SSH remote sessions in Claude Desktop on 3P changedthird-party/claude-desktop/ssh-remote-sessions
Nearest release: v2.1.319, published 18 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 6 Nov 2026 19:31 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 6 Nov 2026 19:37 UTC.
Upstream edited
Recorded here
Lines+33added
Lines−19removed
From line
188
where the diff opens
First seen
28 Aug 2026
this site's first read of the page
Recorded edits25to this page, all time
The whole hunk
from line 188, old and new numbered
/
from line 188
188188To prevent or limit the move, set one of these keys in the profile itself:
189189
190190* **Keep the device on its profile**: set [`disableDeploymentModeChooser`](https://claude.com/docs/third-party/claude-desktop/configuration#disabledeploymentmodechooser) to `true`. The app ignores the admin console, and the sign-in screen doesn't offer **Or sign in with Claude.ai**. A device that has already moved returns to its profile at its next launch.
191* **Allow only your organization**: set [`forceLoginOrgUUID`](https://claude.com/docs/cowork/hipaa-setup#what-each-claude-desktop-key-does) to your organization ID, and set the SSH keys you rely on in the console too. The key also limits standard Claude Desktop sign-in on the device to your organization.
191* **Allow only your organization**: set [`forceLoginOrgUUID`](https://claude.com/docs/cowork/hipaa-setup#what-each-claude-desktop-key-does) to your organization ID, and set the SSH keys you rely on in the console too. The key also limits standard Claude Desktop sign-in on the device to your organization. If users click **Sign in with Claude Console**, also add the ID of each Claude Console organization that you allow, as described under [Keep a device on its managed profile](https://claude.com/docs/third-party/claude-desktop/admin-console.md#keep-a-device-on-its-managed-profile).
192192
193193Before you add either key to a profile that sets only [app-behavior keys](https://claude.com/docs/third-party/claude-desktop/mdm.md#update-keys-and-managed-precedence), such as `disableAutoUpdates`, read the warning under [Keep a device on its managed profile](https://claude.com/docs/third-party/claude-desktop/admin-console.md#keep-a-device-on-its-managed-profile).
194194
from line 269
269269| Your organization's sandbox policy isn't fully applied on `<host>`, so shell commands there may run outside it | `overridden` | Claude Code managed settings on the host replace your policy, even when they say nothing about the sandbox, or they turn the sandbox off or loosen it | Set `parentSettingsBehavior` to `"merge"` in the host's managed settings, and remove `sandbox` values there that conflict with your policy |
270270| No message | `unknown` | Claude Code gives no answer that Claude Desktop can read | In a session on that host, ask Claude to run the two commands under [Confirm commands run inside the sandbox](https://code.claude.com/docs/en/sandboxing#confirm-commands-run-inside-the-sandbox) |
271271
272> [!NOTE]
273>
274> On a device where the [local configuration file governs](#sandbox-from-the-host%E2%80%99s-managed-settings), Claude Desktop 4.16336.0 or later words these messages differently. They name `the sandbox from your inference configuration`, not your organization's sandbox or sandbox policy.
275
272276The fix for the `overridden` message and the fix for the message under [Policy status on the remote host](#policy-status-on-the-remote-host) start at the same setting, `parentSettingsBehavior`. With Claude Desktop 3.6556.1 or later, a session that shows one of the two messages doesn't add the other until the first no longer applies. Your collector still receives the event of the check whose message is held back, and the **Sandbox** row of `/status` still shows the sandbox's state.
273277
274278To check one session, have the user open it, wait until Claude has finished replying, and enter `/status` in the message box. Where your policy includes the sandbox, the **Session info** card shows what Claude Desktop last learned in a **Sandbox** row. Requires Claude Desktop 2.31226.0 or later. Find the value's `reason` in the table of messages and reasons for the cause and the fix:
from line 325
321325Your organization's policy isn't fully applied on <host>. Ask your admin to check parentSettingsBehavior in that host's Claude Code managed settings.
322326```
323327
328> [!NOTE]
329>
330> On a device where the local configuration file governs, Claude Desktop 4.16336.0 or later starts the message with `The policy from your inference configuration`, and doesn't mention an admin. The message after a fix starts with the same words.
331
324332A session that shows one of the two messages doesn't add the other until the first no longer applies. Your collector still receives the event of the check whose message is held back.
325333
326334To fix the host, set `parentSettingsBehavior` to `"merge"` in the host's Claude Code managed settings, which otherwise replace your policy. See [Managed configuration on the remote host](#managed-configuration-on-the-remote-host). Claude Desktop asks again when Claude Code starts, when Claude Desktop rejoins a running Claude Code process, and after each turn. Once the check passes again, a session that still shows the message also shows "Your organization's policy applies on `<host>` again."
from line 357
349357* On a Linux host, glibc 2.17 or later, or musl. The Claude Code engine is a single executable, and its glibc build links only against glibc's own libraries. Version 2.17 is the oldest glibc that build can load, and Claude Code's [system requirements](https://code.claude.com/docs/en/setup#system-requirements) still apply. To see the host's C library and its version, run `ldd --version` on the host. For a musl host, see [Alpine Linux and musl-based distributions](https://code.claude.com/docs/en/setup#alpine-linux-and-musl-based-distributions).
350358* An SSH server. On Windows, Microsoft's OpenSSH Server; with other SSH servers, the engine does not survive a dropped connection.
351359* The SSH server's SFTP subsystem. For a Linux or macOS host that lacks it, see [Hosts without SFTP](#hosts-without-sftp).
352* If devices connect with Claude Desktop's built-in SSH client, an SSH server that accepts several sessions on one connection. Before Claude Desktop 4.5284.0, that client is the default on Windows devices, and later it still connects to hosts already in use. The built-in client can't connect where the server's `sshd_config` sets `MaxSessions 1`. Raise that limit, for example to OpenSSH's default of 10, or see [Hosts that allow one session per connection](#hosts-that-allow-one-session-per-connection).
360* If devices connect with Claude Desktop's built-in SSH client, an SSH server that accepts several sessions on one connection. Before Claude Desktop 4.16336.0, that client is the default on Windows devices, and later it still connects to hosts already in use. The built-in client can't connect where the server's `sshd_config` sets `MaxSessions 1`. Raise that limit, for example to OpenSSH's default of 10, or see [Hosts that allow one session per connection](#hosts-that-allow-one-session-per-connection).
353361* The server doesn't need to allow TCP, Unix socket, agent, or X11 forwarding. A `ProxyJump` host must allow TCP forwarding to the host's SSH port.
354362* A POSIX shell, or PowerShell on Windows.
355363* `git` on the path, for git features.
from line 382
374382
375383A wrapper script that stands in for `ssh`, whether `sshClientPath` names it or it comes first on the `PATH`, must leave `ssh`'s standard error untouched. If it sends that stream through a pipe, a file, or a terminal of its own, sign-ins that need a prompt fail. See [Claude's SSH sign-in helper isn't working on this computer](#claude%E2%80%99s-ssh-sign-in-helper-isn%E2%80%99t-working-on-this-computer).
376384
377Claude Desktop makes the SSH connection by running the device's OpenSSH client, so your own OpenSSH build's Kerberos (GSSAPI), certificate, and `ssh_config` support handles authentication. The program is the one `sshClientPath` names, or else, on macOS and Linux, the first `ssh` on the user's `PATH`, and it must be OpenSSH 7.6 or later. On Windows, the device's OpenSSH client is the default in Claude Desktop 4.5284.0 or later, and only for hosts that are new to the device. See [Prepare Windows devices for the OpenSSH client](#prepare-windows-devices-for-the-openssh-client).
385Claude Desktop makes the SSH connection by running the device's OpenSSH client, so your own OpenSSH build's Kerberos (GSSAPI), certificate, and `ssh_config` support handles authentication. The program is the one `sshClientPath` names, or else, on macOS and Linux, the first `ssh` on the user's `PATH`, and it must be OpenSSH 7.6 or later. On Windows, the device's OpenSSH client is the default in Claude Desktop 4.16336.0 or later, and only for hosts that are new to the device. See [Prepare Windows devices for the OpenSSH client](#prepare-windows-devices-for-the-openssh-client).
378386
379387To use one client for every host, set [`sshTransport`](https://claude.com/docs/third-party/claude-desktop/configuration#sshtransport) (beta) to `system-openssh` or `builtin`. Both apply on every platform. A change applies to new connections, and sessions that are already connected keep their client.
380388
from line 404
396404| `~/.claude/remote/ccd-cli/` | The Claude Code engine, one file per build, under a name that starts with its version (the three most recent are kept) |
397405| `~/.claude/remote/run/<id>/` | The server's socket, token, and log |
398406| `~/.claude/remote/plugins/<id>/` | Plugins synced from the device, in one folder for each Claude Desktop installation that connects |
407| `~/.claude/remote/session-folders/` | The remote server's record of the folders that sessions have worked in, kept as small files. Requires Claude Desktop 4.16336.0 or later |
399408| `~/.claude/uploads/<session-id>/` | Files the user attached to a message. Not removed when the session ends |
400409| `~/.claude/` and `~/.claude.json` | Claude Code's own data, including session transcripts. See [Data storage](https://claude.com/docs/third-party/claude-desktop/data-storage.md) |
401410
from line 428
419428A session without SFTP needs at least the following. Where one is missing, setup fails (see [Setup on the host fails after SSH connects](#setup-on-the-host-fails-after-ssh-connects)).
420429
421430* **Version**: Claude Desktop 3.1623.0 or later on the device.
422* **Client**: the device's OpenSSH client makes the connection. The built-in client needs SFTP. Before Claude Desktop 4.5284.0 it is the default on Windows devices, and in Claude Desktop 4.5284.0 or later it still makes the connection in some cases. To have the device's OpenSSH client make every connection, see [Prepare Windows devices for the OpenSSH client](#prepare-windows-devices-for-the-openssh-client).
431* **Client**: the device's OpenSSH client makes the connection. The built-in client needs SFTP. Before Claude Desktop 4.16336.0 it is the default on Windows devices, and in Claude Desktop 4.16336.0 or later it still makes the connection in some cases. To have the device's OpenSSH client make every connection, see [Prepare Windows devices for the OpenSSH client](#prepare-windows-devices-for-the-openssh-client).
423432* **Shell**: a POSIX shell on the host, with `sh` and the standard Unix tools such as `ls`, `cat`, and `rm`.
424433* **Base64 decoder**: `base64` or `openssl` on the host.
425434* **SHA-256 tool**: `sha256sum`, `shasum`, or `openssl` on the host.
from line 447
438447A device can connect to a host whose `sshd_config` sets `MaxSessions 1` only when the device's OpenSSH client makes the connection:
439448
440449* **macOS and Linux devices**: the device's OpenSSH client is the default. The device also needs Claude Desktop 3.1623.0 or later.
441* **Windows devices**: the built-in client can't connect to such a host. Before Claude Desktop 4.5284.0 it is the default, and in Claude Desktop 4.5284.0 or later it still makes the connection in some cases. To have the device's OpenSSH client make every connection, see [Prepare Windows devices for the OpenSSH client](#prepare-windows-devices-for-the-openssh-client).
450* **Windows devices**: the built-in client can't connect to such a host. Before Claude Desktop 4.16336.0 it is the default, and in Claude Desktop 4.16336.0 or later it still makes the connection in some cases. To have the device's OpenSSH client make every connection, see [Prepare Windows devices for the OpenSSH client](#prepare-windows-devices-for-the-openssh-client).
442451
443452Connecting to a host with this limit changes what the SSH server's log shows and how often devices sign in:
444453
from line 457
448457
449458### Prepare Windows devices for the OpenSSH client
450459
451With Claude Desktop 4.5284.0 or later, a Windows device connects to each host that is new to it through the device's OpenSSH client. A host that the device already connects to stays on the app's built-in SSH client, with no action required. A new or re-imaged PC, or a virtual desktop that keeps no local app data, has no hosts in use, so every host is new to it. The same holds where the app's record of earlier connections is damaged, because the app then resets it. A host that the device last connected to before Claude Desktop 1.46388.1 can count as new too, because earlier versions may have kept no record of it. Before Claude Desktop 4.5284.0, the built-in client makes every connection on Windows unless [`sshTransport`](https://claude.com/docs/third-party/claude-desktop/configuration#sshtransport) (beta) is `system-openssh`.
460With Claude Desktop 4.16336.0 or later, a Windows device connects to each host that is new to it through the device's OpenSSH client. A host that the device already connects to stays on the app's built-in SSH client, with no action required. A new or re-imaged PC, or a virtual desktop that keeps no local app data, has no hosts in use, so every host is new to it. The same holds where the app's record of earlier connections is damaged, because the app then resets it. A host that the device last connected to before Claude Desktop 1.46388.1 can count as new too, because earlier versions may have kept no record of it. Before Claude Desktop 4.16336.0, the built-in client makes every connection on Windows unless [`sshTransport`](https://claude.com/docs/third-party/claude-desktop/configuration#sshtransport) (beta) is `system-openssh`.
452461
453462Choose what your Windows devices do. For the first and the third choice, check what the device's OpenSSH client needs, under **Check what the device's OpenSSH client needs on Windows** below.
454463
from line 568
559568To find the condition that doesn't hold, select **View details** on the card and read the line that starts with `Claude needs:`. `ssh.log` in the [logs directory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#where-data-lives) on the device names the condition too. The card says less in these cases:
560569
561570* **The source of both settings is what fails**: the `Claude needs:` line names only Microsoft's OpenSSH, and the reason is in `ssh.log`.
562* **The path isn't absolute, isn't an `.exe` file, or names no file**: **View details** shows no `Claude needs:` line, and `ssh.log` says only that the program is missing or can't be used.
571* **The path names no file**: **View details** shows no `Claude needs:` line, and `ssh.log` says only that the program is missing or can't be run. Claude Desktop 4.16336.0 or later makes one exception, a path that runs through a user's `AppData\Local` folder, which gets such a line. Before Claude Desktop 4.16336.0, the card says as little for a path that isn't absolute or isn't an `.exe` file.
563572
564573With a client that isn't Microsoft's, plan for the following:
565574
from line 599
590599
591600To find the cause, select **View details** on the card and read the line that starts with `ssh:`.
592601
593* **The line shows `%LOCALAPPDATA%`**: Claude Desktop rejected the value, and the card says that the program is missing or can't be run, even if it is there. Check the value in machine policy, the bootstrap response, the admin console, `sshTransport`, and administrator rights. To narrow the cause down, search `ssh.log` in the [logs directory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#where-data-lives) on the device for `sshClientPath begins with`. The last line that you find names the cause.
594* **The line shows a path without the variable**: in the path, `~` stands for the user's profile folder. If no line under it starts with `Claude needs:`, the user has no `.exe` file at that path. A path in another account's folder, such as `C:\Windows\System32\config\systemprofile`, means that the tool that wrote the value expanded the variable. A `Claude needs:` line that asks for Program Files means that a link leads out of the user's `AppData\Local` folder, or that the value is a full path without the variable, in the registry or in the bootstrap response.
595* **The line says that `sshClientPath` isn't a local absolute path**: the device runs an earlier version, the registry value is an expandable string, which Claude Desktop doesn't read, or the value has a mistake such as `..` or a second `%`.
602* **The line shows `%LOCALAPPDATA%`**: Claude Desktop rejected the value. In Claude Desktop 4.16336.0 or later, the `Claude needs:` line under it names the cause. Earlier versions show no such line, and the card says that the program is missing or can't be run, even if it is there. In `ssh.log` in the [logs directory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#where-data-lives) on the device, the last line with `sshClientPath begins with` names the cause too.
603* **The line shows a path without the variable**: in the path, `~` stands for the user's profile folder. If no line under it starts with `Claude needs:`, the user has no `.exe` file at that path. A path in another account's folder, such as `C:\Windows\System32\config\systemprofile`, means that the tool that wrote the value expanded the variable.
604* **A `Claude needs:` line that asks for `sshClientPath` to start with `%LOCALAPPDATA%\`**: the value is a full path without the variable, in the registry or in the bootstrap response. Requires Claude Desktop 4.16336.0 or later.
605* **A `Claude needs:` line that asks for no junction or symbolic link leading out**: a link leads out of the user's `AppData\Local` folder. Requires Claude Desktop 4.16336.0 or later. Before Claude Desktop 4.16336.0, this case and the one before it get a line that asks for Program Files, if the file is there.
606* **The `ssh:` line says that `sshClientPath` is set, but could not be read**: the `Claude needs:` line under it gives the cause. It asks for a plain string (`REG_SZ`) where the registry value is an expandable string, which Claude Desktop doesn't read. It asks for a full local path where the value has a mistake, such as `..` or a second `%`. Requires Claude Desktop 4.16336.0 or later.
607* **The `ssh:` line says that `sshClientPath` isn't a local absolute path**: the device runs a version before Claude Desktop 4.16336.0, which shows no `Claude needs:` line here. The causes are the same two. Before Claude Desktop 4.4212.0, every value that starts with `%LOCALAPPDATA%\` gets this line too.
596608
597609With a per-user client, plan for the SSH files, prompts, and sign-ins that [Use the OpenSSH client of Git for Windows](#use-the-openssh-client-of-git-for-windows) describes, and for the following:
598610
599* **Application control**: allow the client and the `ssh-keygen.exe` beside the client in your application control policy. If your policy blocks the client, users don't see the card "Ask your IT administrator to fix the configured SSH program". The built-in client tries the connection, and `ssh.log` says that the program gave no answer.
611* **Application control**: allow the client and the `ssh-keygen.exe` beside the client in your application control policy. If your policy blocks the client, the built-in client tries the connection, and `ssh.log` says that the program gave no answer. If your policy blocks that `ssh-keygen.exe` too, the connection fails with the card "Ask your IT administrator to fix the configured SSH program".
600612* **Upgrades**: if the name of the client's folder contains a version number, change the value in machine policy and in the bootstrap response together with each upgrade. Prefer a folder name without a version to a junction, because through a junction Claude Desktop can stop reusing saved SSH passwords.
601613* **Moved or mounted profiles**: Claude Desktop looks in `AppData\Local` under the user's profile folder, even where the `LOCALAPPDATA` variable points elsewhere. It refuses a profile folder that is a UNC path, such as `\\server\profiles\user`. Where Windows mounts the profile from a profile container, test one device before you deliver the value to the others.
602614* **A changed or removed value**: a running Claude Desktop can keep using the client after you change or remove the value. Have users quit and reopen Claude Desktop.
from line 645
633645
634646The built-in client made the connection, and the host needs the device's OpenSSH client. Where the app can name a step, the card's title gives it, and the card's text gives the cause, either "Claude's built-in SSH library can't connect through a jump host (ProxyJump)." or "Claude's built-in SSH library can't check host keys against a certificate authority or another known\_hosts file."
635647
636* **"Ask your IT administrator to set sshTransport to system-openssh"**: the built-in client is the device's default, and the device has a usable OpenSSH client. Set [`sshTransport`](https://claude.com/docs/third-party/claude-desktop/configuration#sshtransport) to `system-openssh`. Claude Desktop 4.5284.0 or later doesn't show this title: the OpenSSH client makes the connection instead.
648* **"Ask your IT administrator to set sshTransport to system-openssh"**: the built-in client is the device's default, and the device has a usable OpenSSH client. Set [`sshTransport`](https://claude.com/docs/third-party/claude-desktop/configuration#sshtransport) to `system-openssh`. Claude Desktop 4.16336.0 or later doesn't show this title: the OpenSSH client makes the connection instead.
637649* **"Ask your IT administrator to change sshTransport from builtin to system-openssh"**: your configuration sets `sshTransport` to `builtin`. Change it to `system-openssh`.
638650* **"Ask your admin to correct the sshTransport setting"**: the app can't read the value that your configuration gives `sshTransport`, for example a misspelling, so the built-in client makes the connection. Correct the value. Requires Claude Desktop 2.37337.0 or later.
639* **"Ask your IT administrator to install Microsoft OpenSSH 9.4 or newer and set sshTransport to system-openssh, then quit and reopen Claude"**: the built-in client is the device's default, and the app found no usable OpenSSH client on the device. Install the client, and set the key. Claude Desktop 4.5284.0 or later shows the next title instead.
640* **"Ask your IT administrator to install Microsoft OpenSSH 9.4 or newer, then quit and reopen Claude"**: the app found no usable OpenSSH client on the device. Install the client. Before Claude Desktop 4.5284.0, this title appears only where `sshTransport` is `system-openssh`.
641* **"Check your network or VPN and try again, or quit and reopen Claude"**: the device's configuration from the Enterprise Admin Console or a bootstrap server hasn't loaded, so the built-in client made the connection. Requires Claude Desktop 4.5284.0 or later.
651* **"Ask your IT administrator to install Microsoft OpenSSH 9.4 or newer and set sshTransport to system-openssh, then quit and reopen Claude"**: the built-in client is the device's default, and the app found no usable OpenSSH client on the device. Install the client, and set the key. Claude Desktop 4.16336.0 or later shows the next title instead.
652* **"Ask your IT administrator to install Microsoft OpenSSH 9.4 or newer, then quit and reopen Claude"**: the app found no usable OpenSSH client on the device. Install the client. Before Claude Desktop 4.16336.0, this title appears only where `sshTransport` is `system-openssh`.
653* **"Check your network or VPN and try again, or quit and reopen Claude"**: the device's configuration from the Enterprise Admin Console or a bootstrap server hasn't loaded, so the built-in client made the connection. Requires Claude Desktop 4.16336.0 or later.
642654* **"Quit and reopen Claude; if this comes back, ask your IT administrator to let Claude use the system OpenSSH client"**: the device couldn't start the OpenSSH client earlier in this run of the app (see [Host requirements](#host-requirements)).
643655
644656Where the app can name no step, the card's title gives the cause, either `<host> needs a jump host, which Claude can't use here` or `Claude can't check <host>'s key here`.
from line 659
647659
648660### Ask your IT administrator to fix the configured SSH program
649661
650The program that `sshClientPath` names is missing, can't be run, is too old, or on Windows doesn't meet the conditions for its kind. Claude Desktop never runs another `ssh` in its place. Select **View details** on the card for the program's path. On a Windows device, to find the condition, see [Use the OpenSSH client of Git for Windows](#use-the-openssh-client-of-git-for-windows) or [Use an OpenSSH client installed per user](#use-an-openssh-client-installed-per-user). With no `sshClientPath`, the card appears on a macOS or Linux device where `sshTransport` is `system-openssh` and the device can't start its own `ssh`. A Windows device in that state connects with the built-in client.
662The program that `sshClientPath` names is missing, can't be run, is too old, or on Windows doesn't meet the conditions for its kind. Claude Desktop never runs another `ssh` in its place. Select **View details** on the card for the program's path. On a Windows device, to find the condition, see [Use the OpenSSH client of Git for Windows](#use-the-openssh-client-of-git-for-windows) or [Use an OpenSSH client installed per user](#use-an-openssh-client-installed-per-user). With no `sshClientPath`, the card appears on a macOS or Linux device where `sshTransport` is `system-openssh` and the device can't start its own `ssh`. A Windows device in that state connects with the built-in client. Where the built-in client makes the connection, the card also appears if a Windows or Linux device refuses to start the `ssh-keygen` in the folder of the program that `sshClientPath` names, for example under an application control policy. **View details** then shows a line that starts with `ssh-keygen:` and gives the blocked program's path. Allow that program to run, then have the user try again.
651663
652664### This computer won't start Claude's SSH sign-in helper
653665
654666Where the device's OpenSSH client makes the connection, the operating system refused to start one of the helper programs that show `ssh`'s prompts. Without them the app can't ask for a password, a one-time code, or a key passphrase, so a sign-in that needs one fails. Select **View details** on the card for the blocked program's path and, where the operating system gave one, the error code. Allow the program:
655667
656* **Windows devices**, with Claude Desktop 2.37337.0 or later: allow the helper programs as described under [Prepare Windows devices for the OpenSSH client](#prepare-windows-devices-for-the-openssh-client), then have the user try again. With Claude Desktop 4.5284.0 or later and `sshTransport` unset or `auto`, the [built-in client connects instead](#prepare-windows-devices-for-the-openssh-client) where the app itself can't start the helper. The host then stays on that client.
668* **Windows devices**, with Claude Desktop 2.37337.0 or later: allow the helper programs as described under [Prepare Windows devices for the OpenSSH client](#prepare-windows-devices-for-the-openssh-client), then have the user try again. With Claude Desktop 4.16336.0 or later and `sshTransport` unset or `auto`, the [built-in client connects instead](#prepare-windows-devices-for-the-openssh-client) where the app itself can't start the helper. The host then stays on that client.
657669* **macOS and Linux devices**, with Claude Desktop 4.16336.0 or later: allow `claude-ssh-askpass` in the folder that **View details** names, then have the user try again. On these devices the built-in client never connects instead. With `spawn EACCES` on a Linux device, check too that the folder isn't mounted `noexec`.
658670
659671While the fault lasts, Claude Desktop can't reconnect by itself with a saved password. It shows the card only while a user waits for the connection, for example after they start a session or send a message. On a Windows device, the card appears only for a host that accepts a password or a one-time code.
from line 696
684696SSH connected, but Claude Desktop couldn't place or start the remote server or the engine on the host. Select **View details** on the failure card to read the app's own message, which can end with a code in square brackets. Match the code, or the start of the message:
685697
686698* **`[SFTP_UNAVAILABLE]`**: the host's SSH server refused the SFTP subsystem. Enable `Subsystem sftp` in the server's `sshd_config`, or see what a session needs under [Hosts without SFTP](#hosts-without-sftp).
687* **`[SESSION_LIMIT]`**: the host's SSH server refused to open another session on the connection. If the host has to keep its `MaxSessions` limit, update the macOS or Linux device to Claude Desktop 3.1623.0 or later, and see [Hosts that allow one session per connection](#hosts-that-allow-one-session-per-connection). Otherwise, raise `MaxSessions` in the server's `sshd_config`, for example to OpenSSH's default of 10, and reload the SSH server.
699* **`[SESSION_LIMIT]`**: the host's SSH server refused to open another session on the connection. If the host has to keep its `MaxSessions` limit, the device's OpenSSH client has to make the connection. See [Hosts that allow one session per connection](#hosts-that-allow-one-session-per-connection) for the version and the setting that each platform needs. Otherwise, raise `MaxSessions` in the server's `sshd_config`, for example to OpenSSH's default of 10, and reload the SSH server.
688700* **`[SFTP_NOT_STARTED]`**: the host's SSH server accepted the request for SFTP, but the SFTP server ended before its first answer, or text arrived in place of that answer. In a terminal on the device, run `sftp` with the same host, for example `sftp [email protected]`, to see what stops it. Then check the settings and files that the message names, or see what a session needs under [Hosts without SFTP](#hosts-without-sftp).
689701* **`[EXEC_NO_INPUT]`**: the host's SSH server ran the app's command but passed it no input, which setup and the session's own link need. In a terminal on the device, run `echo hi | ssh` with the same host and `cat`, for example `echo hi | ssh [email protected] cat`. It prints `hi` on a host that passes input. Have the host's administrator let commands run over SSH receive input.
690702* **`[ENOSPC]` or `[EDQUOT]`**: a disk is full, or a quota is used up. In a message that starts with `Couldn't prepare the deploy locally`, the disk is the device's. In any other message it is the host's, so free space in the SSH user's home directory. [Host requirements](#host-requirements) gives the space the app needs.
from line 707
695707* **`[SERVER_NOT_RUNNABLE]`**: the remote server didn't run from `~/.claude/remote` in the SSH user's home directory, or stopped before it answered. A home directory mounted `noexec` is one cause, and security software on the host that keeps programs from running there is another. Have the host's administrator check that programs can run from that folder. Before Claude Desktop 4.4212.0, the code appears only on a [host without SFTP](#hosts-without-sftp).
696708* **`[DOWNLOAD_BUSY]`**: Anthropic's download server answered that it is busy, so Claude Desktop couldn't download the engine or the remote server to the device. Claude Desktop has already waited and asked again. Have the user try again in a few minutes. If the code keeps coming back, check whether a proxy on the device's network limits downloads from `downloads.claude.ai`, because a proxy can give the same answer.
697709
698`[SESSION_LIMIT]` and `[SFTP_NOT_STARTED]` require Claude Desktop 2.31226.0 or later, and appear only when the device's OpenSSH client makes the connection. `[SESSION_LIMIT]` appears only on macOS and Linux devices. Their cards are titled `<host> allows too few SSH sessions per connection` and `SFTP doesn't start on <host>`.
710`[SESSION_LIMIT]` and `[SFTP_NOT_STARTED]` require Claude Desktop 2.31226.0 or later. `[SFTP_NOT_STARTED]` appears only when the device's OpenSSH client makes the connection. Their cards are titled `<host> allows too few SSH sessions per connection` and `SFTP doesn't start on <host>`.
711
712In Claude Desktop 4.16336.0 or later, `[SESSION_LIMIT]` also appears where the built-in client makes the connection, on a device of any platform. Before Claude Desktop 4.16336.0, it appears only on macOS and Linux devices, and only when the device's OpenSSH client makes the connection.
699713
700714`[CLI_NOT_RUNNABLE]` and `[EXEC_NO_INPUT]` require Claude Desktop 2.37337.0 or later. `[EXEC_NO_INPUT]` appears only where the device's OpenSSH client makes the connection. Their cards are titled `Claude Code didn't run on <host>` and `Ask <host>'s administrator to let SSH commands receive input`. From the same version, the card is titled `Couldn't copy Claude Code to <host>` where the app couldn't put its files on the host, and `Couldn't install Claude Code on <host>` where the engine's install failed, each for a cause with no card of its own.
701715
No line in this hunk matches that.