SDK hosts can send managed settings in the initialize request

What

Managed settings are settings an organization enforces on Claude Code. The SDK (the library for running Claude Code from other programs) can now send them inside the initialize request, the first message it sends to Claude Code, instead of as a command-line argument.

• The SDK process transport has a new managedSettingsViaInitialize option. When it is set, Claude Code is started with --managed-settings-in-initialize, and in some cases also --await-initialize. Otherwise the older --managed-settings path is used. The members do not show what decides when --await-initialize is added.
• --managed-settings-in-initialize is a new command-line flag. It requires --await-initialize and --input-format=stream-json with input piped in. Claude Code reads the managed settings from the first initialize request and applies them.
• The flag errors out if combined with --managed-settings, --sdk-url or a subcommand, or if no usable initialize request arrives.
• A new startup refusal code, managed_settings_not_delivered, is used when Claude Code cannot use the managed settings carried in the initialize request. No session starts without those settings.
• The initialize reply gains managed_settings_applied, marked @internal. A host that sends managed settings must send no prompt until this value is true.
• When managed settings are set, the SDK starts a timeout waiting for the initialize reply. If it runs out, the prompt is not sent and the error says the managed settings could not be confirmed and the prompt was not sent. Before, only a hook set to block did this.
• When managed settings are set, every control request type not on an exempt list is held back behind the prompt hold. Before, only a fixed set of types was held.
• New capability names sdk_managed_settings_in_initialize and sdk_drop_hook_matchers were added.

Why

Organization settings can reach an embedded Claude Code over its input stream. If they fail to arrive, Claude Code refuses to start rather than running without them, and no prompt is sent until they are confirmed as applied.