and seat tier, all read-only.
2222>
2323> Usage shows your allowance: a 5-hour window and a 7-day window, each with the share you have used and when it resets. If either reaches 100 percent, Claude pauses until that window resets.
2424>
government/desktop/import Changed · +4 / -4 lines
from line 41
4141
4242## Run the import
4343
44<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/E-5jO-7jUk7PUSA3/images/government/videos/user-02-bringing-your-chats-and-projects-over-v3.mp4?fit=max&auto=format&n=E-5jO-7jUk7PUSA3&q=85&s=ad5cab0c028626b511eac61a29653fbf" aria-label="Video walkthrough: Bringing your chats and projects over from Claude for Government Web" />
44<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/G8LW177rlshvdwBY/images/government/videos/user-02-bringing-your-chats-and-projects-over-v4.mp4?fit=max&auto=format&n=G8LW177rlshvdwBY&q=85&s=6e910cb7502932bbc23e9a0e43a5ae91" aria-label="Video walkthrough: Bringing your chats and projects over from Claude for Government Web" />
4545
46Video: Bringing your chats and projects over from Claude for Government Web (2 min 11 s). Narrated with an AI-generated voice, with on-screen captions.
46Video: Bringing your chats and projects over from Claude for Government Web (2 min 9 s). Narrated with an AI-generated voice, with on-screen captions.
4747
4848> [accordion] Transcript
4949>
from line 59
5959>
6060> Select Continue, review what will be added, then select Import. When it finishes, the dialog reports what came over. Select Done.
6161>
62> Your conversations appear in the sidebar with their files, and your projects under Projects with their files and instructions. Projects other people shared with you do not come over.
62> Your conversations appear in the sidebar, and your projects under Projects. Projects other people shared with you do not come over.
6363>
6464> Imported chats open in Chat. The first time you continue one, Claude asks whether to resume the imported session. Select Trust and resume to continue the conversation.
6565>
6666> A project that had instructions shows a notice. Claude won't follow imported instructions until you accept them: select Review instructions, check them, and save, or choose Use as is.
6767>
68> The import only copies. Your chats and projects stay in the web app too. You can run it again, and chats already imported are skipped. If the Import and export page says import isn't enabled, update Claude Desktop. If it still says so, ask your administrator.
68> The import only copies. You can run it again, and chats already imported are skipped. If the Import and export page says import isn't enabled, update Claude Desktop. If it still says so, ask your administrator.
6969
7070You start the import yourself from **Settings**, whenever you are ready. If Claude Desktop's home screen shows a **Pick up where you left off in Claude for Government Web** banner, its **Start import** button takes you to the **Import & export** page in **Settings**. If you click **Skip for now** or close the banner, it can come back a few days later, until you run the import or have skipped it a few times. Claude Desktop versions earlier than 2.16120.0 hide the banner permanently after one skip.
7171
government/desktop/video-walkthroughs Changed · +14 / -14 lines
from line 44
4444
4545Copying your conversations and projects from Claude for Government Web into Claude Desktop. Read more: [Run the import](https://claude.com/docs/government/desktop/import.md#run-the-import).
4646
47<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/E-5jO-7jUk7PUSA3/images/government/videos/user-02-bringing-your-chats-and-projects-over-v3.mp4?fit=max&auto=format&n=E-5jO-7jUk7PUSA3&q=85&s=ad5cab0c028626b511eac61a29653fbf" aria-label="Video walkthrough: Bringing your chats and projects over from Claude for Government Web" />
47<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/G8LW177rlshvdwBY/images/government/videos/user-02-bringing-your-chats-and-projects-over-v4.mp4?fit=max&auto=format&n=G8LW177rlshvdwBY&q=85&s=6e910cb7502932bbc23e9a0e43a5ae91" aria-label="Video walkthrough: Bringing your chats and projects over from Claude for Government Web" />
4848
49Video: Bringing your chats and projects over from Claude for Government Web (2 min 11 s). Narrated with an AI-generated voice, with on-screen captions.
49Video: Bringing your chats and projects over from Claude for Government Web (2 min 9 s). Narrated with an AI-generated voice, with on-screen captions.
5050
5151> [accordion] Transcript
5252>
from line 62
6262>
6363> Select Continue, review what will be added, then select Import. When it finishes, the dialog reports what came over. Select Done.
6464>
65> Your conversations appear in the sidebar with their files, and your projects under Projects with their files and instructions. Projects other people shared with you do not come over.
65> Your conversations appear in the sidebar, and your projects under Projects. Projects other people shared with you do not come over.
6666>
6767> Imported chats open in Chat. The first time you continue one, Claude asks whether to resume the imported session. Select Trust and resume to continue the conversation.
6868>
6969> A project that had instructions shows a notice. Claude won't follow imported instructions until you accept them: select Review instructions, check them, and save, or choose Use as is.
7070>
71> The import only copies. Your chats and projects stay in the web app too. You can run it again, and chats already imported are skipped. If the Import and export page says import isn't enabled, update Claude Desktop. If it still says so, ask your administrator.
71> The import only copies. You can run it again, and chats already imported are skipped. If the Import and export page says import isn't enabled, update Claude Desktop. If it still says so, ask your administrator.
7272
7373### Connectors, plugins, and skills from your agency
7474
7575Connecting Microsoft 365, installing plugins your organization offers, and adding a skill, all from **Customize** in the sidebar. Read more: [Plugins in Claude Desktop](https://claude.com/docs/government/desktop/plugins.md) and [Skills in Claude Desktop](https://claude.com/docs/government/desktop/skills.md).
7676
77<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-04-connectors-plugins-and-skills.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=953d050db0ec38bd9d0db7399e96cf40" aria-label="Video walkthrough: Connectors, plugins, and skills from your agency" />
77<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/z_GoItRVM-_PvPPB/images/government/videos/user-04-connectors-plugins-and-skills-v2.mp4?fit=max&auto=format&n=z_GoItRVM-_PvPPB&q=85&s=eaffd949e3db69655dc5f51403a9978b" aria-label="Video walkthrough: Connectors, plugins, and skills from your agency" />
7878
79Video: Connectors, plugins, and skills from your agency (2 min 6 s). Narrated with an AI-generated voice, with on-screen captions.
79Video: Connectors, plugins, and skills from your agency (2 min). Narrated with an AI-generated voice, with on-screen captions.
8080
8181> [accordion] Transcript
8282>
8383> Open Customize in the sidebar for your skills, connectors, and plugins. A connector lets Claude reach another service. The ones you can use come from your organization: here, Microsoft 365 and Web Search.
8484>
85> If your organization has set up Microsoft 365, select Connect and sign in with your Microsoft work account. Claude can then search your mail, calendar, files, and Teams chats, reaching only what you can already open.
85> If your organization has set up Microsoft 365, select Connect and sign in with your Microsoft work account. Claude can then search your mail, calendar, and files, and can read your chats in Teams, reaching only what you can already open.
8686>
87> In a chat, ask about your mail, and Claude asks before it searches. The card shows the search it wants to run. Allow it once, allow it for this task, or deny it.
87> In a chat, ask about your mail, and Claude asks before it searches. You can allow it once, always allow it, or deny it.
8888>
8989> A plugin packages skills and commands from your organization. Plugins lists the ones already installed. Some install automatically. Open one to see its skills and switch it on or off.
9090>
91> To find the rest, select Browse and open the Organization tab, which lists everything your organization offers you. Each plugin's plus sign installs it, and it then appears under Plugins.
91> To find the rest, select Discover and open the Organization tab, which lists everything your organization offers you. Select a plugin's plus sign to install it, and it then appears under Plugins.
9292>
9393> A skill teaches Claude one task your way, set up once and reused. If your organization allows it, select Add under Skills. Upload skill takes a skill file you have, and Create a skill lets you write one.
9494>
from line 102
102102
103103The **Account**, **Usage**, and **Sessions** pages, signing in again after an idle timeout, the diagnostic report, and who to ask for what. Read more: [Your account](https://claude.com/docs/government/account/overview.md).
104104
105<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-05-your-account-usage-limits-and-getting-help.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=691f1dc9497295c364c0e8f81020b942" aria-label="Video walkthrough: Your account, usage limits, and getting help" />
105<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gRdviWIlfWMOOdqO/images/government/videos/user-05-your-account-usage-limits-and-getting-help-v3.mp4?fit=max&auto=format&n=gRdviWIlfWMOOdqO&q=85&s=51cbb68408f3ca928c1c4266f54b313f" aria-label="Video walkthrough: Your account, usage limits, and getting help" />
106106
107Video: Your account, usage limits, and getting help (1 min 57 s). Narrated with an AI-generated voice, with on-screen captions.
107Video: Your account, usage limits, and getting help (1 min 54 s). Narrated with an AI-generated voice, with on-screen captions.
108108
109109> [accordion] Transcript
110110>
111> Your account pages are in the web portal. In a browser, open your agency's Claude for Government address and sign in. Account shows your email, organization, role, and seat tier, all read-only.
111> Your account pages are in the web portal. In a browser, open your agency's Claude for Government address followed by /gateway, and sign in. Account shows your email, organization, role, and seat tier, all read-only.
112112>
113> Usage shows your allowance: a 5-hour window and a 7-day window, each with the share you have used and when it resets. If either reaches 100 percent, Claude pauses until that window resets. Claude Desktop itself does not show this allowance.
113> Usage shows your allowance: a 5-hour window and a 7-day window, each with the share you have used and when it resets. If either reaches 100 percent, Claude pauses until that window resets.
114114>
115115> Sessions lists every place you are signed in, whether in a browser or in Claude Desktop, and when each sign-in began. To sign out a computer you no longer have, select Sign out on its row.
116116>
from line 120
120120>
121121> If something isn't working, your help desk may ask for a diagnostic report. From Help, choose Troubleshooting, then Generate Diagnostic Report.
122122>
123> The dialog lists what goes in: app and system details, your configuration with secrets removed, network checks, and recent errors. It never includes your conversations. Select Export to file and attach the file to your ticket.
123> In the dialog that opens, select Export to file. Then review the files in the saved .zip file before you attach it to your ticket, so you know what you are sharing.
124124>
125125> Who to ask: your organization's owner for a seat, a larger allowance, or a wrong organization or role. Your IT help desk for anything about the app on your computer. Your administrators can take it from there.
126126
third-party/claude-desktop/admin-console Changed · +9 / -1 lines
from line 493
493493
494494You can use `forceLoginOrgUUID` to help prevent shadow IT, which here means people using personal Claude accounts or other organizations' accounts in Claude Desktop on work computers. A user who signs in to standard Claude Desktop with an account that isn't in your organization sees a page that reads "This account is not approved by your enterprise admin" and can only log out.
495495
496Claude Desktop 4.16336.0 or later checks **Sign in with Claude Console** against the `forceLoginOrgUUID` in the device's managed profile. Users see that sign-in where the profile [selects the Claude API with no static key or credential helper](https://claude.com/docs/third-party/claude-desktop/claude-api.md#choose-an-authentication-approach). If the key leaves out the Claude Console organization that a user selects, the app records a warning in `main.log` and still uses the sign-in. A later release stops using a sign-in that the key leaves out. Where `forceLoginOrgUUID` is set, that release also stops using an API key that a version before 3.1623.0 [created at sign-in](https://claude.com/docs/third-party/claude-desktop/claude-api.md#choose-an-authentication-approach), whatever IDs it lists, until the device's next sign-in.
497
498A user whose organization the key leaves out also sees a notice that reads "Your Claude Console sign-in will stop working after a future update". The notice gives the ID of that Claude Console organization, and the user can dismiss it. A user whose device still uses an API key from before 3.1623.0 sees the same notice, whatever IDs `forceLoginOrgUUID` lists. For that user it gives no ID and says to sign out and sign in again. The notice requires Claude Desktop 4.23118.0 or later.
499
500* **Add the organization:** a Claude Console organization has its own ID. In Claude Console, go to [**Settings > Organization**](https://platform.claude.com/settings/organization) and copy the **Organization ID**. Add the ID of each Claude Console organization that you allow to `forceLoginOrgUUID`, in a JSON array with your Claude organization's ID.
501* **Check a device:** search `main.log`, and any numbered copies beside it such as `main1.log`, in the [logs directory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#where-data-lives) on the user's device for `coming release`. If a warning names the ID of a Claude Console organization that you allow, add that ID. Otherwise, have the user sign out and sign in again with a Claude Console organization that the key lists.
502* **Before a user signs in again:** unless [`deploymentOrganizationUuid`](https://claude.com/docs/third-party/claude-desktop/configuration#deploymentorganizationuuid) is set, the app stores sessions and other local data under the organization of the sign-in. After a sign-in to another organization, earlier data can stop appearing in the app. Setting that key now has the same effect. Neither deletes the earlier sessions.
503
496504To deploy `forceLoginOrgUUID`:
497505
4985061. Update devices to Claude Desktop 2.37337.0 or later. Earlier versions ignore the admin console when this key is set.
4995072. In the admin console, copy the **Key** and the **Value** from the **Allow only this organization with device management (MDM)** row, under **Desktop sign-in** on the **Connection** page.
5003. Add the key and value to the device's managed profile, in one of the [locations the app reads](https://claude.com/docs/third-party/claude-desktop/mdm.md#4-deploy-the-configuration). Enter the ID without braces or quotation marks. In the Windows registry, make it a String value (`REG_SZ`). For more than one organization, enter a JSON array of IDs, such as `["ID-1","ID-2"]`.
5083. Add the key and value to the device's managed profile, in one of the [locations the app reads](https://claude.com/docs/third-party/claude-desktop/mdm.md#4-deploy-the-configuration). Enter a single ID without braces or quotation marks. In the Windows registry, make it a String value (`REG_SZ`). For more than one organization, enter a JSON array of IDs as one string value, such as `["ID-1","ID-2"]`.
5015094. Restart Claude Desktop after the profile reaches the device.
502510
503511If the value lists only other IDs, or the app can't read it, the app uses only the profile and the console's settings stop applying. Correct the value and restart Claude Desktop. If the device doesn't return to the console's configuration, its user signs in to your organization again, as described under [Devices with a managed profile](#devices-with-a-managed-profile).
third-party/claude-desktop/import Changed · +5 / -3 lines
from line 281
281281
282282## Troubleshoot an import or export
283283
284For an export file from another device, see [Problems when you move to another device](#problems-when-you-move-to-another-device).
285
284286Claude Desktop runs each claude.ai import through the Claude CLI binary, the [helper program](https://claude.com/docs/third-party/claude-desktop/installation.md#endpoint-security-software) that also runs your conversations. Unless your organization deploys the [offline installer](https://claude.com/docs/third-party/claude-desktop/installation.md#offline-installation), Claude Desktop downloads the version of the binary it needs separately from the app, when you start a new conversation or task. If this computer doesn't have that version when you click **Import**, Claude Desktop 4.23118.0 or later tries to download it first, and the wizard shows **Downloading the program that converts your chats…** while you wait.
285287
286288### The import can’t start until a one-time download finishes
287289
288The wizard shows this message when this computer has no version of the Claude CLI binary that can import a claude.ai export, and the download isn't finished. A running download continues after the message appears. Running the import again retries a failed download. Wait a few minutes, then run the import again.
290The wizard shows this message when this computer has no version of the Claude CLI binary that can import a claude.ai export, and the download isn't finished. If you sign in to fetch the export, the message can appear right after you click **Fetch export**, under **Couldn’t fetch your export**. A running download continues after the message appears. Running the import again retries a failed download. Wait a few minutes, then run the import again.
289291
290292If the message comes back, ask your administrator to follow [Cowork workspace or Claude CLI fails to download](https://claude.com/docs/third-party/claude-desktop/installation.md#cowork-workspace-or-claude-cli-fails-to-download) and to leave any earlier version of the binary in place.
291293
from line 295
293295
294296When an import fails and the wizard has no specific message for the cause, it shows a code, such as `IMPORTER_EXIT`, with **Import failed**, **Your claude.ai export didn’t import**, or **Couldn’t import this export**. If you can import only by signing in, the message asks you to sign in and fetch the export again. On Claude Desktop versions before 4.23118.0, the wizard shows no code, and if you can choose a file, it shows [That doesn’t look like a claude.ai export](#that-doesn%E2%80%99t-look-like-a-claude-ai-export) for these failures.
295297
296Your export can still be valid. If you import with **Choose file…**, use each `.zip` file as you downloaded it, not renamed or compressed again. On Windows, keep each file's full path under 260 characters, for example by moving it to your Downloads folder.
298Your claude.ai export can still be valid. If you import with **Choose file…**, use each `.zip` file as you downloaded it, not renamed or compressed again. On Windows, keep each file's full path under 260 characters, for example by moving it to your Downloads folder.
297299
298300If you signed in to fetch the export and the wizard still shows **Import**, click it again without closing the wizard. Closing the wizard deletes the fetched export. There's a limit on how often you can fetch an export. In any other case, run the import again from **Settings > Import & export**.
299301
from line 305
303305
304306Choose the `.zip` file of your [claude.ai export](#step-1-claude-ai-chats-and-projects) as you downloaded it. If the export came as more than one `.zip` file, choose all of them together.
305307
306On Claude Desktop versions before 4.23118.0, the message can also appear after you click **Import** on the **Review** step. Your export can still be valid. Close the wizard, send any message in a new conversation or task, and wait for the reply, so the import can run on the current version of the Claude CLI binary. Closing the wizard deletes an export that you fetched by signing in, so fetch it again. Then follow the steps in [Import failed with a code under the message](#import-failed-with-a-code-under-the-message). These versions show no code.
308On Claude Desktop versions before 4.23118.0, the message can also appear after you click **Import** on the **Review** step. Your claude.ai export can still be valid. Close the wizard, send any message in a new conversation or task, and wait for the reply, so the import can run on the current version of the Claude CLI binary. Closing the wizard deletes an export that you fetched by signing in, so fetch it again. Then follow the steps in [Import failed with a code under the message](#import-failed-with-a-code-under-the-message). These versions show no code.
307309
308310### Importing a claude.ai export needs a newer version of this app
309311
third-party/claude-desktop/installation Changed · +17 / -4 lines
from line 130
130130
131131### Cowork workspace or Claude CLI fails to download
132132
133Claude Desktop downloads the VM workspace bundle that Cowork uses and the Claude CLI binary (the agent helper described under [Endpoint security software](#endpoint-security-software)) from `downloads.claude.ai` whenever a device does not have the versions the app needs. When the workspace download fails or the downloaded file does not pass verification, the app shows **Couldn't download Claude's workspace** or **Failed to start Claude's workspace**, with the download error under it, for example a message that begins "Claude's workspace download was not the expected file", "Claude's workspace download could not be unpacked on this computer", "Checksum mismatch", "Download failed", or "Request error". When the Claude CLI download fails on a device that has no earlier copy, Chat conversations and Cowork tasks fail to start with "Host Claude Code binary not available. Check that the download completed."
133Claude Desktop downloads the VM workspace bundle that Cowork uses and the Claude CLI binary (the agent helper described under [Endpoint security software](#endpoint-security-software)) from `downloads.claude.ai` whenever a device does not have the versions the app needs. A failed download has these signs:
134134
135Restarting the app tries the download again, which is enough when an earlier attempt was only interrupted. When the same message returns on every attempt, the usual cause is a proxy, secure web gateway, or web filter between the device and `downloads.claude.ai`. Such equipment can block the app's requests, cut off the transfer partway (the workspace bundle is more than 1 GB), or return its own page in place of the file. Less often, security software on the device locks or quarantines the downloaded files.
135* **Workspace**: when the download fails or the downloaded file does not pass verification, the app shows **Couldn't download Claude's workspace** or **Failed to start Claude's workspace**, with the download error under it, for example a message that begins "Claude's workspace download was not the expected file", "Claude's workspace download could not be unpacked on this computer", "Checksum mismatch", "Download failed", or "Request error".
136* **Claude CLI binary, no earlier version on the device**: Chat conversations and Cowork tasks fail to start with "Host Claude Code binary not available. Check that the download completed."
137* **Claude CLI binary, earlier version on the device**: Chat conversations and Cowork tasks still run on that version. The first sign of the failure can be a message in the [claude.ai import wizard](https://claude.com/docs/third-party/claude-desktop/import.md#troubleshoot-an-import-or-export). Don't remove that version. Conversations and tasks need it until the download succeeds.
136138
139If an earlier attempt was only interrupted, another attempt is enough. To start another attempt, have the user do one of these for the download that failed:
140
141* **Workspace**: start or open a Cowork task, or click **Retry** on the **Couldn't download Claude's workspace** message. Where Cowork is on, the app also tries this download after a restart, unless [`disableAutoUpdates`](https://claude.com/docs/third-party/claude-desktop/configuration#disableautoupdates) is `true`.
142* **Claude CLI binary**: start a new conversation or task. The app also tries this download after a restart, unless [`isClaudeCodeForDesktopEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#isclaudecodefordesktopenabled) is `false`, which turns Code off. Claude Desktop 4.23118.0 or later also tries this download when the user clicks **Import** in the import wizard.
143
144When the same message returns on every attempt, the usual cause is a proxy, secure web gateway, or web filter between the device and `downloads.claude.ai`. Such equipment can block the app's requests, cut off the transfer partway (the workspace bundle is more than 1 GB), or return its own page in place of the file. Less often, security software on the device locks or quarantines the downloaded files.
145
146To see whether the app reaches `downloads.claude.ai`, generate the [diagnostic report](#troubleshooting) on the device and open `reachability.txt` in the `.zip` file. The line for `downloads.claude.ai` starts with `✗` when the app's request failed and with `✓` when the app got any answer. That answer can come from a proxy. A `✓` doesn't show that files arrive complete.
147
148Make the change that fits your network:
149
137150* Allow Claude Desktop itself, not only browsers, to reach `downloads.claude.ai`, as listed under [Required egress paths](https://claude.com/docs/third-party/claude-desktop/telemetry.md#required-egress-paths). The download follows the app's proxy settings, described under [Network proxy](https://claude.com/docs/third-party/claude-desktop/network-proxy.md).
138151* If a proxy or secure web gateway inspects this traffic, make sure files from `downloads.claude.ai` reach the device complete and unchanged.
139152* On a network that cannot allow these downloads, deploy the [offline installer](#offline-installation), which includes both components.
140153
141Once the device can download from `downloads.claude.ai`, have the user restart Claude Desktop and start a new conversation or task, so that the app downloads what is missing. If the messages persist, generate the diagnostic report described under [Troubleshooting](#troubleshooting) and send it to your Anthropic representative. It includes the errors the app logged for these downloads.
154Once the device can download from `downloads.claude.ai`, have the user restart Claude Desktop and then start another attempt at each download that failed. If the messages persist, generate the diagnostic report described under [Troubleshooting](#troubleshooting) and send it to your Anthropic representative. It includes the errors the app logged for these downloads.
142155
143156### Windows security policy blocks the Cowork workspace
144157
third-party/claude-desktop/ssh-remote-sessions Changed · +33 / -19 lines
from line 188
188188To prevent or limit the move, set one of these keys in the profile itself:
189189
190190* **Keep the device on its profile**: set [`disableDeploymentModeChooser`](https://claude.com/docs/third-party/claude-desktop/configuration#disabledeploymentmodechooser) to `true`. The app ignores the admin console, and the sign-in screen doesn't offer **Or sign in with Claude.ai**. A device that has already moved returns to its profile at its next launch.
191* **Allow only your organization**: set [`forceLoginOrgUUID`](https://claude.com/docs/cowork/hipaa-setup#what-each-claude-desktop-key-does) to your organization ID, and set the SSH keys you rely on in the console too. The key also limits standard Claude Desktop sign-in on the device to your organization.
191* **Allow only your organization**: set [`forceLoginOrgUUID`](https://claude.com/docs/cowork/hipaa-setup#what-each-claude-desktop-key-does) to your organization ID, and set the SSH keys you rely on in the console too. The key also limits standard Claude Desktop sign-in on the device to your organization. If users click **Sign in with Claude Console**, also add the ID of each Claude Console organization that you allow, as described under [Keep a device on its managed profile](https://claude.com/docs/third-party/claude-desktop/admin-console.md#keep-a-device-on-its-managed-profile).
192192
193193Before you add either key to a profile that sets only [app-behavior keys](https://claude.com/docs/third-party/claude-desktop/mdm.md#update-keys-and-managed-precedence), such as `disableAutoUpdates`, read the warning under [Keep a device on its managed profile](https://claude.com/docs/third-party/claude-desktop/admin-console.md#keep-a-device-on-its-managed-profile).
194194
from line 269
269269| Your organization's sandbox policy isn't fully applied on `<host>`, so shell commands there may run outside it | `overridden` | Claude Code managed settings on the host replace your policy, even when they say nothing about the sandbox, or they turn the sandbox off or loosen it | Set `parentSettingsBehavior` to `"merge"` in the host's managed settings, and remove `sandbox` values there that conflict with your policy |
270270| No message | `unknown` | Claude Code gives no answer that Claude Desktop can read | In a session on that host, ask Claude to run the two commands under [Confirm commands run inside the sandbox](https://code.claude.com/docs/en/sandboxing#confirm-commands-run-inside-the-sandbox) |
271271
272> [!NOTE]
273>
274> On a device where the [local configuration file governs](#sandbox-from-the-host%E2%80%99s-managed-settings), Claude Desktop 4.16336.0 or later words these messages differently. They name `the sandbox from your inference configuration`, not your organization's sandbox or sandbox policy.
275
272276The fix for the `overridden` message and the fix for the message under [Policy status on the remote host](#policy-status-on-the-remote-host) start at the same setting, `parentSettingsBehavior`. With Claude Desktop 3.6556.1 or later, a session that shows one of the two messages doesn't add the other until the first no longer applies. Your collector still receives the event of the check whose message is held back, and the **Sandbox** row of `/status` still shows the sandbox's state.
273277
274278To check one session, have the user open it, wait until Claude has finished replying, and enter `/status` in the message box. Where your policy includes the sandbox, the **Session info** card shows what Claude Desktop last learned in a **Sandbox** row. Requires Claude Desktop 2.31226.0 or later. Find the value's `reason` in the table of messages and reasons for the cause and the fix:
from line 325
321325Your organization's policy isn't fully applied on <host>. Ask your admin to check parentSettingsBehavior in that host's Claude Code managed settings.
322326```
323327
328> [!NOTE]
329>
330> On a device where the local configuration file governs, Claude Desktop 4.16336.0 or later starts the message with `The policy from your inference configuration`, and doesn't mention an admin. The message after a fix starts with the same words.
331
324332A session that shows one of the two messages doesn't add the other until the first no longer applies. Your collector still receives the event of the check whose message is held back.
325333
326334To fix the host, set `parentSettingsBehavior` to `"merge"` in the host's Claude Code managed settings, which otherwise replace your policy. See [Managed configuration on the remote host](#managed-configuration-on-the-remote-host). Claude Desktop asks again when Claude Code starts, when Claude Desktop rejoins a running Claude Code process, and after each turn. Once the check passes again, a session that still shows the message also shows "Your organization's policy applies on `<host>` again."
from line 357
349357* On a Linux host, glibc 2.17 or later, or musl. The Claude Code engine is a single executable, and its glibc build links only against glibc's own libraries. Version 2.17 is the oldest glibc that build can load, and Claude Code's [system requirements](https://code.claude.com/docs/en/setup#system-requirements) still apply. To see the host's C library and its version, run `ldd --version` on the host. For a musl host, see [Alpine Linux and musl-based distributions](https://code.claude.com/docs/en/setup#alpine-linux-and-musl-based-distributions).
350358* An SSH server. On Windows, Microsoft's OpenSSH Server; with other SSH servers, the engine does not survive a dropped connection.
351359* The SSH server's SFTP subsystem. For a Linux or macOS host that lacks it, see [Hosts without SFTP](#hosts-without-sftp).
352* If devices connect with Claude Desktop's built-in SSH client, an SSH server that accepts several sessions on one connection. Before Claude Desktop 4.5284.0, that client is the default on Windows devices, and later it still connects to hosts already in use. The built-in client can't connect where the server's `sshd_config` sets `MaxSessions 1`. Raise that limit, for example to OpenSSH's default of 10, or see [Hosts that allow one session per connection](#hosts-that-allow-one-session-per-connection).
360* If devices connect with Claude Desktop's built-in SSH client, an SSH server that accepts several sessions on one connection. Before Claude Desktop 4.16336.0, that client is the default on Windows devices, and later it still connects to hosts already in use. The built-in client can't connect where the server's `sshd_config` sets `MaxSessions 1`. Raise that limit, for example to OpenSSH's default of 10, or see [Hosts that allow one session per connection](#hosts-that-allow-one-session-per-connection).
353361* The server doesn't need to allow TCP, Unix socket, agent, or X11 forwarding. A `ProxyJump` host must allow TCP forwarding to the host's SSH port.
354362* A POSIX shell, or PowerShell on Windows.
355363* `git` on the path, for git features.
from line 382
374382
375383A wrapper script that stands in for `ssh`, whether `sshClientPath` names it or it comes first on the `PATH`, must leave `ssh`'s standard error untouched. If it sends that stream through a pipe, a file, or a terminal of its own, sign-ins that need a prompt fail. See [Claude's SSH sign-in helper isn't working on this computer](#claude%E2%80%99s-ssh-sign-in-helper-isn%E2%80%99t-working-on-this-computer).
376384
377Claude Desktop makes the SSH connection by running the device's OpenSSH client, so your own OpenSSH build's Kerberos (GSSAPI), certificate, and `ssh_config` support handles authentication. The program is the one `sshClientPath` names, or else, on macOS and Linux, the first `ssh` on the user's `PATH`, and it must be OpenSSH 7.6 or later. On Windows, the device's OpenSSH client is the default in Claude Desktop 4.5284.0 or later, and only for hosts that are new to the device. See [Prepare Windows devices for the OpenSSH client](#prepare-windows-devices-for-the-openssh-client).
385Claude Desktop makes the SSH connection by running the device's OpenSSH client, so your own OpenSSH build's Kerberos (GSSAPI), certificate, and `ssh_config` support handles authentication. The program is the one `sshClientPath` names, or else, on macOS and Linux, the first `ssh` on the user's `PATH`, and it must be OpenSSH 7.6 or later. On Windows, the device's OpenSSH client is the default in Claude Desktop 4.16336.0 or later, and only for hosts that are new to the device. See [Prepare Windows devices for the OpenSSH client](#prepare-windows-devices-for-the-openssh-client).
378386
379387To use one client for every host, set [`sshTransport`](https://claude.com/docs/third-party/claude-desktop/configuration#sshtransport) (beta) to `system-openssh` or `builtin`. Both apply on every platform. A change applies to new connections, and sessions that are already connected keep their client.
380388
from line 404
396404| `~/.claude/remote/ccd-cli/` | The Claude Code engine, one file per build, under a name that starts with its version (the three most recent are kept) |
397405| `~/.claude/remote/run/<id>/` | The server's socket, token, and log |
398406| `~/.claude/remote/plugins/<id>/` | Plugins synced from the device, in one folder for each Claude Desktop installation that connects |
407| `~/.claude/remote/session-folders/` | The remote server's record of the folders that sessions have worked in, kept as small files. Requires Claude Desktop 4.16336.0 or later |
399408| `~/.claude/uploads/<session-id>/` | Files the user attached to a message. Not removed when the session ends |
400409| `~/.claude/` and `~/.claude.json` | Claude Code's own data, including session transcripts. See [Data storage](https://claude.com/docs/third-party/claude-desktop/data-storage.md) |
401410
from line 428
419428A session without SFTP needs at least the following. Where one is missing, setup fails (see [Setup on the host fails after SSH connects](#setup-on-the-host-fails-after-ssh-connects)).
420429
421430* **Version**: Claude Desktop 3.1623.0 or later on the device.
422* **Client**: the device's OpenSSH client makes the connection. The built-in client needs SFTP. Before Claude Desktop 4.5284.0 it is the default on Windows devices, and in Claude Desktop 4.5284.0 or later it still makes the connection in some cases. To have the device's OpenSSH client make every connection, see [Prepare Windows devices for the OpenSSH client](#prepare-windows-devices-for-the-openssh-client).
431* **Client**: the device's OpenSSH client makes the connection. The built-in client needs SFTP. Before Claude Desktop 4.16336.0 it is the default on Windows devices, and in Claude Desktop 4.16336.0 or later it still makes the connection in some cases. To have the device's OpenSSH client make every connection, see [Prepare Windows devices for the OpenSSH client](#prepare-windows-devices-for-the-openssh-client).
423432* **Shell**: a POSIX shell on the host, with `sh` and the standard Unix tools such as `ls`, `cat`, and `rm`.
424433* **Base64 decoder**: `base64` or `openssl` on the host.
425434* **SHA-256 tool**: `sha256sum`, `shasum`, or `openssl` on the host.
from line 447
438447A device can connect to a host whose `sshd_config` sets `MaxSessions 1` only when the device's OpenSSH client makes the connection:
439448
440449* **macOS and Linux devices**: the device's OpenSSH client is the default. The device also needs Claude Desktop 3.1623.0 or later.
441* **Windows devices**: the built-in client can't connect to such a host. Before Claude Desktop 4.5284.0 it is the default, and in Claude Desktop 4.5284.0 or later it still makes the connection in some cases. To have the device's OpenSSH client make every connection, see [Prepare Windows devices for the OpenSSH client](#prepare-windows-devices-for-the-openssh-client).
450* **Windows devices**: the built-in client can't connect to such a host. Before Claude Desktop 4.16336.0 it is the default, and in Claude Desktop 4.16336.0 or later it still makes the connection in some cases. To have the device's OpenSSH client make every connection, see [Prepare Windows devices for the OpenSSH client](#prepare-windows-devices-for-the-openssh-client).
442451
443452Connecting to a host with this limit changes what the SSH server's log shows and how often devices sign in:
444453
from line 457
448457
449458### Prepare Windows devices for the OpenSSH client
450459
451With Claude Desktop 4.5284.0 or later, a Windows device connects to each host that is new to it through the device's OpenSSH client. A host that the device already connects to stays on the app's built-in SSH client, with no action required. A new or re-imaged PC, or a virtual desktop that keeps no local app data, has no hosts in use, so every host is new to it. The same holds where the app's record of earlier connections is damaged, because the app then resets it. A host that the device last connected to before Claude Desktop 1.46388.1 can count as new too, because earlier versions may have kept no record of it. Before Claude Desktop 4.5284.0, the built-in client makes every connection on Windows unless [`sshTransport`](https://claude.com/docs/third-party/claude-desktop/configuration#sshtransport) (beta) is `system-openssh`.
460With Claude Desktop 4.16336.0 or later, a Windows device connects to each host that is new to it through the device's OpenSSH client. A host that the device already connects to stays on the app's built-in SSH client, with no action required. A new or re-imaged PC, or a virtual desktop that keeps no local app data, has no hosts in use, so every host is new to it. The same holds where the app's record of earlier connections is damaged, because the app then resets it. A host that the device last connected to before Claude Desktop 1.46388.1 can count as new too, because earlier versions may have kept no record of it. Before Claude Desktop 4.16336.0, the built-in client makes every connection on Windows unless [`sshTransport`](https://claude.com/docs/third-party/claude-desktop/configuration#sshtransport) (beta) is `system-openssh`.
452461
453462Choose what your Windows devices do. For the first and the third choice, check what the device's OpenSSH client needs, under **Check what the device's OpenSSH client needs on Windows** below.
454463
from line 568
559568To find the condition that doesn't hold, select **View details** on the card and read the line that starts with `Claude needs:`. `ssh.log` in the [logs directory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#where-data-lives) on the device names the condition too. The card says less in these cases:
560569
561570* **The source of both settings is what fails**: the `Claude needs:` line names only Microsoft's OpenSSH, and the reason is in `ssh.log`.
562* **The path isn't absolute, isn't an `.exe` file, or names no file**: **View details** shows no `Claude needs:` line, and `ssh.log` says only that the program is missing or can't be used.
571* **The path names no file**: **View details** shows no `Claude needs:` line, and `ssh.log` says only that the program is missing or can't be run. Claude Desktop 4.16336.0 or later makes one exception, a path that runs through a user's `AppData\Local` folder, which gets such a line. Before Claude Desktop 4.16336.0, the card says as little for a path that isn't absolute or isn't an `.exe` file.
563572
564573With a client that isn't Microsoft's, plan for the following:
565574
from line 599
590599
591600To find the cause, select **View details** on the card and read the line that starts with `ssh:`.
592601
593* **The line shows `%LOCALAPPDATA%`**: Claude Desktop rejected the value, and the card says that the program is missing or can't be run, even if it is there. Check the value in machine policy, the bootstrap response, the admin console, `sshTransport`, and administrator rights. To narrow the cause down, search `ssh.log` in the [logs directory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#where-data-lives) on the device for `sshClientPath begins with`. The last line that you find names the cause.
594* **The line shows a path without the variable**: in the path, `~` stands for the user's profile folder. If no line under it starts with `Claude needs:`, the user has no `.exe` file at that path. A path in another account's folder, such as `C:\Windows\System32\config\systemprofile`, means that the tool that wrote the value expanded the variable. A `Claude needs:` line that asks for Program Files means that a link leads out of the user's `AppData\Local` folder, or that the value is a full path without the variable, in the registry or in the bootstrap response.
595* **The line says that `sshClientPath` isn't a local absolute path**: the device runs an earlier version, the registry value is an expandable string, which Claude Desktop doesn't read, or the value has a mistake such as `..` or a second `%`.
602* **The line shows `%LOCALAPPDATA%`**: Claude Desktop rejected the value. In Claude Desktop 4.16336.0 or later, the `Claude needs:` line under it names the cause. Earlier versions show no such line, and the card says that the program is missing or can't be run, even if it is there. In `ssh.log` in the [logs directory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#where-data-lives) on the device, the last line with `sshClientPath begins with` names the cause too.
603* **The line shows a path without the variable**: in the path, `~` stands for the user's profile folder. If no line under it starts with `Claude needs:`, the user has no `.exe` file at that path. A path in another account's folder, such as `C:\Windows\System32\config\systemprofile`, means that the tool that wrote the value expanded the variable.
604* **A `Claude needs:` line that asks for `sshClientPath` to start with `%LOCALAPPDATA%\`**: the value is a full path without the variable, in the registry or in the bootstrap response. Requires Claude Desktop 4.16336.0 or later.
605* **A `Claude needs:` line that asks for no junction or symbolic link leading out**: a link leads out of the user's `AppData\Local` folder. Requires Claude Desktop 4.16336.0 or later. Before Claude Desktop 4.16336.0, this case and the one before it get a line that asks for Program Files, if the file is there.
606* **The `ssh:` line says that `sshClientPath` is set, but could not be read**: the `Claude needs:` line under it gives the cause. It asks for a plain string (`REG_SZ`) where the registry value is an expandable string, which Claude Desktop doesn't read. It asks for a full local path where the value has a mistake, such as `..` or a second `%`. Requires Claude Desktop 4.16336.0 or later.
607* **The `ssh:` line says that `sshClientPath` isn't a local absolute path**: the device runs a version before Claude Desktop 4.16336.0, which shows no `Claude needs:` line here. The causes are the same two. Before Claude Desktop 4.4212.0, every value that starts with `%LOCALAPPDATA%\` gets this line too.
596608
597609With a per-user client, plan for the SSH files, prompts, and sign-ins that [Use the OpenSSH client of Git for Windows](#use-the-openssh-client-of-git-for-windows) describes, and for the following:
598610
599* **Application control**: allow the client and the `ssh-keygen.exe` beside the client in your application control policy. If your policy blocks the client, users don't see the card "Ask your IT administrator to fix the configured SSH program". The built-in client tries the connection, and `ssh.log` says that the program gave no answer.
611* **Application control**: allow the client and the `ssh-keygen.exe` beside the client in your application control policy. If your policy blocks the client, the built-in client tries the connection, and `ssh.log` says that the program gave no answer. If your policy blocks that `ssh-keygen.exe` too, the connection fails with the card "Ask your IT administrator to fix the configured SSH program".
600612* **Upgrades**: if the name of the client's folder contains a version number, change the value in machine policy and in the bootstrap response together with each upgrade. Prefer a folder name without a version to a junction, because through a junction Claude Desktop can stop reusing saved SSH passwords.
601613* **Moved or mounted profiles**: Claude Desktop looks in `AppData\Local` under the user's profile folder, even where the `LOCALAPPDATA` variable points elsewhere. It refuses a profile folder that is a UNC path, such as `\\server\profiles\user`. Where Windows mounts the profile from a profile container, test one device before you deliver the value to the others.
602614* **A changed or removed value**: a running Claude Desktop can keep using the client after you change or remove the value. Have users quit and reopen Claude Desktop.
from line 645
633645
634646The built-in client made the connection, and the host needs the device's OpenSSH client. Where the app can name a step, the card's title gives it, and the card's text gives the cause, either "Claude's built-in SSH library can't connect through a jump host (ProxyJump)." or "Claude's built-in SSH library can't check host keys against a certificate authority or another known\_hosts file."
635647
636* **"Ask your IT administrator to set sshTransport to system-openssh"**: the built-in client is the device's default, and the device has a usable OpenSSH client. Set [`sshTransport`](https://claude.com/docs/third-party/claude-desktop/configuration#sshtransport) to `system-openssh`. Claude Desktop 4.5284.0 or later doesn't show this title: the OpenSSH client makes the connection instead.
648* **"Ask your IT administrator to set sshTransport to system-openssh"**: the built-in client is the device's default, and the device has a usable OpenSSH client. Set [`sshTransport`](https://claude.com/docs/third-party/claude-desktop/configuration#sshtransport) to `system-openssh`. Claude Desktop 4.16336.0 or later doesn't show this title: the OpenSSH client makes the connection instead.
637649* **"Ask your IT administrator to change sshTransport from builtin to system-openssh"**: your configuration sets `sshTransport` to `builtin`. Change it to `system-openssh`.
638650* **"Ask your admin to correct the sshTransport setting"**: the app can't read the value that your configuration gives `sshTransport`, for example a misspelling, so the built-in client makes the connection. Correct the value. Requires Claude Desktop 2.37337.0 or later.
639* **"Ask your IT administrator to install Microsoft OpenSSH 9.4 or newer and set sshTransport to system-openssh, then quit and reopen Claude"**: the built-in client is the device's default, and the app found no usable OpenSSH client on the device. Install the client, and set the key. Claude Desktop 4.5284.0 or later shows the next title instead.
640* **"Ask your IT administrator to install Microsoft OpenSSH 9.4 or newer, then quit and reopen Claude"**: the app found no usable OpenSSH client on the device. Install the client. Before Claude Desktop 4.5284.0, this title appears only where `sshTransport` is `system-openssh`.
641* **"Check your network or VPN and try again, or quit and reopen Claude"**: the device's configuration from the Enterprise Admin Console or a bootstrap server hasn't loaded, so the built-in client made the connection. Requires Claude Desktop 4.5284.0 or later.
651* **"Ask your IT administrator to install Microsoft OpenSSH 9.4 or newer and set sshTransport to system-openssh, then quit and reopen Claude"**: the built-in client is the device's default, and the app found no usable OpenSSH client on the device. Install the client, and set the key. Claude Desktop 4.16336.0 or later shows the next title instead.
652* **"Ask your IT administrator to install Microsoft OpenSSH 9.4 or newer, then quit and reopen Claude"**: the app found no usable OpenSSH client on the device. Install the client. Before Claude Desktop 4.16336.0, this title appears only where `sshTransport` is `system-openssh`.
653* **"Check your network or VPN and try again, or quit and reopen Claude"**: the device's configuration from the Enterprise Admin Console or a bootstrap server hasn't loaded, so the built-in client made the connection. Requires Claude Desktop 4.16336.0 or later.
642654* **"Quit and reopen Claude; if this comes back, ask your IT administrator to let Claude use the system OpenSSH client"**: the device couldn't start the OpenSSH client earlier in this run of the app (see [Host requirements](#host-requirements)).
643655
644656Where the app can name no step, the card's title gives the cause, either `<host> needs a jump host, which Claude can't use here` or `Claude can't check <host>'s key here`.
from line 659
647659
648660### Ask your IT administrator to fix the configured SSH program
649661
650The program that `sshClientPath` names is missing, can't be run, is too old, or on Windows doesn't meet the conditions for its kind. Claude Desktop never runs another `ssh` in its place. Select **View details** on the card for the program's path. On a Windows device, to find the condition, see [Use the OpenSSH client of Git for Windows](#use-the-openssh-client-of-git-for-windows) or [Use an OpenSSH client installed per user](#use-an-openssh-client-installed-per-user). With no `sshClientPath`, the card appears on a macOS or Linux device where `sshTransport` is `system-openssh` and the device can't start its own `ssh`. A Windows device in that state connects with the built-in client.
662The program that `sshClientPath` names is missing, can't be run, is too old, or on Windows doesn't meet the conditions for its kind. Claude Desktop never runs another `ssh` in its place. Select **View details** on the card for the program's path. On a Windows device, to find the condition, see [Use the OpenSSH client of Git for Windows](#use-the-openssh-client-of-git-for-windows) or [Use an OpenSSH client installed per user](#use-an-openssh-client-installed-per-user). With no `sshClientPath`, the card appears on a macOS or Linux device where `sshTransport` is `system-openssh` and the device can't start its own `ssh`. A Windows device in that state connects with the built-in client. Where the built-in client makes the connection, the card also appears if a Windows or Linux device refuses to start the `ssh-keygen` in the folder of the program that `sshClientPath` names, for example under an application control policy. **View details** then shows a line that starts with `ssh-keygen:` and gives the blocked program's path. Allow that program to run, then have the user try again.
651663
652664### This computer won't start Claude's SSH sign-in helper
653665
654666Where the device's OpenSSH client makes the connection, the operating system refused to start one of the helper programs that show `ssh`'s prompts. Without them the app can't ask for a password, a one-time code, or a key passphrase, so a sign-in that needs one fails. Select **View details** on the card for the blocked program's path and, where the operating system gave one, the error code. Allow the program:
655667
656* **Windows devices**, with Claude Desktop 2.37337.0 or later: allow the helper programs as described under [Prepare Windows devices for the OpenSSH client](#prepare-windows-devices-for-the-openssh-client), then have the user try again. With Claude Desktop 4.5284.0 or later and `sshTransport` unset or `auto`, the [built-in client connects instead](#prepare-windows-devices-for-the-openssh-client) where the app itself can't start the helper. The host then stays on that client.
668* **Windows devices**, with Claude Desktop 2.37337.0 or later: allow the helper programs as described under [Prepare Windows devices for the OpenSSH client](#prepare-windows-devices-for-the-openssh-client), then have the user try again. With Claude Desktop 4.16336.0 or later and `sshTransport` unset or `auto`, the [built-in client connects instead](#prepare-windows-devices-for-the-openssh-client) where the app itself can't start the helper. The host then stays on that client.
657669* **macOS and Linux devices**, with Claude Desktop 4.16336.0 or later: allow `claude-ssh-askpass` in the folder that **View details** names, then have the user try again. On these devices the built-in client never connects instead. With `spawn EACCES` on a Linux device, check too that the folder isn't mounted `noexec`.
658670
659671While the fault lasts, Claude Desktop can't reconnect by itself with a saved password. It shows the card only while a user waits for the connection, for example after they start a session or send a message. On a Windows device, the card appears only for a host that accepts a password or a one-time code.
from line 696
684696SSH connected, but Claude Desktop couldn't place or start the remote server or the engine on the host. Select **View details** on the failure card to read the app's own message, which can end with a code in square brackets. Match the code, or the start of the message:
685697
686698* **`[SFTP_UNAVAILABLE]`**: the host's SSH server refused the SFTP subsystem. Enable `Subsystem sftp` in the server's `sshd_config`, or see what a session needs under [Hosts without SFTP](#hosts-without-sftp).
687* **`[SESSION_LIMIT]`**: the host's SSH server refused to open another session on the connection. If the host has to keep its `MaxSessions` limit, update the macOS or Linux device to Claude Desktop 3.1623.0 or later, and see [Hosts that allow one session per connection](#hosts-that-allow-one-session-per-connection). Otherwise, raise `MaxSessions` in the server's `sshd_config`, for example to OpenSSH's default of 10, and reload the SSH server.
699* **`[SESSION_LIMIT]`**: the host's SSH server refused to open another session on the connection. If the host has to keep its `MaxSessions` limit, the device's OpenSSH client has to make the connection. See [Hosts that allow one session per connection](#hosts-that-allow-one-session-per-connection) for the version and the setting that each platform needs. Otherwise, raise `MaxSessions` in the server's `sshd_config`, for example to OpenSSH's default of 10, and reload the SSH server.
688700* **`[SFTP_NOT_STARTED]`**: the host's SSH server accepted the request for SFTP, but the SFTP server ended before its first answer, or text arrived in place of that answer. In a terminal on the device, run `sftp` with the same host, for example `sftp [email protected]`, to see what stops it. Then check the settings and files that the message names, or see what a session needs under [Hosts without SFTP](#hosts-without-sftp).
689701* **`[EXEC_NO_INPUT]`**: the host's SSH server ran the app's command but passed it no input, which setup and the session's own link need. In a terminal on the device, run `echo hi | ssh` with the same host and `cat`, for example `echo hi | ssh [email protected] cat`. It prints `hi` on a host that passes input. Have the host's administrator let commands run over SSH receive input.
690702* **`[ENOSPC]` or `[EDQUOT]`**: a disk is full, or a quota is used up. In a message that starts with `Couldn't prepare the deploy locally`, the disk is the device's. In any other message it is the host's, so free space in the SSH user's home directory. [Host requirements](#host-requirements) gives the space the app needs.
from line 707
695707* **`[SERVER_NOT_RUNNABLE]`**: the remote server didn't run from `~/.claude/remote` in the SSH user's home directory, or stopped before it answered. A home directory mounted `noexec` is one cause, and security software on the host that keeps programs from running there is another. Have the host's administrator check that programs can run from that folder. Before Claude Desktop 4.4212.0, the code appears only on a [host without SFTP](#hosts-without-sftp).
696708* **`[DOWNLOAD_BUSY]`**: Anthropic's download server answered that it is busy, so Claude Desktop couldn't download the engine or the remote server to the device. Claude Desktop has already waited and asked again. Have the user try again in a few minutes. If the code keeps coming back, check whether a proxy on the device's network limits downloads from `downloads.claude.ai`, because a proxy can give the same answer.
697709
698`[SESSION_LIMIT]` and `[SFTP_NOT_STARTED]` require Claude Desktop 2.31226.0 or later, and appear only when the device's OpenSSH client makes the connection. `[SESSION_LIMIT]` appears only on macOS and Linux devices. Their cards are titled `<host> allows too few SSH sessions per connection` and `SFTP doesn't start on <host>`.
710`[SESSION_LIMIT]` and `[SFTP_NOT_STARTED]` require Claude Desktop 2.31226.0 or later. `[SFTP_NOT_STARTED]` appears only when the device's OpenSSH client makes the connection. Their cards are titled `<host> allows too few SSH sessions per connection` and `SFTP doesn't start on <host>`.
711
712In Claude Desktop 4.16336.0 or later, `[SESSION_LIMIT]` also appears where the built-in client makes the connection, on a device of any platform. Before Claude Desktop 4.16336.0, it appears only on macOS and Linux devices, and only when the device's OpenSSH client makes the connection.
699713
700714`[CLI_NOT_RUNNABLE]` and `[EXEC_NO_INPUT]` require Claude Desktop 2.37337.0 or later. `[EXEC_NO_INPUT]` appears only where the device's OpenSSH client makes the connection. Their cards are titled `Claude Code didn't run on <host>` and `Ask <host>'s administrator to let SSH commands receive input`. From the same version, the card is titled `Couldn't copy Claude Code to <host>` where the app couldn't put its files on the host, and `Couldn't install Claude Code on <host>` where the engine's install failed, each for a cause with no card of its own.
701715
government/desktop/plugins Changed · +2 / -2 lines
from line 6
66
77A plugin is a package that adds capabilities to Claude in a single step, such as skills, slash commands, sub-agents, and hooks. Plugins work in Cowork and in Code. Skills from your organization's plugins also work in Chat, on Claude Desktop 1.44121.4 or later. [What a Chat conversation can reach](https://claude.com/docs/third-party/claude-desktop/chat.md#what-a-chat-conversation-can-reach) says what else a plugin adds there.
88
9<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/user-04-connectors-plugins-and-skills.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=953d050db0ec38bd9d0db7399e96cf40" aria-label="Video walkthrough: Connectors, plugins, and skills from your agency" />
9<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/z_GoItRVM-_PvPPB/images/government/videos/user-04-connectors-plugins-and-skills-v2.mp4?fit=max&auto=format&n=z_GoItRVM-_PvPPB&q=85&s=eaffd949e3db69655dc5f51403a9978b" aria-label="Video walkthrough: Connectors, plugins, and skills from your agency" />
1010
11Video: Connectors, plugins, and skills from your agency (2 min 6 s). Narrated with an AI-generated voice, with on-screen captions.
11Video: Connectors, plugins, and skills from your agency (2 min). Narrated with an AI-generated voice, with on-screen captions.
1212
1313[Transcript](https://claude.com/docs/government/desktop/video-walkthroughs.md#connectors-plugins-and-skills-from-your-agency)
1414
third-party/claude-desktop/claude-api Changed · +4 / -0 lines
from line 26
2626
2727Under a profile that manages the configuration, the app ignores any configuration that an earlier Claude API account sign-in saved. A profile can itself select the Claude API with no static key or credential helper. Users then sign in with **Sign in with Claude Console**, and each selects the Console organization that their usage is billed to, as described under [Choose an authentication approach](#choose-an-authentication-approach). A user who already signed in with Claude Console keeps that sign-in, and the Console organization they chose, until the app next asks them to sign in.
2828
29> [!NOTE]
30>
31> If the profile also sets `forceLoginOrgUUID`, [add the ID of each Console organization that you allow](https://claude.com/docs/third-party/claude-desktop/admin-console.md#keep-a-device-on-its-managed-profile) to that key.
32
2933## Configure the app
3034
3135### Configuration keys
third-party/claude-desktop/move-to-claude-enterprise Changed · +2 / -0 lines
from line 76
7676
7777For either option, copy the **Organization ID** from [**Organization settings > Organization and access**](https://claude.ai/admin-settings/organization). Set `importThirdPartyHistoryIntoOrgUUID` to this ID, without braces or quotation marks. To keep Claude on these computers from using another organization or a personal account, where nothing migrates, you can also set `forceLoginOrgUUID` to the same ID. The app then blocks Claude accounts that aren't in that organization.
7878
79If you keep the cloud provider keys and users click **Sign in with Claude Console**, also add the ID of each Claude Console organization that you allow, as described under [Keep a device on its managed profile](https://claude.com/docs/third-party/claude-desktop/admin-console.md#keep-a-device-on-its-managed-profile).
80
7981On Windows, in an elevated PowerShell window:
8082
8183```powershell theme={null}