Configuration reference changedthird-party/claude-desktop/configuration
Nearest release: v2.1.322, published 19 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 10 Nov 2026 21:15 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 10 Nov 2026 21:37 UTC.
Upstream edited
Recorded here
Lines+122added
Lines−69removed
From line
154
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits74to this page, all time
### `organizationAnnouncement`
The whole hunk
from line 154, old and new numbered
/
from line 154
154154| [`deploymentDisplayName`](#deploymentdisplayname) | Deployment display name | Appearance | Admin Console |
155155| [`deploymentDisplaySubtitle`](#deploymentdisplaysubtitle) | Deployment display subtitle | Appearance | |
156156| [`disableConfigDeprecationWarnings`](#disableconfigdeprecationwarnings) | Hide configuration deprecation warnings | Appearance | Admin Console |
157| [`organizationAnnouncement`](#organizationannouncement) | Organization announcement | Appearance | Admin Console |
157158| [`banner`](#banner) | Organization banner | Appearance | Admin Console |
158159| [`sessionStatusLine`](#sessionstatusline) | Status line | Appearance | Admin Console |
159160| [`disableFeatureDiscovery`](#disablefeaturediscovery) | Hide feature announcements | Appearance | Admin Console |
from line 340
339340>
340341> SOCKS proxies and embedded credentials (`user:pass@`) are rejected.
341342>
342> This is an app-behavior key, like `disableAutoUpdates`. If your MDM profile holds nothing but such keys, the app reads them all from that profile alone, so put every one you use there.
343> It is an app-behavior key. If your MDM profile holds only such keys, a user's or bootstrap server's value for one is ignored: put all you use there.
343344
344345***
345346
from line 366
365366>
366367> What `egressProxyUrl` lists as not sent through its proxy skips the PAC file too.
367368>
368> This is an app-behavior key, like `disableAutoUpdates`. If your MDM profile holds nothing but such keys, the app reads them all from that profile alone, so put every one you use there.
369> It is an app-behavior key. If your MDM profile holds only such keys, a user's or bootstrap server's value for one is ignored: put all you use there.
369370
370371***
371372
from line 688
687688>
688689> Off unless you set it to `true`. While off, Auto mode's built-in safety check reviews risky actions.
689690>
690> This setting is temporary. It goes away when Claude Code drops that built-in check. After that, only turning off **Allow Auto mode** avoids the provider's check.
691> This setting goes away when Claude Code drops that built-in check. After that, only turning off **Allow Auto mode** avoids the provider's check.
691692>
692693> When on, each Auto mode request carries one more `anthropic-beta` value and a `safeguards` field. The field describes the session, including Claude Code's `autoMode` settings, permission rules, folder paths, a user name and Git state. Your gateway must forward both unchanged, and return `safeguard_results` and tool-use IDs unchanged. If it returns an error such as 401 or 500, every Auto mode turn fails. Turn this off and have users restart the app.
693694>
from line 1138
11371138
11381139> [accordion] More detail
11391140>
1140> Each entry is a model ID string or an object:
1141> Each entry is a model ID or an object:
11411142>
1142> ```json theme={null} theme={null}
1143> ```json theme={null}
11431144> [
11441145> {"name": "claude-sonnet-5",
11451146> "supports1m": true},
from line 1148
11471148> ]
11481149> ```
11491150>
1150> Use your inference provider's exact model ID:
1151> Use your provider's exact model ID:
11511152>
11521153> * **Vertex:** the publisher ID (`claude-sonnet-5`).
11531154> * **Bedrock:** the inference-profile ID (`us.anthropic.claude-sonnet-5`).
11541155> * **Foundry:** the deployment name.
1155> * **Gateway:** the exact ID that its `/v1/models` endpoint returns.
1156> * **Gateway:** the ID its `/v1/models` endpoint returns.
11561157>
1157> For Auto mode on a gateway, also list `claude-sonnet-5`. Its safety classifier calls that ID by default (see `autoModeEnabled`).
1158> For Auto mode on a gateway, also list `claude-sonnet-5`, or an Opus or older Sonnet entry tagged with its tier (see `autoModeEnabled`).
11581159
11591160> [accordion] Child attributes (8)
11601161>
from line 1402
14011402
14021403> [accordion] More detail
14031404>
1404> Every connection is still checked against `sshHostAllowlist`. While that list allows no host, the SSH section is hidden.
1405> Every connection is still checked against `sshHostAllowlist`. While that list allows no host, Code offers none of these.
14051406>
14061407> For a connection from this list, the app does not first ask the user to confirm the host. SSH's own host-key checks still apply, so a first connection to a host missing from the user's `known_hosts` may ask the user or fail. Users can still add connections of their own.
14071408>
from line 1511
15101511>
15111512> `standard` turns on Unified Claude. `off` turns Chat and Cowork off, which leaves only Code, or nothing where Code is off. `isClaudeCodeForDesktopEnabled` still decides Code. Under `standard`, if you use `chatSessionRetentionDays`, set `coworkSessionRetentionDays` as well: it covers new conversations that are Cowork tasks.
15121513>
1513> **Unset:** the three settings that this key replaces decide until November 10, 2026 (12:00 PM PT). Current versions of the app started after that read an unset key as `standard`, whatever those three say. Cowork is then on even where `coworkTabEnabled` is `false`.
1514> **Unset:** the three settings that this key replaces decide until November 10, 2026 (12:00 PM PT). Current versions started after that read an unset key as `standard`, so Cowork is on even where `coworkTabEnabled` is `false`. Where those three leave Chat and Cowork off, the newest versions read `off` until December 17, 2026 (12:00 PM PT).
15141515>
15151516> A non-empty value that the app does not recognize, such as `Standard`, is read as `off`.
15161517
from line 1557
15561557> * **Ports:** an entry other than `*` can end in `:port`, which only Code ignores. Update all devices first: older versions then block every host in Cowork's shell.
15571558> * **Plugins:** command-line tools also reach hosts their plugin declares.
15581559> * **Built-in browser:** a list other than `*`, even an empty one, limits Claude's browsing.
1559> * **Code:** a list other than `*` locks Claude Code's sandbox on, for shell commands only, where it runs (see `allowedWorkspaceFolders`). So does an unset list, except where a local file is the only configuration and `blockReadsOutsideWorkingDirectories` is off. Claude Code's own managed settings, where a session has any, take priority by default.
1560> * **Code:** a list other than `*` locks Claude Code's sandbox on, for shell commands only, where it runs (see `allowedWorkspaceFolders`). So does an unset list, except where a local file is the only configuration and `blockReadsOutsideWorkingDirectories` is off. Claude Code's own managed settings take priority by default.
15601561
15611562***
15621563
from line 1572
15711572> Claude can read and write in every listed folder unless its `mode` is `ro`. An empty list allows none.
15721573>
15731574> * **Paths:** `~` and these variables expand per user: `%OneDrive%`, `%OneDriveCommercial%`, `%OneDriveConsumer%`, `%APPDATA%`, `%LOCALAPPDATA%`, `%USERNAME%`, `%XDG_DOCUMENTS_DIR%`. An entry with any other variable, or an unset one, adds no folder.
1574> * **Code shell commands:** this key turns on Claude Code's sandbox on macOS, and on Linux and WSL2 where bubblewrap and socat work. There, most writes outside the list are refused, and most reads are not. Elsewhere, Windows included, only Claude's file tools follow the list. Claude Code's own managed settings, where a session has any, take priority by default.
1575> * **Code shell commands:** this key turns on Claude Code's sandbox on macOS, and on Linux and WSL2 where bubblewrap and socat work. There, most writes outside the list are refused, and most reads are not. Elsewhere, Windows included, only Claude's file tools follow the list. Claude Code's own managed settings take priority by default.
15751576>
15761577> Do not list a home folder: it holds SSH keys and shell start-up files.
15771578
from line 1619
16181619>
16191620> The user's git configuration files stay readable, and they can hold credentials. If the app cannot download its Claude Code, sessions may run on an older copy without this block.
16201621>
1621> Claude Code's own managed settings, where a session has any, take priority by default.
1622> Claude Code's own managed settings take priority by default.
16221623
16231624***
16241625
from line 1633
16321633>
16331634> Unless it is `false`, new Code sessions normally start in Auto mode.
16341635>
1635> By default on a gateway, Auto mode sends its own requests to Claude Sonnet 5. Your gateway must accept the ID `claude-sonnet-5` and the `anthropic-beta` value `context-1m-2025-08-07`. If you set `inferenceModels`, list that ID there and in any group's model list. If not, Auto mode can block actions it would normally allow.
1636> By default on a gateway, Auto mode's check calls `claude-sonnet-5`. Your gateway must accept that ID and the `anthropic-beta` value `context-1m-2025-08-07`. If you set `inferenceModels`, list that ID, or an Opus or older Sonnet entry tagged with its tier, there and in any group's model list. If not, Auto mode can block actions it would normally allow.
1637>
1638> In Cowork, while Auto mode runs, each shell command waits for this check (usually one more request). If no check can be made, the command is refused. On a model that can't run Auto mode, the task switches to Manually approve and shell commands skip this check. A plugin whose start hook sends a task's first message turns this check off for that task.
16361639
16371640***
16381641
from line 1706
17031706> Nothing is deleted: turning it back on restores the hidden marketplaces.
17041707>
17051708> * It does not limit Claude Code in a terminal.
1706> * Claude Code's own managed settings, where a session has any, take priority by default. Restrict marketplaces in those settings as well.
1709> * Claude Code's own managed settings take priority by default. Restrict marketplaces in those settings as well.
17071710>
17081711> Applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set `deploymentMode` to `3p`, or `disableDeploymentModeChooser`.
17091712
from line 1843
18401843>
18411844> `ask` also turns off the user's saved “always allow” choices for that tool. A scheduled task in Cowork waits at the prompt.
18421845>
1843> **Rules such as `Bash(curl *)`:** Claude Code's own managed settings, where a session has any, take priority by default. A tool name such as `Bash` still applies. Update all devices first: an older version drops these rules, so the tool runs without a prompt.
1846> **Rules such as `Bash(curl *)`:** Claude Code's own managed settings take priority by default. A tool name such as `Bash` still applies. Update all devices first: an older version drops these rules, so the tool runs without a prompt.
18441847>
18451848> An unusable entry is dropped and recorded as a configuration error.
18461849
from line 1897
18941897>
18951898> MDM profile only. Only a machine-wide `false` (`HKLM`) allows WSL sessions on a device with any managed configuration.
18961899>
1897> For a WSL session that starts under `allowedWorkspaceFolders`, Desktop checks it inside the distro, so `~` also means the distro user's home. The session needs both bubblewrap and socat there to start. Shell commands can read the Windows drives under `/mnt`. `blockReadsOutsideWorkingDirectories` hides them, apart from listed `/mnt` folders. Users can re-open them. Claude Code's server-managed settings, among others, can take away that read limit and the sandbox: see the list's Path help.
1900> Under `allowedWorkspaceFolders`, a WSL session needs bubblewrap and socat in the distro, and its shell commands can read the Windows drives under `/mnt`. Claude Code's server-managed settings, among others, can remove its sandbox and `blockReadsOutsideWorkingDirectories`: see the Path help of `allowedWorkspaceFolders`.
18981901>
1899> This is an app-behavior key, like `disableAutoUpdates`. If your MDM profile holds nothing but such keys, the app reads them all from that profile alone, so put every one you use there.
1902> It is an app-behavior key. If your MDM profile holds only such keys, a user's or bootstrap server's value for one is ignored: put all you use there.
19001903
19011904***
19021905
from line 1913
19101913
19111914> [accordion] More detail
19121915>
1913> The launcher comes from the device's managed settings, not server-managed settings. SSH sessions to Linux or macOS hosts use the one in the host's managed-settings files.
1916> The launcher comes from the device's managed settings, not server-managed settings. SSH sessions to Linux or macOS use the host's managed-settings files.
19141917>
1915> * **Credentials:** the app passes the launcher no inference credential. The launcher must supply one, such as `ANTHROPIC_AUTH_TOKEN`, or every reply fails.
1916> * **Not used:** on Windows for sessions on the device, in WSL, in Cowork, and for the connection test and title generation.
1918> * **Credentials:** the app passes no inference credential. The launcher must supply one, such as `ANTHROPIC_AUTH_TOKEN`, and keep `ANTHROPIC_BASE_URL` or set your gateway's, or every reply fails.
1919> * **Not used:** for sessions on a Windows device, in WSL, in Cowork, and for the connection test and title generation.
19171920>
19181921> To stop users bypassing the launcher, set this key in your MDM profile, with `disableDeploymentModeChooser` if that profile sets more than app-behavior keys.
19191922>
1920> This is an app-behavior key, like `disableAutoUpdates`. If your MDM profile holds nothing but such keys, the app reads them all from that profile alone, so put every one you use there.
1923> It is an app-behavior key. If your MDM profile holds only such keys, a user's or bootstrap server's value for one is ignored: put all you use there.
19211924
19221925***
19231926
from line 2121
21182121> >
21192122> > Unset is off, except in Admin Console organizations, where it is on unless an admin turns it off. Without the Admin Console, also set `deploymentOrganizationUuid`. Only sessions stored before you set it are copied.
21202123> >
2121> > It brings back more than sessions, without asking the user. That includes:
2124> > Without asking the user, it brings back more than sessions, including:
21222125> >
2123> > * The user's Cowork memory, global instructions and Instructions for Claude, which are used at once, unreviewed.
2126> > * The user's Cowork memory, global instructions, Instructions for Claude and project descriptions, which are used at once, unreviewed.
2127> > * The folders connected to Cowork projects and sessions. Claude can read and change their files, as under the earlier configuration.
21242128> > * Scheduled tasks. A task that was on runs at its next scheduled time.
21252129> > * Uploaded plugins, unless `userPluginUploadsEnabled` is off. They can run programs on the device.
21262130> > * Saved skills, unless `skillCreationEnabled` is off.
from line 2135
21312135>
21322136> > [accordion] More detail
21332137> >
2134> > The zip contains sessions, projects and their files, memory, scheduled tasks, saved skills, uploaded plugins, some app preferences, and local MCP servers. Passwords or API keys in them are included. Sign-ins and the servers’ variable values are not. Treat it as sensitive data.
2138> > The zip can contain sessions, projects and their files, memory, scheduled tasks, saved skills, uploaded plugins, some app preferences, and local MCP server commands. Passwords or API keys in them are included. Treat it as sensitive data.
2139> >
2140> > This setting does not cover the `/export` command.
21352141>
21362142> **bannerBehavior** `enum`
21372143>
from line 2192
21862192> >
21872193> > Also applies to an installed plugin's server that matches this entry by URL, or else by name (letter case is ignored).
21882194> >
2189> > * That server follows this entry instead of `orgPluginSettings`, even if the entry sets no `toolPolicy`. A built-in entry (one with `server`) applies only if it sets one.
2195> > * That server follows this entry instead of `orgPluginSettings`, even if the entry sets no `toolPolicy`. A built-in entry (one with `server`) applies only if it sets one. A local entry applies only where it has a `command`.
21902196> > * For a server that only a plugin runs, use an entry with `transport: "policy-only"`.
2191> > * Claude Code runs or connects to some plugin servers itself. For those: Claude Code's own managed settings, where a session has any, take priority by default.
2197> > * Claude Code runs or connects to some plugin servers itself. For those: Claude Code's own managed settings take priority by default.
21922198>
21932199> > [tab] microsoft365
21942200> >
from line 2302
22962302> >
22972303> > > [accordion] More detail
22982304> > >
2299> > > A value written here replaces the entry's value whole: lists and maps are not merged.
2305> > > Lists and maps are replaced, not merged.
23002306> > >
2301> > > * A local (`stdio`) entry can repeat `command`, `args`, `env`, `envHelper` and `envHelperArgs`. It always needs its own `command` too.
2307> > > * A local (`stdio`) entry can repeat `command`, `args`, `env`, `envHelper` and `envHelperArgs`.
23022308> > > * A remote or web search entry can repeat `headersHelper` and `headersHelperArgs`. If it gives `headersHelper` here, it needs its own too.
23032309> > > * A mistake under any operating system drops the server on all of them.
2304> > > * An older version ignores this setting and runs the entry's own values. Until all devices are updated, put the Windows values in the entry itself.
2310> > > * Older versions ignore this setting and use the entry's own values. They and some later versions drop an entry with no `command` of its own. Until all devices are updated, put the Windows values in the entry itself.
23052311> >
23062312> > > [accordion] Child attributes (3)
23072313> > >
from line 2559
25532559> >
25542560> > > [accordion] More detail
25552561> > >
2556> > > A value written here replaces the entry's value whole: lists and maps are not merged.
2562> > > Lists and maps are replaced, not merged.
25572563> > >
2558> > > * A local (`stdio`) entry can repeat `command`, `args`, `env`, `envHelper` and `envHelperArgs`. It always needs its own `command` too.
2564> > > * A local (`stdio`) entry can repeat `command`, `args`, `env`, `envHelper` and `envHelperArgs`.
25592565> > > * A remote or web search entry can repeat `headersHelper` and `headersHelperArgs`. If it gives `headersHelper` here, it needs its own too.
25602566> > > * A mistake under any operating system drops the server on all of them.
2561> > > * An older version ignores this setting and runs the entry's own values. Until all devices are updated, put the Windows values in the entry itself.
2567> > > * Older versions ignore this setting and use the entry's own values. They and some later versions drop an entry with no `command` of its own. Until all devices are updated, put the Windows values in the entry itself.
25622568> >
25632569> > > [accordion] Child attributes (3)
25642570> > >
from line 2623
26172623> >
26182624> > Must be: `stdio`
26192625> >
2620> > **command** `string` *required*
2626> > **command** `string`
26212627> >
26222628> > Consent required (A value that a bootstrap server delivers applies only after the user approves it, unless machine-scoped device management set that server's address. The trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
26232629> >
2624> > Absolute path to the server executable, run on the user’s machine.
2630> > Absolute path to the server executable on the user’s machine. Without it, the server runs only on operating systems with their own Command.
26252631> >
2632> > > [accordion] More detail
2633> > >
2634> > > Required, unless `platformOverrides` gives a `command` for at least one operating system. The server then runs only where it has a `command`. Elsewhere its `toolPolicy` does not apply. It still counts as a managed server there: Claude Code drops MCP servers that users add. No other entry can use its name.
2635> >
26262636> > **args** `string[]`
26272637> >
26282638> > Consent required (A value that a bootstrap server delivers applies only after the user approves it, unless machine-scoped device management set that server's address. The trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
from line 2688
26782688> >
26792689> > > [accordion] More detail
26802690> > >
2681> > > A value written here replaces the entry's value whole: lists and maps are not merged.
2691> > > Lists and maps are replaced, not merged.
26822692> > >
2683> > > * A local (`stdio`) entry can repeat `command`, `args`, `env`, `envHelper` and `envHelperArgs`. It always needs its own `command` too.
2693> > > * A local (`stdio`) entry can repeat `command`, `args`, `env`, `envHelper` and `envHelperArgs`.
26842694> > > * A remote or web search entry can repeat `headersHelper` and `headersHelperArgs`. If it gives `headersHelper` here, it needs its own too.
26852695> > > * A mistake under any operating system drops the server on all of them.
2686> > > * An older version ignores this setting and runs the entry's own values. Until all devices are updated, put the Windows values in the entry itself.
2696> > > * Older versions ignore this setting and use the entry's own values. They and some later versions drop an entry with no `command` of its own. Until all devices are updated, put the Windows values in the entry itself.
26872697> >
26882698> > > [accordion] Child attributes (3)
26892699> > >
from line 2766
27562766
27572767integerRange: 0–3,650Since 2.7032.0
27582768
2759**Scheduled-task tool approval lifetime.** Days a scheduled task can reuse a persistent MCP tool approval before it asks again. 0 turns reuse off. Unset: no limit.
2769**Scheduled-task tool approval lifetime.** Days a scheduled task reuses a persistent MCP tool approval before asking again. 0 is off. Unset: no limit (Cowork folder deletes: 30 days).
27602770
27612771> [accordion] More detail
27622772>
from line 2788
27782788>
27792789> When `false` comes from an MDM profile, the app starts only the local `managedMcpServers` entries in that same profile, exactly as written there. A `false` from any other source does not do this.
27802790>
2781> Claude Code's own managed settings, where a session has any, take priority by default.
2791> Claude Code's own managed settings take priority by default.
27822792
27832793***
27842794
from line 2804
27942804> * **Once set:** no entry allows a plugin's local (`stdio`) server, and servers that a user or a project configures for Claude Code are not connected.
27952805> * **`policy-only`:** a `managedMcpServers` entry with that `transport` does not allow its server. List the server's own URL here too.
27962806>
2797> Claude Code's own managed settings, where a session has any, take priority by default.
2807> Claude Code's own managed settings take priority by default.
27982808
27992809> [accordion] Child attributes (1)
28002810>
from line 2828
28182828> * **Not affected:** `managedMcpServers` and servers from the org-plugins directory on the device.
28192829> * **Any other form**, such as `serverName`, is reported and blocks every plugin's remote server.
28202830>
2821> Claude Code's own managed settings, where a session has any, take priority by default.
2831> Claude Code's own managed settings take priority by default.
28222832
28232833> [accordion] Child attributes (1)
28242834>
from line 2977
29672977
29682978booleanDefault: falseSince 1.2581.0
29692979
2970**Block nonessential services.** Connector icons, hosted artifact previews, MCP Apps widgets and the Linux spellcheck dictionary. A blocked widget shows an error.
2980**Block nonessential services.** Connector icons, hosted artifact previews, MCP Apps widgets, Linux spellcheck, and GitLab and Gerrit status. Blocked widgets show an error.
29712981
29722982> [accordion] More detail
29732983>
from line 2986
29762986> * Artifacts still render locally.
29772987> * Excel files in the Code tab preview only through Claude’s workspace (the local VM).
29782988> * Spellcheck underlines are off on Linux.
2989> * The Code tab’s pull request bar stops updating or adding GitLab merge requests and Gerrit changes. GitHub pull requests still show. Claude Code may still check GitLab or Gerrit with your command-line sign-ins unless Block nonessential telemetry is on.
29792990>
29802991> Windows still downloads a dictionary for a language it cannot check natively. This key does not stop that download.
29812992
from line 3082
30713082
30723083One of: `off`, `error` (default), `warn`, `info`, `debug`
30733084
3085> [accordion] More detail
3086>
3087> Every level but `off` also sends one info record, `lam_vm_edr_extension_install_completed`, each time the Cowork workspace VM reports that an endpoint security (EDR) package installed. Filter on that name to leave it out of your collector.
3088
30743089***
30753090
30763091#### `otlpContentCapture`
from line 3156
31413156>
31423157> On Windows the notice covers installs from the MSIX package, not the Microsoft Store version or the .exe installer. The switch to the newer version may end the Cowork tasks of other users signed in on that device.
31433158>
3144> This is an app-behavior key, like `releaseChannel`. If your MDM profile holds nothing but such keys, the app reads them all from that profile alone, so put every one you use there.
3159> It is an app-behavior key. If your MDM profile holds only such keys, a user's or bootstrap server's value for one is ignored: put all you use there.
31453160
31463161***
31473162
from line 3173
31583173> * **Unset:** off in third-party deployments. Where users sign in with Claude.ai it follows Anthropic's rollout, and `false` keeps it off.
31593174> * **Windows:** if Windows does not reopen Claude, scheduled tasks and background work stop until a user opens it. The restart may also end the Cowork tasks of other users signed in on that device.
31603175>
3161> This is an app-behavior key, like `disableAutoUpdates`. If your MDM profile holds nothing but such keys, the app reads them all from that profile alone, so put every one you use there.
3176> It is an app-behavior key. If your MDM profile holds only such keys, a user's or bootstrap server's value for one is ignored: put all you use there.
31623177
31633178***
31643179
from line 3191
31763191> * Idle means 10 minutes without input. Where the system reports no idle time, as some Wayland sessions do, an unset key never restarts: set a number.
31773192> * The restart waits while Claude is mid-task on the device.
31783193>
3179> This is an app-behavior key, like `disableAutoUpdates`. If your MDM profile holds nothing but such keys, the app reads them all from that profile alone, so put every one you use there.
3194> It is an app-behavior key. If your MDM profile holds only such keys, a user's or bootstrap server's value for one is ignored: put all you use there.
31803195
31813196***
31823197
from line 3210
31953210>
31963211> These hours do not delay an update. It usually installs sooner, after 10 minutes with no Claude window in use and no task running.
31973212>
3198> This is an app-behavior key, like `disableAutoUpdates`. If your MDM profile holds nothing but such keys, the app reads them all from that profile alone, so put every one you use there.
3213> It is an app-behavior key. If your MDM profile holds only such keys, a user's or bootstrap server's value for one is ignored: put all you use there.
31993214
32003215***
32013216
from line 3226
32113226>
32123227> If an MDM profile sets `bootstrapUrl` to a `config.claude.com` URL and leaves `bootstrapEnabled` on, the app reads the feed from `releases.claude.com` whatever this key says. Turn this key on anyway: an older version reads it from there only when this key is on.
32133228>
3214> This is an app-behavior key, like `disableAutoUpdates`. If your MDM profile holds nothing but such keys, the app reads them all from that profile alone, so put every one you use there.
3229> It is an app-behavior key. If your MDM profile holds only such keys, a user's or bootstrap server's value for one is ignored: put all you use there.
32153230
32163231***
32173232
from line 3247
32323247> * Users who sign in to Claude.ai follow `stable`, unless their organization manages Claude Desktop from the Admin Console.
32333248> * No effect on Linux or Microsoft Store installs.
32343249>
3235> This is an app-behavior key, like `disableAutoUpdates`. If your MDM profile holds nothing but such keys, the app reads them all from that profile alone, so put every one you use there.
3250> It is an app-behavior key. If your MDM profile holds only such keys, a user's or bootstrap server's value for one is ignored: put all you use there.
32363251
32373252***
32383253
from line 3265
32503265>
32513266> When an MDM profile that sets more than app-behavior keys first reaches a running app, the restart dialog can show with no countdown.
32523267>
3253> This is an app-behavior key, like `disableAutoUpdates`. If your MDM profile holds nothing but such keys, the app reads them all from that profile alone, so put every one you use there.
3268> It is an app-behavior key. If your MDM profile holds only such keys, a user's or bootstrap server's value for one is ignored: put all you use there.
32543269
32553270***
32563271
from line 3279
32643279>
32653280> A change that needs a restart starts the `relaunchEnforcementHours` countdown.
32663281>
3267> This is an app-behavior key, like `disableAutoUpdates`. If your MDM profile holds nothing but such keys, the app reads them all from that profile alone, so put every one you use there.
3282> It is an app-behavior key. If your MDM profile holds only such keys, a user's or bootstrap server's value for one is ignored: put all you use there.
32683283
32693284***
32703285
from line 3315
33003315
33013316> [accordion] More detail
33023317>
3303> Applies only while the app runs in third-party mode. Deletion can start shortly after the app gets this configuration. Pinned sessions are not exempt. Opening an old chat or Cowork task without continuing it does not reliably keep it.
3318> Applies only in third-party mode. Deletion can start shortly after the app gets this configuration. Pinned sessions are not exempt. Opening an old chat or Cowork task without continuing it may not keep it.
33043319>
33053320> It does not delete, for example:
33063321>
from line 3328
33133328>
33143329> A value that cannot be read as a whole number of days deletes nothing.
33153330>
3316> To keep some people's idle sessions, set all three periods to 3650 days for them, in the configuration that sets their periods.
3331> To keep some people's idle sessions, set all three periods to 3650 days in the configuration that sets their periods.
33173332
33183333***
33193334
from line 3340
33253340
33263341> [accordion] More detail
33273342>
3328> Applies only while the app runs in third-party mode. Deletion can start shortly after the app gets this configuration. Pinned sessions are not exempt. Opening an old chat or Cowork task without continuing it does not reliably keep it.
3343> Applies only in third-party mode. Deletion can start shortly after the app gets this configuration. Pinned sessions are not exempt. Opening an old chat or Cowork task without continuing it may not keep it.
33293344>
33303345> It does not delete, for example:
33313346>
from line 3353
33383353>
33393354> A value that cannot be read as a whole number of days deletes nothing.
33403355>
3341> To keep some people's idle sessions, set all three periods to 3650 days for them, in the configuration that sets their periods.
3356> To keep some people's idle sessions, set all three periods to 3650 days in the configuration that sets their periods.
33423357
33433358***
33443359
from line 3365
33503365
33513366> [accordion] More detail
33523367>
3353> Applies only while the app runs in third-party mode. Deletion can start shortly after the app gets this configuration. Pinned sessions are not exempt. Opening an old chat or Cowork task without continuing it does not reliably keep it.
3368> Applies only in third-party mode. Deletion can start shortly after the app gets this configuration. Pinned sessions are not exempt. Opening an old chat or Cowork task without continuing it may not keep it.
33543369>
33553370> It does not delete, for example:
33563371>
from line 3378
33633378>
33643379> A value that cannot be read as a whole number of days deletes nothing.
33653380>
3366> To keep some people's idle sessions, set all three periods to 3650 days for them, in the configuration that sets their periods.
3381> To keep some people's idle sessions, set all three periods to 3650 days in the configuration that sets their periods.
33673382
33683383***
33693384
from line 3466
34513466
34523467***
34533468
3469### `organizationAnnouncement`
3470
3471objectSince 5.1231.0
3472
3473**Organization announcement.** Shows everyone one message from your organization, which each person can close. Off unless set.
3474
3475> [accordion] More detail
3476>
3477> It is signed “From” and your `deploymentDisplayName`, or “From your organization”.
3478>
3479> * **Shown again:** without an `id`, when `title` or `body` changes. With one, only when the `id` changes.
3480> * **Links:** write `[words](address)`, with an `http` or `https` address.
3481> * **Invalid or too long text:** nothing is shown, and the log says why.
3482> * **MDM:** alone in a profile, or with app-behavior keys only, it keeps other settings and wins over the console's message. Update all devices first. A first profile blocks WSL (see `disableWslSessions`). Over a Setup configuration it also takes Code's shell offline on macOS and Linux until Setup sets `coworkEgressAllowedHosts`.
3483> * **Admin Console:** a group's message keeps the organization's `id` and `placement` unless it sets its own.
3484
3485> [accordion] Child attributes (4)
3486>
3487> **title** `string` *required*
3488>
3489> One line of plain text, up to 80 characters.
3490>
3491> **body** `string` *required*
3492>
3493> Markdown: paragraphs, bold, lists and links. Anything else shows as plain text or is left out. Up to 1,000 characters.
3494>
3495> **placement** `enum` (default: inline)
3496>
3497> A card on the start screen of Chat, Cowork and Code, or a dialog over the whole window. Unset: the card.
3498>
3499> One of: `inline` (default), `modal`
3500>
3501> **id** `string`
3502>
3503> Optional. With an ID, people who closed the message see it again only when the ID changes.
3504
3505***
3506
34543507### `banner`
34553508
34563509objectSince 1.7196.0
from line 3546
34933546
34943547> [accordion] More detail
34953548>
3496> * **Runs:** on the user's device, as the signed-in user, when a session opens, a turn ends, the app regains focus or the model changes.
3497> * **Input:** one JSON line on standard input: `{"session_id": "…", "model": {"id": "…", "display_name": "…"}}`. Fields with no value are left out. Do not build a file path from these values.
3549> * **Runs:** on the user's device, as the signed-in user. When: a session opens, a turn ends or its result arrives, the app regains focus or the model changes.
3550> * **Input:** one JSON line on standard input: `{"session_id": "…", "model": {"id": "…", "display_name": "…"}, "cost": {"total_cost_usd": 1.24}}`. `cost` holds only the session's estimated cost in USD, while `inferenceModelPricingEnabled` is on, and is for display only. Fields with no value are left out, so no `cost` means no estimate, not 0. Do not build a file path from these values.
34983551> * **Output:** Claude shows the first non-empty line, up to 200 characters. ANSI codes 31 to 36 and 91 to 96 set the color.
34993552> * **Limits:** 10 seconds and 64 KiB of output. Past either, Claude stops the program.
35003553
from line 3757
37043757
37053758> [accordion] More detail
37063759>
3707> * If a `managedMcpServers` entry is for the same server (same URL, otherwise same name), the entry here is ignored. Put the locks in that entry's `toolPolicy`.
3760> * If a `managedMcpServers` entry is for the same server (same URL, otherwise same name), the entry here is ignored. Put the locks in that entry's `toolPolicy`. On an operating system where that local (`stdio`) entry has no `command`, the entry here applies.
37083761> * Update all devices first: an older version ignores this list and enforces no locks.
3709> * Claude Code's own managed settings, where a session has any, take priority by default.
3762> * Claude Code's own managed settings take priority by default.
37103763
37113764> [accordion] Child attributes (2)
37123765>
No line in this hunk matches that.