The whole hunk
from line 148, old and new numbered
/
lines
from line 148
148148
149149### Corporate root for app connections
150150
151The `[network] ca_bundle` key in `config.toml` points at a PEM file whose certificates Claude Science adds to its default trust for sign-in, the Claude API, Anthropic-hosted connectors, and update checks; the public roots stay in place, so the file holds only your corporate root. The path rules are in the [configuration file reference](/docs/claude-science/configuration-file-reference#app-connection-keys). A failing value is ignored with a warning rather than stopping the app, so a sign-in error behind inspection usually means the bundle did not load, and the app re-reads the bundle every few minutes, so a corrected file takes effect without a restart. When you deploy a `config.toml`, deploy the bundle files alongside it.
151The `[network] ca_bundle` key in `config.toml` points at a PEM file whose certificates Claude Science adds to its default trust for sign-in, the Claude API, Anthropic-hosted connectors, update checks, and [cloud storage](/docs/claude-science/cloud-storage) access from Settings. For cloud storage, the corporate root applies to Amazon S3 and S3-compatible connections, and to Google Cloud Storage connections that use an HMAC key. The public roots stay in place, so the file holds only your corporate root. The path rules are in the [configuration file reference](/docs/claude-science/configuration-file-reference#app-connection-keys). A failing value is ignored with a warning rather than stopping the app, so a sign-in error behind inspection usually means the bundle did not load, and the app re-reads the bundle every few minutes, so a corrected file takes effect without a restart. When you deploy a `config.toml`, deploy the bundle files alongside it.
152152
153153### Corporate root for package downloads
154154
from line 171
171171
172172### What the certificate settings do not cover
173173
174Code that Claude runs inside a session, such as a `pip install` typed into a cell or an R `install.packages()` call, does not see either bundle; behind TLS inspection, have Claude install packages into an environment rather than in a cell.
174Code that Claude runs inside a session, such as a `pip install` typed into a cell or an R `install.packages()` call, is covered on macOS but not on Linux. On macOS, Python, pip, curl, git, and downloads from R in the session's environments trust the same certificates as environment builds: the `[conda] ca_bundle` file if you set one, otherwise the system's public roots plus the corporate root Claude Science finds in the macOS keychain (`[network] ca_bundle` alone does not reach in-session code). On Linux, neither bundle reaches code inside a session: curl and git there honor a root installed in the operating system's trust store, but the environment's Python, pip, and R see public roots only, so behind TLS inspection, have Claude install packages into an environment rather than in a cell.
175175
176176The local connectors (the bundled research tools) do not work behind TLS inspection in this release: they run in their own Python environment, and nothing delivers your corporate root to that environment, so their connections fail certificate verification. This is a known limitation. Claude Science does detect TLS inspection from your configured CA bundle and relax the connectors' strict certificate-profile check, which stops them from rejecting a corporate root whose Basic Constraints extension is not marked critical, but that relaxation adds no trust. The Anthropic-hosted connectors keep working once `[network] ca_bundle` is set. Connector installs that use `npm` also keep npm's own certificate configuration.
177177