ccdesk 0.2.2 → 0.2.4

package/dist/shared/settings-catalog.json

@@ -0,0 +1,2199 @@
+{
+    "$comment": "From https://code.claude.com/docs/en/settings-reference.md",
+    "keys": {
+        "advisorModel": {
+            "summary": "Pick which model answers when Claude asks the [advisor tool](https://code.claude.com/docs/en/advisor)",
+            "category": "Model and responses",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#advisormodel",
+            "about": "Pick which model answers when Claude calls the server-side [advisor tool](https://code.claude.com/docs/en/advisor). Unset it to turn the advisor off. The advisor must be at least as capable as your main model. See [Choose an advisor model](https://code.claude.com/docs/en/advisor#choose-an-advisor-model) for the accepted pairings and what happens when you pick one that isn't accepted.\n\nYou don't usually edit this key by hand. Run `/advisor` to open a picker that shows the current choice, the models that can advise, and **No advisor**. Claude Code saves your pick to this key in `~/.claude/settings.json`. If you pick from a [Remote Control](https://code.claude.com/docs/en/remote-control) client or in a session attached to a remote worker, the pick applies to that session only and doesn't change this key.\n\nIf your account requires the [usage-credits consent](https://code.claude.com/docs/en/advisor#fable-advisor-and-usage-credits), accept it first by running `/model fable`. Until you do, picking Fable in `/advisor` saves nothing and Claude Code tells you to run `/model fable` first.",
+            "type": "string, one of the aliases `\"fable\"`, `\"opus\"`, or `\"sonnet\"`, which resolve to Claude Code's current default version of that model family, or a full model ID such as `\"claude-opus-5-5\"`",
+            "default": "unset, so the advisor is off"
+        },
+        "agent": {
+            "summary": "Start every session as a named [subagent](https://code.claude.com/docs/en/sub-agents) with its prompt, tools, and model",
+            "category": "Agents, sessions, and worktrees",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#agent",
+            "about": "Run the main thread as a named [subagent](https://code.claude.com/docs/en/sub-agents#invoke-subagents-explicitly), so Claude Code applies that subagent's system prompt, tool restrictions, and model to your session. The same key sets the default agent for sessions you dispatch from `claude agents`.",
+            "type": "string, the name of a built-in or custom agent",
+            "default": "unset, so the main thread runs as Claude Code's default agent"
+        },
+        "agentPushNotifEnabled": {
+            "summary": "Let Claude send a [push notification to your phone](https://code.claude.com/docs/en/remote-control#mobile-push-notifications) when it decides to",
+            "category": "Remote, desktop, and notifications",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#agentpushnotifenabled",
+            "about": "Allow Claude to send a push notification to your phone when it decides one is worth sending, for example when a long task finishes. Claude Code syncs this choice to your account, and pushes arrive while [Remote Control](https://code.claude.com/docs/en/remote-control) is connected. Appears in `/config` as **Push when Claude decides**.",
+            "type": "Boolean\n* `true`: Claude can send a push notification to your phone when it decides one is worth sending\n* `false`: Claude doesn't send those notifications",
+            "default": "`false`"
+        },
+        "allowAllClaudeAiMcps": {
+            "summary": "Load the [claude.ai connectors](https://code.claude.com/docs/en/mcp) Claude Code fetches itself alongside a deployed [`managed-mcp.json`](https://code.claude.com/docs/en/managed-mcp#exclusive-control-with-managed-mcp-json)",
+            "category": "MCP",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#allowallclaudeaimcps",
+            "about": "Load the [claude.ai connectors](https://code.claude.com/docs/en/mcp#use-mcp-servers-from-claude-ai) Claude Code fetches itself alongside a deployed `managed-mcp.json`. Without this key, `managed-mcp.json` takes exclusive control of MCP servers and suppresses those connectors.",
+            "type": "Boolean\n* `true`: Claude Code loads the claude.ai connectors alongside a deployed `managed-mcp.json`\n* `false`: a deployed `managed-mcp.json` takes exclusive control of MCP servers and suppresses the claude.ai connectors [Claude Code fetches itself](https://code.claude.com/docs/en/mcp#how-connectors-reach-claude-code)",
+            "default": "`false`, so a deployed `managed-mcp.json` suppresses the claude.ai connectors Claude Code fetches itself"
+        },
+        "allowClaudeInChromeWithManagedMcp": {
+            "summary": "Let the built-in [Claude in Chrome](https://code.claude.com/docs/en/chrome) server run alongside a deployed [`managed-mcp.json`](https://code.claude.com/docs/en/managed-mcp#exclusive-control-with-managed-mcp-json)",
+            "category": "MCP",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#allowclaudeinchromewithmanagedmcp",
+            "about": "Let the built-in [Claude in Chrome](https://code.claude.com/docs/en/chrome) server run alongside a deployed `managed-mcp.json`. Without this key, a deployed `managed-mcp.json` blocks Claude in Chrome in terminal sessions. Requires Claude Code v2.1.282 or later.",
+            "type": "Boolean\n* `true`: the built-in Claude in Chrome server can run alongside a deployed `managed-mcp.json`\n* `false`: a deployed `managed-mcp.json` blocks Claude in Chrome in terminal sessions",
+            "default": "`false`, so a deployed `managed-mcp.json` blocks Claude in Chrome in terminal sessions"
+        },
+        "allowedChannelPlugins": {
+            "summary": "Replace the default allowlist of [channel plugins](https://code.claude.com/docs/en/channels#restrict-which-channel-plugins-can-run) that can push messages",
+            "category": "Plugins and skills",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#allowedchannelplugins",
+            "about": "Choose which [channel](https://code.claude.com/docs/en/channels) plugins can push messages into sessions in your organization. When you set it, Claude Code uses your list in place of the default Anthropic allowlist; each entry names a plugin and the marketplace it comes from.",
+            "type": "array of objects, each with `marketplace` and `plugin` strings. An entry can instead be a `\"plugin@marketplace\"` string such as `\"telegram@claude-plugins-official\"`, which Claude Code treats as the equivalent object. The string form requires Claude Code v2.1.267 or later; earlier versions reject the whole `allowedChannelPlugins` value when it contains one",
+            "default": "unset, so Claude Code uses the default Anthropic allowlist"
+        },
+        "allowedHttpHookUrls": {
+            "summary": "Limit which URLs [HTTP hooks](https://code.claude.com/docs/en/hooks) can target",
+            "category": "Hooks and automation",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#allowedhttphookurls",
+            "about": "Limit which URLs [HTTP hooks](https://code.claude.com/docs/en/hooks#http-hook-fields) can target. When you define this key, Claude Code runs an HTTP hook only if its URL matches one of the patterns and blocks the rest without running them; an empty array blocks every HTTP hook.",
+            "type": "array of URL patterns, with `*` as a wildcard",
+            "default": "unset, so any URL is allowed"
+        },
+        "allowedMcpServers": {
+            "summary": "Allowlist which [MCP servers](https://code.claude.com/docs/en/mcp) users can add",
+            "category": "MCP",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#allowedmcpservers",
+            "about": "Allowlist the MCP servers people can add. Claude Code blocks any server that doesn't match an entry wherever it's defined, including plugin servers, servers a user passes with `--mcp-config`, and servers from claude.ai.\n\nBuilt-in servers such as Claude in Chrome, the `ide` server Claude Code connects to in a running [VS Code](https://code.claude.com/docs/en/vs-code#the-built-in-ide-mcp-server) or [JetBrains](https://code.claude.com/docs/en/jetbrains#the-built-in-ide-mcp-server) IDE, and servers the CLI itself configures are exempt from the allowlist, and the denylist still applies to them. On Claude Code v2.1.268 or later, a [Claude Tag](https://code.claude.com/docs/en/claude-tag) session's Slack tools are also exempt from the allowlist, and the denylist still applies to them. In-process `type: \"sdk\"` servers are exempt from both lists; the [app that started the session](https://code.claude.com/docs/en/mcp#how-connectors-reach-claude-code) registers them.\n\nServers your organization delivers are also exempt from the allowlist, and the denylist still applies to them. The exemption covers every [`managedMcpServers`](https://code.claude.com/docs/en/settings-reference#managedmcpservers) entry, and any [`managed-mcp.json`](https://code.claude.com/docs/en/managed-mcp#exclusive-control-with-managed-mcp-json) entry whose values use no `${VAR}` expansion. See [How a server is evaluated](https://code.claude.com/docs/en/managed-mcp#how-a-server-is-evaluated) for the full check order. Before v2.1.259, servers from `managed-mcp.json` had to match too.",
+            "type": "array of objects, each with exactly one key: `serverName`, a string limited to letters, numbers, hyphens, and underscores; `serverCommand`, an array of the command and its arguments matched exactly; or `serverUrl`, a URL pattern with `*` wildcards",
+            "default": "unset, so every server is allowed; an empty array blocks every server users add"
+        },
+        "allowedProviders": {
+            "summary": "Limit which [API providers](https://code.claude.com/docs/en/third-party-integrations) a machine may use",
+            "category": "Authentication and providers",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#allowedproviders",
+            "about": "List the services a machine may reach Claude through, such as the Anthropic API, Amazon Bedrock, or an LLM gateway. A session on a provider that isn't listed is refused at startup, at login, and when it next contacts the API, so switching to an unlisted provider mid-session is refused too. The [refusal message](https://code.claude.com/docs/en/errors#managed-settings-dont-allow-this-api-provider) names what selected the provider and the steps to continue. Requires Claude Code v2.1.285 or later.",
+            "type": "array of strings, each one of:\n* `\"anthropic\"`: the Anthropic API on Anthropic's own host, through a claude.ai or Console sign-in or an API key. Pair it with [`forceLoginMethod`](https://code.claude.com/docs/en/settings-reference#forceloginmethod) or [`forceLoginOrgUUID`](https://code.claude.com/docs/en/settings-reference#forceloginorguuid) to also restrict the sign-in\n* `\"bedrock\"`: [Amazon Bedrock](https://code.claude.com/docs/en/amazon-bedrock)\n* `\"vertex\"`: [Google Cloud's Agent Platform](https://code.claude.com/docs/en/google-vertex-ai), formerly Vertex AI\n* `\"foundry\"`: [Microsoft Foundry](https://code.claude.com/docs/en/microsoft-foundry)\n* `\"anthropicAws\"`: [Claude Platform on AWS](https://code.claude.com/docs/en/claude-platform-on-aws)\n* `\"mantle\"`: the Amazon Bedrock [Mantle endpoint](https://code.claude.com/docs/en/amazon-bedrock#use-the-mantle-endpoint). A session that [runs Mantle alongside the Invoke API](https://code.claude.com/docs/en/amazon-bedrock#run-mantle-alongside-the-invoke-api) uses both providers, so list `\"bedrock\"` and `\"mantle\"` together for it\n* `\"customEndpoint\"`: the Anthropic API or a cloud provider's API sent to another host, such as an [LLM gateway](https://code.claude.com/docs/en/llm-gateway) named by `ANTHROPIC_BASE_URL` or by a provider's endpoint variable such as `ANTHROPIC_BEDROCK_BASE_URL`. Claude Code admits it only for the exact value a managed [`env`](https://code.claude.com/docs/en/settings-reference#env) block pins\n* `\"gateway\"`: a [Cloud gateway](https://code.claude.com/docs/en/claude-apps-gateway) sign-in",
+            "default": "unset, so any provider can be used"
+        },
+        "allowManagedHooksOnly": {
+            "summary": "Run only the [hooks](https://code.claude.com/docs/en/hooks) your organization deploys",
+            "category": "Hooks and automation",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#allowmanagedhooksonly",
+            "about": "Restrict hook execution to hooks your organization deploys.",
+            "type": "Boolean\n* `true`: only managed hooks run, plus Agent SDK hooks and hooks from plugins your managed settings force-enable. See [What runs under `allowManagedHooksOnly`](https://code.claude.com/docs/en/settings-reference#what-runs-under-allowmanagedhooksonly)\n* `false`: hooks from every settings scope and plugin run",
+            "default": "unset, so hooks from every settings scope and plugin run"
+        },
+        "allowManagedMcpServersOnly": {
+            "summary": "Make the managed [MCP](https://code.claude.com/docs/en/mcp) allowlist the only one that applies",
+            "category": "MCP",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#allowmanagedmcpserversonly",
+            "about": "Make the managed allowlist the only one that applies. Claude Code then reads [`allowedMcpServers`](https://code.claude.com/docs/en/settings-reference#allowedmcpservers) from managed settings alone and ignores allowlists in user, project, and local settings; [`deniedMcpServers`](https://code.claude.com/docs/en/settings-reference#deniedmcpservers) still merges from every settings scope, so users can still block servers for themselves. Administrators set it so a user's own settings can't broaden what the managed allowlist permits.",
+            "type": "Boolean\n* `true`: Claude Code reads `allowedMcpServers` from managed settings alone and ignores allowlists in user, project, and local settings\n* `false`: allowlists from every settings scope merge",
+            "default": "`false`, so allowlists from every settings scope merge"
+        },
+        "allowManagedPermissionRulesOnly": {
+            "summary": "Make [managed settings](https://code.claude.com/docs/en/managed-settings) the only settings source of [permission rules](https://code.claude.com/docs/en/permissions#managed-settings)",
+            "category": "Permission settings",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#allowmanagedpermissionrulesonly",
+            "about": "Make managed settings the only settings source of permission rules. Claude Code then ignores `allow`, `ask`, and `deny` rules in user, project, local, and `--settings` files, ignores `--allowedTools`, hides the always-allow choices in permission prompts, and stops saving new rules.\n\nWhen [parent settings from an embedding host](https://code.claude.com/docs/en/managed-settings#let-an-embedding-host-add-policy) apply, Claude Code treats them as part of the managed tier. It drops their `allow` rules and `additionalDirectories`, and keeps their `deny` and `ask` rules except `Read` and `Edit` rules whose pattern starts with `!`. A host can't carve paths out of the managed rules with a `!` rule, whether or not you set this key.\n\n`--disallowedTools` rules and the current session's `deny` and `ask` rules still apply, including after Claude Code reloads settings mid-session. They only restrict, so they can't widen what the managed rules grant. Before v2.1.257, Claude Code dropped those command-line and session rules at the first settings reload.\n\nFor what a `!` pattern in a `--disallowedTools` or session rule can carve out, see [Read and Edit rules](https://code.claude.com/docs/en/permissions#read-and-edit).\n\nWhen you set this key, Claude Code v2.1.282 or later also ignores the [`allowed-tools`](https://code.claude.com/docs/en/skills#pre-approve-tools-for-a-skill) frontmatter in skills and `.claude/commands/` files from these sources:\n\n* A repository's `.claude/` directory\n* Your `~/.claude/skills/` and `~/.claude/commands/` directories, including [skills synced from claude.ai](https://code.claude.com/docs/en/skills#where-synced-skills-load)\n* An `--add-dir` directory\n* [Plugins declared with a `.claude-plugin` manifest](https://code.claude.com/docs/en/plugins/loading#plugins-shared-through-a-repository) inside `~/.claude/skills/` or the project's `.claude/skills/`\n\nSkills from managed settings and bundled skills keep their `allowed-tools`. A skill's `disallowed-tools` still applies. For what a developer sees when Claude Code ignores the field, see [When only managed permission rules apply](https://code.claude.com/docs/en/skills#when-only-managed-permission-rules-apply).",
+            "type": "Boolean\n* `true`: managed settings become the only settings source of permission rules\n* `false`: Claude Code applies permission rules from user, project, local, and `--settings` files in addition to the managed ones",
+            "default": "unset, so Claude Code applies permission rules from user, project, and local settings and from `--settings`, in addition to the managed ones"
+        },
+        "alwaysThinkingEnabled": {
+            "summary": "Turn [extended thinking](https://code.claude.com/docs/en/model-config#extended-thinking) off for every session",
+            "category": "Model and responses",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#alwaysthinkingenabled",
+            "about": "Turn [extended thinking](https://code.claude.com/docs/en/model-config#extended-thinking) off for every session by setting this to `false`. Thinking is on by default, so `true` changes nothing. Most people set this through `/config` rather than by editing the file.\n\nOn models that always think, such as Opus 5.5, Sonnet 5.5, Haiku 5.5, and the Fable models, `false` has no effect. On [third-party providers](https://code.claude.com/docs/en/third-party-integrations) Claude Code omits the `thinking` parameter instead of turning thinking off, so adaptive-reasoning models may still think. With thinking turned off on the Anthropic API, Claude Code sends effort `high` instead of a higher level to models it knows [don't accept that combination](https://code.claude.com/docs/en/errors#effort-isnt-available-with-thinking-turned-off), such as Opus 5.",
+            "type": "Boolean\n* `true`: no effect; thinking is already on\n* `false`: Claude Code turns extended thinking off for every session",
+            "default": "unset, so thinking is on for models that support it"
+        },
+        "apiKeyHelper": {
+            "summary": "Generate the [API credential](https://code.claude.com/docs/en/authentication#credential-management) with your own command",
+            "category": "Authentication and providers",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#apikeyhelper",
+            "about": "Run your own command to produce the credential Claude Code sends with model requests. Claude Code runs the command through the system shell, `/bin/sh` on macOS and Linux and `cmd` on Windows, and sends its output as both the `X-Api-Key` and `Authorization: Bearer` headers. Use it for dynamic or rotating credentials, such as short-lived tokens fetched from a vault.",
+            "type": "string, a shell command line",
+            "default": "unset, so Claude Code doesn't run a helper"
+        },
+        "askUserQuestionTimeout": {
+            "summary": "Let an unanswered question [auto-continue](https://code.claude.com/docs/en/tools-reference#question-auto-continue-timeout) after idle time",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#askuserquestiontimeout",
+            "about": "Let an unanswered [`AskUserQuestion`](https://code.claude.com/docs/en/tools-reference) dialog auto-continue after a period of idle time, submitting whatever options you had already selected. Set it when you step away and want Claude to continue without you. With the default, questions wait until you answer them. For when the timer pauses or never starts, see [Question auto-continue timeout](https://code.claude.com/docs/en/tools-reference#question-auto-continue-timeout).",
+            "type": "string, one of `\"60s\"`, `\"5m\"`, `\"10m\"`, or `\"never\"`",
+            "default": "`\"never\"`"
+        },
+        "appendPlugins": {
+            "summary": "Run your organization's [mods](https://code.claude.com/docs/en/plugins/mods/admin) after every mod a user installs",
+            "category": "Plugins and skills",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#appendplugins",
+            "about": "List the managed plugins whose [mods](https://code.claude.com/docs/en/plugins/mods/overview) run after every mod a user installs, in the listed order. An id listed in both `prependPlugins` and `appendPlugins` is prepended. In managed settings, Claude Code skips an id whose plugin doesn't [count as your organization's](https://code.claude.com/docs/en/plugins/mods/admin#install-your-organizations-mods).",
+            "type": "array of `plugin-name@marketplace-name` strings",
+            "default": "unset"
+        },
+        "attribution": {
+            "summary": "Customize the attribution Claude Code adds to commits and pull requests",
+            "category": "Git and attribution",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#attribution",
+            "about": "Customize the attribution Claude Code adds to git commits and pull requests. Commits get a [git trailer](https://git-scm.com/docs/git-interpret-trailers) such as `Co-Authored-By` by default; pull request descriptions get plain text. Set each part separately with the sub-keys below.",
+            "type": "object with `commit` and `pr` strings and a `sessionUrl` Boolean, or `false` to hide all attribution. The `false` value requires Claude Code v2.1.281 or later; earlier versions reject it and [skip the whole user, project, or local settings file](https://code.claude.com/docs/en/settings#fix-a-broken-settings-file) that holds it",
+            "default": "unset, so Claude Code uses the standard attribution shown under each sub-key"
+        },
+        "attribution.commit": {
+            "summary": "Change or hide the trailer Claude Code adds to commits",
+            "category": "Git and attribution",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#attribution-commit",
+            "about": "Set the attribution text Claude Code adds to git commits, including any trailers. Set it to an empty string to hide commit attribution.",
+            "type": "string",
+            "default": "unset, so Claude Code adds `Co-Authored-By: <name> <noreply@anthropic.com>`. The name is the model in use when the commit is made, such as `Claude Sonnet 5`. When a [subagent](https://code.claude.com/docs/en/sub-agents) makes the commit, the trailer names the subagent's model.\n* When Claude Code recognizes the model as a Claude model but can't confirm its exact version, it writes `Claude` alone.\n* When it can't match the model ID to any Claude model, such as a third-party model served through a custom [`ANTHROPIC_BASE_URL`](https://code.claude.com/docs/en/env-vars), it writes `Claude Code`."
+        },
+        "attribution.pr": {
+            "summary": "Change or hide the attribution line in pull request descriptions",
+            "category": "Git and attribution",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#attribution-pr",
+            "about": "Set the attribution text Claude Code adds to pull request descriptions. Set it to an empty string to hide pull request attribution.",
+            "type": "string",
+            "default": "unset, so Claude Code adds `🤖 Generated with [Claude Code](https://claude.com/claude-code)`"
+        },
+        "attribution.sessionUrl": {
+            "summary": "Omit the claude.ai session link from [cloud](https://code.claude.com/docs/en/claude-code-on-the-web) and [Remote Control](https://code.claude.com/docs/en/remote-control) commits",
+            "category": "Git and attribution",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#attribution-sessionurl",
+            "about": "Choose whether Claude Code appends the claude.ai session link when it commits or opens a pull request from a [cloud](https://code.claude.com/docs/en/claude-code-on-the-web) or [Remote Control](https://code.claude.com/docs/en/remote-control) session. Claude Code adds the link as a `Claude-Session` trailer on commits and as a link in pull request descriptions. Set it to `false` to omit the link.",
+            "type": "Boolean\n* `true`: Claude Code appends the claude.ai session link when it commits or opens a pull request from a cloud or Remote Control session\n* `false`: Claude Code omits the link",
+            "default": "`true`"
+        },
+        "autoCompactEnabled": {
+            "summary": "Turn [automatic compaction](https://code.claude.com/docs/en/context-window) off or on",
+            "category": "Memory and context",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#autocompactenabled",
+            "about": "Have Claude Code [compact the conversation automatically](https://code.claude.com/docs/en/context-window#when-your-context-fills-up) when context approaches the limit. Appears in `/config` as **Auto-compact**, and toggling it there writes this key to your user settings.",
+            "type": "Boolean\n* `true`: Claude Code compacts the conversation automatically when context approaches the limit\n* `false`: Claude Code doesn't compact automatically",
+            "default": "`true`"
+        },
+        "autoCompactWindow": {
+            "summary": "Set how full the context gets before Claude Code [compacts](https://code.claude.com/docs/en/context-window)",
+            "category": "Memory and context",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#autocompactwindow",
+            "about": "Set how full the context window gets before Claude Code [compacts automatically](https://code.claude.com/docs/en/context-window#when-your-context-fills-up).",
+            "type": "number of tokens, from `100000` to `1000000`. Claude Code caps the value at your model's context window; the [models overview](https://platform.claude.com/docs/en/about-claude/models/overview) lists each model's window",
+            "default": "unset, so Claude Code picks a window tuned for your model"
+        },
+        "autoConnectIde": {
+            "summary": "Connect to a running [VS Code](https://code.claude.com/docs/en/vs-code) or [JetBrains](https://code.claude.com/docs/en/jetbrains#from-external-terminals) IDE automatically from an external terminal",
+            "category": "Global config settings",
+            "scopes": [],
+            "docs": "https://code.claude.com/docs/en/settings-reference#autoconnectide",
+            "about": "Connect to a running IDE automatically when you start Claude Code from an external terminal. Appears in `/config` as **Auto-connect to IDE (external terminal)** when you run Claude Code outside a VS Code or JetBrains terminal.",
+            "type": "Boolean\n* `true`: Claude Code connects to a running IDE automatically when you start it from an external terminal\n* `false`: Claude Code doesn't connect automatically from an external terminal; inside a VS Code or JetBrains terminal, or with `--ide`, it still connects",
+            "default": "`false`"
+        },
+        "autoContinueAtUsageLimit": {
+            "summary": "Wait in the open session and [continue the task automatically](https://code.claude.com/docs/en/interactive-mode#wait-for-a-usage-limit-to-reset) after a claude.ai usage limit resets",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#autocontinueatusagelimit",
+            "about": "After a claude.ai usage limit stops your session, wait in the open session and continue the task automatically after the reset. See [Turn automatic continue off](https://code.claude.com/docs/en/interactive-mode#turn-automatic-continue-off). Requires Claude Code v2.1.234 or later.",
+            "type": "Boolean\n* `true`: after a claude.ai usage limit stops your session, Claude Code waits in the open session and continues the task automatically after the reset\n* `false`: Claude Code doesn't start the wait on its own. You can still [start a wait yourself](https://code.claude.com/docs/en/interactive-mode#start-a-wait-yourself) from the usage-limit options menu",
+            "default": "`true`"
+        },
+        "autoInstallIdeExtension": {
+            "summary": "Turn off automatic install of the [IDE extension](https://code.claude.com/docs/en/vs-code#install-the-extension) from a VS Code terminal",
+            "category": "Global config settings",
+            "scopes": [],
+            "docs": "https://code.claude.com/docs/en/settings-reference#autoinstallideextension",
+            "about": "Install the Claude Code IDE extension automatically when you run Claude Code from a VS Code terminal. Appears in `/config` as **Auto-install IDE extension** when you run Claude Code inside a VS Code or JetBrains terminal.",
+            "type": "Boolean\n* `true`: Claude Code installs the IDE extension automatically when you run it from a VS Code terminal\n* `false`: Claude Code doesn't install the extension automatically",
+            "default": "`true`"
+        },
+        "autoMemoryDirectory": {
+            "summary": "Store [auto memory](https://code.claude.com/docs/en/memory#auto-memory) in a directory you choose",
+            "category": "Memory and context",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#automemorydirectory",
+            "about": "Store [auto memory](https://code.claude.com/docs/en/memory#storage-location) in a directory of your choice instead of the per-project default.",
+            "type": "string, an absolute or `~/`-prefixed directory path",
+            "default": "unset, so Claude Code uses `~/.claude/projects/<project>/memory/`"
+        },
+        "autoMemoryEnabled": {
+            "summary": "Turn [auto memory](https://code.claude.com/docs/en/memory#auto-memory) off or on",
+            "category": "Memory and context",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#automemoryenabled",
+            "about": "Turn [auto memory](https://code.claude.com/docs/en/memory#enable-or-disable-auto-memory) on or off. When `false`, Claude doesn't read from or write to the auto memory directory. You can also toggle it with `/memory` during a session, which writes this key to your user settings.",
+            "type": "Boolean\n* `true`: the same as unset; auto memory stays on unless something that outranks this key turns it off for the session, such as `--bare`, safe mode, or `CLAUDE_CODE_DISABLE_AUTO_MEMORY`\n* `false`: Claude doesn't read from or write to the auto memory directory",
+            "default": "`true`"
+        },
+        "autoMode": {
+            "summary": "Add your own allow and deny rules to the [auto mode](https://code.claude.com/docs/en/permission-modes#eliminate-prompts-with-auto-mode) classifier",
+            "category": "Permission settings",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#automode",
+            "about": "Add your own rules to what the [auto mode](https://code.claude.com/docs/en/permission-modes#eliminate-prompts-with-auto-mode) classifier blocks and allows. Use it to tell the classifier which repos, buckets, and domains your organization trusts, so it stops blocking routine internal operations. The classifier ships with [built-in allow and deny rules](https://code.claude.com/docs/en/auto-mode-config#inspect-the-defaults-and-your-effective-config). Include the literal string `\"$defaults\"` in an array to keep those built-in rules at that position and add yours around them; leave it out to replace them with yours.",
+            "type": "object with `environment`, `allow`, `soft_deny`, and `hard_deny` arrays of prose rules, plus the [`classifyAllShell`](https://code.claude.com/docs/en/settings-reference#automode-classifyallshell) Boolean",
+            "default": "unset, so the classifier uses only its [built-in rules](https://code.claude.com/docs/en/auto-mode-config#inspect-the-defaults-and-your-effective-config)"
+        },
+        "autoMode.classifyAllShell": {
+            "summary": "Send every shell command through the [auto mode classifier](https://code.claude.com/docs/en/permission-modes#what-the-classifier-blocks-by-default), even ones a narrow allow rule matches",
+            "category": "Permission settings",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#automode-classifyallshell",
+            "about": "Send every Bash and PowerShell command through the auto mode classifier while auto mode is active. By default, auto mode suspends only allow rules that could run arbitrary code: tool-wide and wildcard rules such as `Bash(*)`, and interpreter or shell-wrapper prefixes such as `Bash(python *)`. A command that any other allow rule matches, such as `Bash(npm test)`, skips the classifier unless it carries [per-command allowed domains](https://code.claude.com/docs/en/sandboxing#per-command-allowed-domains-in-auto-mode). When it skips, a destructive argument the rule's prefix didn't anticipate can get through unseen. Setting this key suspends every shell allow rule for the session so the classifier sees every command. Requires Claude Code v2.1.193 or later.",
+            "type": "Boolean\n* `true`: while auto mode is active, Claude Code sends every Bash and PowerShell command through the classifier and suspends your shell allow rules; outside auto mode the rules still apply\n* `false`: auto mode suspends only allow rules that could run arbitrary code, such as `Bash(*)` and `Bash(python *)`; a command that any other allow rule matches skips the classifier unless it carries [per-command allowed domains](https://code.claude.com/docs/en/sandboxing#per-command-allowed-domains-in-auto-mode), and every other shell command goes through it",
+            "default": "`false`"
+        },
+        "autoScrollEnabled": {
+            "summary": "[Follow new output](https://code.claude.com/docs/en/fullscreen#auto-follow) to the bottom in fullscreen rendering",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#autoscrollenabled",
+            "about": "Follow new output to the bottom of the conversation in [fullscreen rendering](https://code.claude.com/docs/en/fullscreen). Turn it off to stay where you scrolled while Claude keeps working; permission prompts still scroll into view.",
+            "type": "Boolean\n* `true`: the conversation follows new output to the bottom\n* `false`: you stay where you scrolled while Claude keeps working; permission prompts still appear below the transcript",
+            "default": "`true`"
+        },
+        "autoUpdatesChannel": {
+            "summary": "Follow the stable [release channel](https://code.claude.com/docs/en/setup#configure-release-channel) instead of latest",
+            "category": "Updates and versioning",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#autoupdateschannel",
+            "about": "Choose which [release channel](https://code.claude.com/docs/en/setup#configure-release-channel) background auto-updates and `claude update` follow. Set `\"stable\"` for a version that is typically about one week old and skips releases with major regressions, or `\"latest\"` for the most recent release.",
+            "type": "string, one of:\n* `\"latest\"`: updates follow the most recent release\n* `\"stable\"`: updates follow a version that is typically about one week old and skips releases with major regressions",
+            "default": "unset, so Claude Code follows `\"latest\"`"
+        },
+        "availableModels": {
+            "summary": "[Restrict which models](https://code.claude.com/docs/en/model-config#restrict-model-selection) people can pick",
+            "category": "Model and responses",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#availablemodels",
+            "about": "Restrict which models people can select for the main session, [subagents](https://code.claude.com/docs/en/sub-agents), [skills](https://code.claude.com/docs/en/skills), and the [advisor](https://code.claude.com/docs/en/advisor). A managed list constrains `/model`, `--model`, and the `model` key in a developer's own files; a model outside it can't be selected. With the default prefix matching, this doesn't touch the Default option on its own; pair it with [`enforceAvailableModels`](https://code.claude.com/docs/en/settings-reference#enforceavailablemodels) for that.",
+            "type": "array of model aliases or IDs",
+            "default": "unset, so every model is available"
+        },
+        "availableModelsMatch": {
+            "summary": "Make each `availableModels` model ID entry [permit only the version it names](https://code.claude.com/docs/en/model-config#block-specific-models-or-versions)",
+            "category": "Model and responses",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#availablemodelsmatch",
+            "about": "Choose how [`availableModels`](https://code.claude.com/docs/en/settings-reference#availablemodels) entries match model IDs. By default a model ID entry also permits later versions that extend it, so `\"claude-opus-5\"` permits Opus 5.5. With `\"exact\"`, each model ID entry permits only the version it names, so a newer version of that model stays blocked until you list it. Requires Claude Code v2.1.283 or later.",
+            "type": "string, one of:\n* `\"prefix\"`: a model ID entry permits its version and any model ID that extends it with another segment\n* `\"exact\"`: a model ID entry permits only the version it names, including that version's dated IDs, so `\"claude-opus-5\"` permits Opus 5 but not `claude-opus-5-5`. A family alias such as `\"opus\"` still permits the whole family, and `best`, `opusplan`, and `default` entries are ignored",
+            "default": "`\"prefix\"`"
+        },
+        "awaySummaryEnabled": {
+            "summary": "Turn off the [session recap](https://code.claude.com/docs/en/interactive-mode#session-recap) shown when you come back to the terminal",
+            "category": "Remote, desktop, and notifications",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#awaysummaryenabled",
+            "about": "Show a one-line session recap when you return to the terminal after a few minutes away. Set it to `false`, or turn off **Session recap** in `/config`, to stop the recap.",
+            "type": "Boolean\n* `true`: you see a one-line session recap when you return after a few minutes away\n* `false`: Claude Code shows no recap",
+            "default": "unset, so the recap is on"
+        },
+        "awsAuthRefresh": {
+            "summary": "Refresh expired [Bedrock credentials](https://code.claude.com/docs/en/amazon-bedrock#advanced-credential-configuration) in `.aws` with your own command",
+            "category": "Authentication and providers",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#awsauthrefresh",
+            "about": "Run your own command, such as `aws sso login`, to refresh the credentials in your `.aws` directory when the ones Claude Code has for [Amazon Bedrock](https://code.claude.com/docs/en/amazon-bedrock) stop working. Claude Code checks the current credentials against STS first and runs the command only when that check fails, then reads the refreshed `.aws` directory.\n\nWhen the check fails at the same time in several Claude Code processes that use the same command and credentials, such as separate terminals or IDE windows, one process runs the command and the rest wait for that run instead of starting their own. A process that has waited 60 seconds with a request pending runs the command itself. To turn this off, set [`CLAUDE_CODE_DISABLE_AUTH_REFRESH_LOCK`](https://code.claude.com/docs/en/env-vars) to `1`.",
+            "type": "string, a shell command line",
+            "default": "unset, so Claude Code doesn't refresh AWS credentials for you"
+        },
+        "awsCredentialExport": {
+            "summary": "Supply [Bedrock credentials](https://code.claude.com/docs/en/amazon-bedrock#advanced-credential-configuration) as JSON from your own command",
+            "category": "Authentication and providers",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#awscredentialexport",
+            "about": "Run your own command that prints AWS credentials as JSON, so Claude Code can call [Amazon Bedrock](https://code.claude.com/docs/en/amazon-bedrock) with credentials that don't live in your `.aws` directory. Claude Code accepts the `aws sts` output shape and the flat `aws configure export-credentials` shape, and scopes the credentials to its own Bedrock client, so the shell commands Claude runs still see your ambient credentials.",
+            "type": "string, a shell command line",
+            "default": "unset, so Claude Code uses the ambient AWS credential chain"
+        },
+        "axScreenReader": {
+            "summary": "Render [screen-reader friendly output](https://code.claude.com/docs/en/accessibility)",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#axscreenreader",
+            "about": "Render screen-reader friendly output: flat text without decorative borders or animations. Screen-reader mode uses the classic renderer, so the `tui` setting has no effect while it is active; attached [background sessions](https://code.claude.com/docs/en/agent-view) still render fullscreen.",
+            "type": "Boolean\n* `true`: Claude Code renders flat text without decorative borders or animations, using the classic renderer\n* `false`: Claude Code renders normally",
+            "default": "unset, so screen-reader mode is off"
+        },
+        "bashEditDiffEnabled": {
+            "summary": "Record the [files that changed while a Bash command ran](https://code.claude.com/docs/en/hooks#bash) in every permission mode",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#basheditdiffenabled",
+            "about": "Choose whether Claude Code records which files changed in a Git repository while a Bash command runs. When it records them, you see their diff in the terminal after the command, and your [PostToolUse Bash hooks](https://code.claude.com/docs/en/hooks#bash) receive the changed-file list.\n\nA listed file isn't always one the command changed. A change that another program or another Bash call made while the command ran can appear there too.\n\nSet the key to `true` to record them in every permission mode. Requires Claude Code v2.1.269 or later.",
+            "type": "Boolean",
+            "default": "unset, so Claude Code records changes in auto mode and `bypassPermissions` mode when it directs Claude to edit files through Bash"
+        },
+        "bashOutputMaxChars": {
+            "summary": "Set how much of a successful command's [output](https://code.claude.com/docs/en/tools-reference#output-limits) Claude receives inline",
+            "category": "Memory and context",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#bashoutputmaxchars",
+            "about": "Set how many characters of a successful Bash or PowerShell command's [output Claude receives inline](https://code.claude.com/docs/en/tools-reference#output-limits). When output passes the limit, Claude Code saves it to a file and Claude receives a short preview plus the file's path. Raise the limit when command output, such as a verbose build or a full test-suite log, routinely overflows the default and you want Claude to read it without opening the file. Requires Claude Code v2.1.261 or later.",
+            "type": "number of characters, a positive integer. Claude Code clamps the value into the range `4000` to `128000`",
+            "default": "unset, so Claude receives up to 30,000 characters inline"
+        },
+        "blockedMarketplaces": {
+            "summary": "Block [plugin marketplace](https://code.claude.com/docs/en/plugins/overview) sources for your organization",
+            "category": "Plugins and skills",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#blockedmarketplaces",
+            "about": "Block plugin marketplace sources for your organization. Claude Code checks the blocklist on marketplace add and on plugin install, update, refresh, and auto-update, so a marketplace someone added before you set the policy can't be used to fetch plugins either. Blocked sources are checked before download, so they never touch the filesystem.\n\nIf you set this key in the [claude.ai admin console](https://code.claude.com/docs/en/server-managed-settings), claude.ai also applies it when anyone in your organization adds a marketplace from a git repository on claude.ai, as [How restrictions work](https://code.claude.com/docs/en/plugins/org#restrict-what-users-can-install) describes.",
+            "type": "array of marketplace source objects, in the same forms as [`strictKnownMarketplaces`](https://code.claude.com/docs/en/settings-reference#allowed-source-types)",
+            "default": "unset, so no marketplace is blocked"
+        },
+        "browserExternalPageTools": {
+            "summary": "Keep Claude's tools off external pages in the [desktop](https://code.claude.com/docs/en/desktop) Browser pane",
+            "category": "Tools",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#browserexternalpagetools",
+            "about": "Stop Claude from using its tools to read or act on external pages in the desktop app's [Browser pane](https://code.claude.com/docs/en/desktop#browse-external-sites). People in your organization can still open external sites themselves, and local dev server previews keep working with Claude's tools. The desktop app reads this key; the terminal CLI ignores it.",
+            "type": "string, `\"disabled\"`; the desktop app also accepts `\"disable\"`, in either case",
+            "default": "unset, so Claude's tools work on external pages"
+        },
+        "channelsEnabled": {
+            "summary": "Allow [channels](https://code.claude.com/docs/en/channels#enable-channels-for-your-organization) for your organization",
+            "category": "Plugins and skills",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#channelsenabled",
+            "about": "Allow [channels](https://code.claude.com/docs/en/channels) for your organization. On claude.ai Team and Enterprise plans, Claude Code blocks channels until you set this to `true`. For [Anthropic Console](https://code.claude.com/docs/en/authentication#claude-console-authentication) accounts that authenticate with an API key, channels are allowed by default. If your organization deploys managed settings, Claude Code blocks channels on those accounts too until you set this key to `true`.",
+            "type": "Boolean\n* `true`: Claude Code allows channels for your organization\n* `false`: the same as unset; whether channels are blocked depends on your plan, as the Default says",
+            "default": "unset; channels are blocked on Team and Enterprise plans and on Console accounts with managed settings, and allowed on Pro and Max plans and on Console accounts without managed settings"
+        },
+        "claudeInChromeDefaultEnabled": {
+            "summary": "Turn on [Chrome integration](https://code.claude.com/docs/en/chrome) when a session starts, in the interactive CLI and the VS Code extension",
+            "category": "Global config settings",
+            "scopes": [],
+            "docs": "https://code.claude.com/docs/en/settings-reference#claudeinchromedefaultenabled",
+            "about": "Start every interactive CLI session with [Chrome integration](https://code.claude.com/docs/en/chrome) on, without passing `--chrome` each time. If you run [`claude remote-control`](https://code.claude.com/docs/en/remote-control), a session it starts for one of your [project](https://code.claude.com/docs/en/claude-projects) threads follows this key too, except in `bypassPermissions` mode. With Claude Code v2.1.287 or later, this key also applies to sessions in the [VS Code extension](https://code.claude.com/docs/en/vs-code#automate-browser-tasks-with-chrome): see [Enable Chrome by default](https://code.claude.com/docs/en/chrome#enable-chrome-by-default).\n\nRunning `/chrome` and selecting **Enabled by default** sets this key for you. Appears in `/config` as **Claude in Chrome enabled by default**.",
+            "type": "Boolean\n* `true`: Claude Code turns on Chrome integration when an interactive CLI session starts, as it does when you pass `--chrome`. In the VS Code extension, sessions connect to the browser as they start\n* `false`: interactive CLI sessions start with Chrome integration off, and Claude Code stops [offering to set it up](https://code.claude.com/docs/en/chrome#install-the-extension-when-claude-asks). Pass `--chrome` to turn it on for one interactive session. In the VS Code extension, a session connects when you type `@browser`, as when the key is unset",
+            "default": "unset, so Chrome integration is off and Claude Code can still offer to set it up"
+        },
+        "claudeMd": {
+            "summary": "Inject organization-wide [CLAUDE.md](https://code.claude.com/docs/en/memory#deploy-organization-wide-claude-md) instructions from managed settings",
+            "category": "Memory and context",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#claudemd",
+            "about": "Inject CLAUDE.md-style instructions as organization-managed memory without deploying a separate file. Claude Code loads the text as a managed memory entry ahead of user and project CLAUDE.md files.",
+            "type": "string, the text of a CLAUDE.md file; write it as you would the file, Markdown included, with line breaks as `\\n`",
+            "default": "unset"
+        },
+        "claudeMdExcludes": {
+            "summary": "Skip specific [CLAUDE.md](https://code.claude.com/docs/en/memory#exclude-specific-claude-md-files) files when memory loads",
+            "category": "Memory and context",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#claudemdexcludes",
+            "about": "Skip specific `CLAUDE.md` files when Claude Code loads [memory](https://code.claude.com/docs/en/memory#exclude-specific-claude-md-files). In a large monorepo, use it to skip CLAUDE.md files from other teams that aren't relevant to your work; [Exclude irrelevant CLAUDE.md files](https://code.claude.com/docs/en/large-codebases#exclude-irrelevant-claude-md-files) in the large-codebases guide walks through that case. Patterns match against absolute file paths.",
+            "type": "array of strings, each a glob pattern or absolute path",
+            "default": "unset, so Claude Code loads every CLAUDE.md it finds"
+        },
+        "cleanupPeriodDays": {
+            "summary": "Choose how many days Claude Code keeps [transcripts](https://code.claude.com/docs/en/data-usage#data-retention) before deleting them",
+            "category": "Privacy and telemetry",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#cleanupperioddays",
+            "about": "Set how many days Claude Code keeps [session transcripts and other application data](https://code.claude.com/docs/en/claude-directory#cleaned-up-automatically) before deleting them. Claude Code runs the deletion as a background sweep after a session starts, as long as it can safely determine the retention period. The sweep deletes transcripts without showing a message, so a session you haven't used for longer than the retention period no longer appears in the [`/resume`](https://code.claude.com/docs/en/sessions#resume-a-session) picker.",
+            "type": "number of days, a whole number, minimum `1`",
+            "default": "`30`"
+        },
+        "companyAnnouncements": {
+            "summary": "Show your organization's announcements at startup",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#companyannouncements",
+            "about": "Show your organization's announcements to users at startup. When you list more than one, Claude Code picks one at random for each session; on a person's very first launch it shows the first entry.",
+            "type": "array of strings",
+            "default": "unset, so no announcement shows"
+        },
+        "copyFullResponse": {
+            "summary": "Make [`/copy`](https://code.claude.com/docs/en/commands) copy the full response without showing the picker",
+            "category": "Global config settings",
+            "scopes": [],
+            "docs": "https://code.claude.com/docs/en/settings-reference#copyfullresponse",
+            "about": "Make [`/copy`](https://code.claude.com/docs/en/commands) copy the full response every time, without showing the picker. Selecting **Always copy full response** in that picker sets this key to `true`. Appears in `/config` as **Skip the /copy picker**.",
+            "type": "Boolean\n* `true`: `/copy` copies the full response without showing the picker\n* `false`: when the response contains code blocks or blockquotes, `/copy` shows a picker where you choose one block or the full response",
+            "default": "`false`"
+        },
+        "copyOnSelect": {
+            "summary": "Turn off automatic copying of text you select with the mouse in [fullscreen rendering](https://code.claude.com/docs/en/fullscreen#use-the-mouse) and agent view",
+            "category": "Global config settings",
+            "scopes": [],
+            "docs": "https://code.claude.com/docs/en/settings-reference#copyonselect",
+            "about": "Copy text to your clipboard automatically when you finish selecting it with the mouse in [fullscreen rendering](https://code.claude.com/docs/en/fullscreen#use-the-mouse) or [agent view](https://code.claude.com/docs/en/agent-view). Appears in `/config` as **Copy on select** while fullscreen rendering is on.",
+            "type": "Boolean\n* `true`: Claude Code copies text to your clipboard when you finish selecting it\n* `false`: selecting text leaves your clipboard unchanged, and you [copy the selection with a keyboard shortcut](https://code.claude.com/docs/en/fullscreen#use-the-mouse) instead",
+            "default": "`true`"
+        },
+        "crossSessionInbound": {
+            "summary": "Choose whether Claude Code delivers [messages from your other sessions](https://code.claude.com/docs/en/cross-session-messaging#control-inbound-messages), shows a notice without delivering them, or refuses them",
+            "category": "Agents, sessions, and worktrees",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#crosssessioninbound",
+            "about": "Choose what this session does with [messages arriving from your other Claude Code sessions](https://code.claude.com/docs/en/cross-session-messaging#control-inbound-messages). When no value applies, Claude Code decides per message from the two sessions' permission-mode classes. Requires Claude Code v2.1.224 or later.",
+            "type": "string, one of:\n* `\"accept\"`: Claude Code delivers the message to Claude\n* `\"hold\"`: Claude Code shows a notice for the message without delivering it\n* `\"refuse\"`: Claude Code drops the message",
+            "default": "unset, so Claude Code decides per message"
+        },
+        "defaultShell": {
+            "summary": "Choose whether Bash or PowerShell runs the shell commands you type with the [`!` prefix](https://code.claude.com/docs/en/interactive-mode#shell-mode-with-prefix)",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#defaultshell",
+            "about": "Choose whether Bash or PowerShell runs the shell commands you type with the [`!` prefix](https://code.claude.com/docs/en/interactive-mode#shell-mode-with-prefix) in the input box, the ones Claude Code runs directly and adds to the session.\n\n`\"powershell\"` works only while the [PowerShell tool](https://code.claude.com/docs/en/tools-reference#powershell-tool) is on. The tool is on by default on Windows without Git Bash, and on Windows with Git Bash for claude.ai and Console accounts. In Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry sessions, and on macOS, Linux, and WSL, set `CLAUDE_CODE_USE_POWERSHELL_TOOL=1` to turn the tool on. Set that variable to `0` to turn the tool off.",
+            "type": "string, one of:\n* `\"bash\"`: Claude Code runs your `!` commands in Bash\n* `\"powershell\"`: Claude Code runs your `!` commands in PowerShell",
+            "default": "`\"bash\"`, or `\"powershell\"` on Windows when Bash isn't available"
+        },
+        "defaultToAgentsView": {
+            "summary": "Open [agent view](https://code.claude.com/docs/en/agent-view) instead of a new conversation when you run `claude` with no arguments",
+            "category": "Global config settings",
+            "scopes": [],
+            "docs": "https://code.claude.com/docs/en/settings-reference#defaulttoagentsview",
+            "about": "Open [agent view](https://code.claude.com/docs/en/agent-view) instead of a new conversation when you run `claude` with no arguments. Appears in `/config` as **Open agents view by default** unless agent view is [turned off](https://code.claude.com/docs/en/settings-reference#disableagentview).",
+            "type": "Boolean\n* `true`: `claude` with no arguments opens agent view, unless agent view is [turned off](https://code.claude.com/docs/en/settings-reference#disableagentview)\n* `false`: `claude` with no arguments starts a new conversation",
+            "default": "`false`"
+        },
+        "deniedMcpServers": {
+            "summary": "Block specific [MCP servers](https://code.claude.com/docs/en/mcp) by URL, command, or name",
+            "category": "MCP",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#deniedmcpservers",
+            "about": "Block specific MCP servers. Claude Code refuses to load a matching server wherever it's defined, including plugin servers, servers passed with `--mcp-config`, servers from `managed-mcp.json`, servers from [`managedMcpServers`](https://code.claude.com/docs/en/settings-reference#managedmcpservers), and the claude.ai connectors [it fetches itself](https://code.claude.com/docs/en/mcp#how-connectors-reach-claude-code). In-process `type: \"sdk\"` servers are exempt; the app that started the session registers them.",
+            "type": "array of objects, each with exactly one key: `serverName`, a string, so a claude.ai connector's display name such as `\"claude.ai Slack\"` works; `serverCommand`, an array of the command and its arguments matched exactly; or `serverUrl`, a URL pattern with `*` wildcards",
+            "default": "unset, so no server is blocked; an empty array also blocks nothing"
+        },
+        "deniedModels": {
+            "summary": "[Block specific models](https://code.claude.com/docs/en/model-config#block-specific-models-or-versions), even ones `availableModels` permits",
+            "category": "Model and responses",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#deniedmodels",
+            "about": "Block specific models, with or without an [`availableModels`](https://code.claude.com/docs/en/settings-reference#availablemodels) allowlist and even when that list permits them. Claude Code hides a blocked model from the `/model` picker, and the model can't be selected anywhere `availableModels` is enforced. A session on the Default option doesn't run a blocked model either, as [Block specific models or versions](https://code.claude.com/docs/en/model-config#block-specific-models-or-versions) describes. Requires Claude Code v2.1.283 or later.",
+            "type": "array of model aliases or IDs\n* A family alias such as `\"opus\"` blocks every model in that family\n* A model ID such as `\"claude-opus-5-5\"` blocks that version in every spelling, including dated and provider-specific IDs\n* A model ID with no minor version, such as `\"claude-opus-5\"`, also blocks later minor versions such as Opus 5.5. Write `\"claude-opus-5-0\"` to block Opus 5 alone\n* `best`, `opusplan`, and `default` entries are ignored",
+            "default": "unset, so no model is blocked"
+        },
+        "desktopSessionCleanupPeriodDays": {
+            "summary": "Set an age limit in days for [Claude Desktop and Cowork transcripts](https://code.claude.com/docs/en/claude-directory#cleaned-up-automatically)",
+            "category": "Privacy and telemetry",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#desktopsessioncleanupperioddays",
+            "about": "Set an age limit in days for the transcripts of sessions you started or most recently continued in Claude Desktop or Cowork. Without this key, Claude Code [keeps those transcripts at any age](https://code.claude.com/docs/en/claude-directory#cleaned-up-automatically). Claude Code deletes each one once it's older than both this limit and [`cleanupPeriodDays`](https://code.claude.com/docs/en/settings-reference#cleanupperioddays), so with `cleanupPeriodDays` at its default of 30, a value of `7` still keeps them 30 days. [Cleaned up automatically](https://code.claude.com/docs/en/claude-directory#cleaned-up-automatically) lists the cases where `cleanupPeriodDays` applies instead and Claude Code ignores this key. Requires Claude Code v2.1.248 or later.",
+            "type": "number of days, a whole number, minimum `0`",
+            "default": "`0`, which sets no age limit"
+        },
+        "dialogExpiry": {
+            "summary": "Set how long Claude Code waits for [Remote Control](https://code.claude.com/docs/en/remote-control) or an SDK host to answer a forwarded dialog before it cancels the dialog",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#dialogexpiry",
+            "about": "Set the deadline for dialogs Claude Code [forwards to a remote client](https://code.claude.com/docs/en/remote-control#limitations), such as a Remote Control or SDK host, and for the approval dialog for a [held cross-session message](https://code.claude.com/docs/en/cross-session-messaging#control-inbound-messages). On Claude Code v2.1.236 or later, the same deadline bounds the mid-session [Fable usage-credits consent prompt](https://code.claude.com/docs/en/model-config#fable-and-usage-credits) in a session that may have nobody at the terminal. When no answer arrives before the deadline, Claude Code cancels the dialog and continues with its no-action default. Requires Claude Code v2.1.224 or later.",
+            "type": "string, one of `\"60s\"`, `\"5m\"`, `\"10m\"`, or `\"never\"`, which disables the deadline",
+            "default": "`\"5m\"`"
+        },
+        "diffTool": {
+            "summary": "Choose whether Claude's proposed file changes open in the [VS Code](https://code.claude.com/docs/en/vs-code) or [JetBrains](https://code.claude.com/docs/en/jetbrains#features) diff viewer or stay in the terminal",
+            "category": "Global config settings",
+            "scopes": [],
+            "docs": "https://code.claude.com/docs/en/settings-reference#difftool",
+            "about": "Choose where Claude Code shows the diff of an `Edit` or `Write` change it proposes when a [VS Code](https://code.claude.com/docs/en/vs-code) or [JetBrains](https://code.claude.com/docs/en/jetbrains#features) IDE is connected: `\"auto\"` opens it in the IDE's diff viewer, `\"terminal\"` keeps it in the terminal. Appears in `/config` as **Diff tool** only while Claude Code is connected to a VS Code or JetBrains IDE.",
+            "type": "string, one of:\n* `\"auto\"`: Claude Code opens the diff in the IDE's diff viewer when a VS Code or JetBrains IDE is connected\n* `\"terminal\"`: Claude Code keeps the diff in the terminal",
+            "default": "`\"auto\"`"
+        },
+        "disableAgentView": {
+            "summary": "Turn off background agents and [agent view](https://code.claude.com/docs/en/agent-view)",
+            "category": "Agents, sessions, and worktrees",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#disableagentview",
+            "about": "Turn off [background agents and agent view](https://code.claude.com/docs/en/agent-view): `claude agents`, `--bg`, `/background`, and the on-demand supervisor. Set it in [managed settings](https://code.claude.com/docs/en/managed-settings) to enforce it for an organization.",
+            "type": "Boolean\n* `true`: Claude Code turns off `claude agents`, `--bg`, `/background`, and the on-demand supervisor\n* `false`: agent view is available",
+            "default": "unset, so agent view is available"
+        },
+        "disableAllHooks": {
+            "summary": "Turn off [hooks](https://code.claude.com/docs/en/hooks), a custom [status line](https://code.claude.com/docs/en/statusline), and a custom [`@` file suggestion](https://code.claude.com/docs/en/interactive-mode#quick-commands) command at once",
+            "category": "Hooks and automation",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#disableallhooks",
+            "about": "Turn off [hooks](https://code.claude.com/docs/en/hooks#disable-or-remove-hooks), any custom [status line](https://code.claude.com/docs/en/statusline), and any custom [file suggestion](https://code.claude.com/docs/en/settings-reference#filesuggestion) command. Use it to turn all of these off temporarily without deleting them from your settings.",
+            "type": "Boolean\n* `true`: Claude Code turns off hooks, any custom status line, and any custom file suggestion command\n* `false`: hooks, the status line, and the file suggestion command run",
+            "default": "unset, so hooks run"
+        },
+        "disableArtifact": {
+            "summary": "Deprecated; use `enableArtifact` to turn the [Artifact tool](https://code.claude.com/docs/en/artifacts) off",
+            "category": "Remote, desktop, and notifications",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#disableartifact",
+            "about": "**Warning:** Deprecated, and replaced by [`enableArtifact`](https://code.claude.com/docs/en/settings-reference#enableartifact). Claude Code still honors `disableArtifact: true` as equivalent to `enableArtifact: false`, and ignores `disableArtifact: false`.\n\nUse [`enableArtifact`](https://code.claude.com/docs/en/settings-reference#enableartifact) instead to turn off the [Artifact](https://code.claude.com/docs/en/artifacts) tool, which publishes session output as a private web page on claude.ai. When you turn the **Artifacts** row off in `/config`, Claude Code writes `enableArtifact` to your user settings and clears this key.",
+            "type": "Boolean\n* `true`: Claude Code turns the Artifact tool off for every session the file applies to, and no other file turns it back on\n* `false`: ignored; to leave the tool on, remove the key",
+            "default": "unset, so the tool follows your account's [availability](https://code.claude.com/docs/en/artifacts#availability)"
+        },
+        "disableAutoMode": {
+            "summary": "Remove [auto mode](https://code.claude.com/docs/en/permission-modes#eliminate-prompts-with-auto-mode) from the permission mode cycle",
+            "category": "Permission settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#disableautomode",
+            "about": "Remove [auto mode](https://code.claude.com/docs/en/permission-modes#eliminate-prompts-with-auto-mode) from the `Shift+Tab` cycle. Any session that would otherwise [start in auto mode](https://code.claude.com/docs/en/permission-modes#which-mode-a-session-starts-in), whether from `--permission-mode auto`, a settings file, or the built-in default, starts in `default` instead. Administrators set it in managed settings to prevent developers in their organization from using auto mode.",
+            "type": "the string `\"disable\"`",
+            "default": "unset"
+        },
+        "disableBrowserExternalNavigation": {
+            "summary": "Limit the [desktop](https://code.claude.com/docs/en/desktop) Browser pane to localhost for people and Claude",
+            "category": "Tools",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#disablebrowserexternalnavigation",
+            "about": "Turn off external browsing in the desktop app's [Browser pane](https://code.claude.com/docs/en/desktop#browse-external-sites) for people and Claude alike. Localhost dev server previews keep working. The desktop app reads this key; the terminal CLI ignores it.",
+            "type": "Boolean; only the JSON Boolean `true` takes effect\n* `true`: the desktop app turns off external browsing in the Browser pane for people and Claude alike; localhost previews keep working\n* `false`: external browsing stays on",
+            "default": "unset, so external browsing is on"
+        },
+        "disableBundledSkills": {
+            "summary": "Turn off the [skills](https://code.claude.com/docs/en/skills#bundled-skills) and [workflows](https://code.claude.com/docs/en/workflows) included with Claude Code",
+            "category": "Plugins and skills",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#disablebundledskills",
+            "about": "Turn off the [skills](https://code.claude.com/docs/en/skills) and workflows included with Claude Code. Claude Code removes bundled skills and workflows entirely, while built-in commands such as `/init` stay typable but are hidden from the model.",
+            "type": "Boolean\n* `true`: Claude Code removes bundled skills and workflows and hides built-in commands such as `/init` from the model\n* `false`: bundled skills load",
+            "default": "unset, so bundled skills load"
+        },
+        "disableClaudeAiConnectors": {
+            "summary": "Turn off [claude.ai connectors](https://code.claude.com/docs/en/mcp#disable-claude-ai-connectors) so Claude Code doesn't fetch them",
+            "category": "MCP",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#disableclaudeaiconnectors",
+            "about": "Turn off the [claude.ai MCP connectors](https://code.claude.com/docs/en/mcp#use-mcp-servers-from-claude-ai) [Claude Code fetches itself](https://code.claude.com/docs/en/mcp#how-connectors-reach-claude-code), so it neither fetches nor connects them. A `true` in any settings file applies: a checked-in project `.claude/settings.json` can opt a repository out of those connectors, but a project-level `false` can't override a user- or managed-level `true`.",
+            "type": "Boolean\n* `true`: Claude Code neither fetches nor connects those connectors\n* `false`: the same as unset; Claude Code fetches your connectors unless another settings file or `ENABLE_CLAUDEAI_MCP_SERVERS` turns them off",
+            "default": "`false`, so Claude Code fetches your connectors"
+        },
+        "disableCommandPluginSources": {
+            "summary": "Block [plugins](https://code.claude.com/docs/en/plugins/overview) that install by running a marketplace-declared command",
+            "category": "Plugins and skills",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#disablecommandpluginsources",
+            "about": "Block the [`command` plugin source](https://code.claude.com/docs/en/plugins/marketplace-reference#command-plugin-source), which installs a plugin by running a marketplace-declared command on the user's machine. When you set it to `true`, Claude Code never runs the command, doesn't install or update command-sourced plugins, and stops loading the ones already installed. Set it to `false` to allow them explicitly. Whenever it blocks command sources, whether you set it to `true` or leave it unset under [`allowManagedHooksOnly`](https://code.claude.com/docs/en/settings-reference#allowmanagedhooksonly), it also blocks marketplace [`headersHelper` commands](https://code.claude.com/docs/en/plugins/host-marketplace#authenticate-archive-downloads), except for a marketplace that managed settings themselves declare. Requires Claude Code v2.1.229 or later, and the `headersHelper` block requires v2.1.238 or later.",
+            "type": "Boolean\n* `true`: Claude Code never runs the marketplace-declared command, doesn't install or update command-sourced plugins, and stops loading the ones already installed\n* `false`: Claude Code allows command-sourced plugins explicitly",
+            "default": "unset, so Claude Code follows [`allowManagedHooksOnly`](https://code.claude.com/docs/en/settings-reference#allowmanagedhooksonly): an organization that restricts hook execution to managed settings gets command sources disabled too"
+        },
+        "disableDeepLinkRegistration": {
+            "summary": "Stop Claude Code from registering the [`claude-cli://` handler](https://code.claude.com/docs/en/deep-links)",
+            "category": "Remote, desktop, and notifications",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#disabledeeplinkregistration",
+            "about": "Stop Claude Code from registering the `claude-cli://` protocol handler with the operating system, which it otherwise does after you send the first prompt of an interactive session. [Deep links](https://code.claude.com/docs/en/deep-links) let external tools open a Claude Code session with a pre-filled prompt. Set this in environments where protocol handler registration is restricted or managed separately.",
+            "type": "the string `\"disable\"`",
+            "default": "unset, so Claude Code registers the handler"
+        },
+        "disableDesktopLocalSessions": {
+            "summary": "Turn off [Desktop Code sessions](https://code.claude.com/docs/en/desktop#local-sessions-on-managed-devices) that run on the device, leaving SSH to other hosts and cloud",
+            "category": "Remote, desktop, and notifications",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#disabledesktoplocalsessions",
+            "about": "Turn off Code sessions that run on the device in the [desktop app](https://code.claude.com/docs/en/desktop#local-sessions-on-managed-devices), for deployments where developers should work on remote machines over SSH. In the Code tab, the **Local** environment stays in the environment dropdown but is grayed out and can't be selected, with a tooltip saying your organization turned it off; on Windows the WSL entry is grayed out the same way, though whether WSL sessions run on a managed device at all is [governed separately](https://code.claude.com/docs/en/admin-setup#wsl-sessions-in-claude-code-desktop). New sessions default to the first [SSH connection](https://code.claude.com/docs/en/desktop#ssh-sessions) if one is configured, and the app refuses to start or resume a session on the device, including an SSH connection back to the same machine. SSH sessions to other hosts and cloud sessions are unaffected. The desktop app reads this key; the terminal CLI ignores it. Requires Claude Desktop v1.37937.0 or later.",
+            "type": "Boolean; only the JSON Boolean `true` takes effect\n* `true`: the desktop app offers no on-device Code sessions; existing local sessions stay listed but can't continue\n* `false`: local sessions stay available",
+            "default": "unset, so local sessions are available"
+        },
+        "disabledMcpjsonServers": {
+            "summary": "Reject specific servers from a project's [`.mcp.json`](https://code.claude.com/docs/en/mcp#project-scope)",
+            "category": "MCP",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#disabledmcpjsonservers",
+            "about": "Reject specific servers defined in a project's `.mcp.json` file so Claude Code never connects them or asks you to approve them. A rejection in any settings file applies, including a project `.claude/settings.json` checked into the repository.",
+            "type": "array of strings, the server names as they appear in `.mcp.json`",
+            "default": "unset"
+        },
+        "disableMobileSimulatorTools": {
+            "summary": "Block Claude's tools in the [desktop](https://code.claude.com/docs/en/desktop) iOS Simulator pane",
+            "category": "Tools",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#disablemobilesimulatortools",
+            "about": "Block Claude's tools for the desktop app's [iOS Simulator pane](https://code.claude.com/docs/en/desktop-ios-simulator#turn-off-simulator-access). People keep manual use of the pane; only Claude's access is removed, and nobody can turn it back on from inside the app. The desktop app reads this key; the terminal CLI ignores it.",
+            "type": "Boolean; only the JSON Boolean `true` takes effect\n* `true`: the desktop app blocks Claude's tools for the iOS Simulator pane\n* `false`: Claude's simulator tools follow each person's settings toggle in the desktop app",
+            "default": "unset, so Claude's simulator tools follow each person's settings toggle in the desktop app"
+        },
+        "disableRemoteControl": {
+            "summary": "Turn off [Remote Control](https://code.claude.com/docs/en/remote-control) everywhere it can start",
+            "category": "Remote, desktop, and notifications",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#disableremotecontrol",
+            "about": "Turn off [Remote Control](https://code.claude.com/docs/en/remote-control): Claude Code then refuses `claude remote-control`, the `--remote-control` flag, auto-start, and the in-session toggle, and reports that your organization's policy disabled it. Place it in [managed settings](https://code.claude.com/docs/en/managed-settings) for per-device MDM enforcement.",
+            "type": "Boolean\n* `true`: Claude Code refuses `claude remote-control`, the `--remote-control` flag, auto-start, and the in-session toggle\n* `false`: Remote Control stays available",
+            "default": "`false`"
+        },
+        "disableSideloadFlags": {
+            "summary": "Reject the CLI flags that sideload [plugins](https://code.claude.com/docs/en/plugins/overview), [subagents](https://code.claude.com/docs/en/sub-agents), and [MCP servers](https://code.claude.com/docs/en/mcp)",
+            "category": "Enterprise and managed settings",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#disablesideloadflags",
+            "about": "Reject the `--plugin-dir`, `--plugin-url`, `--agents`, and `--mcp-config` CLI flags at startup, which users could otherwise pass to bypass [`strictKnownMarketplaces`](https://code.claude.com/docs/en/settings-reference#strictknownmarketplaces) for a single run. Claude Code exits with an error naming the rejected flags. In [cloud sessions](https://code.claude.com/docs/en/claude-code-on-the-web), Claude Code instead starts the session and drops every server-delivered `--mcp-config` entry except in-process `type: \"sdk\"` entries and a [Claude Tag](https://code.claude.com/docs/en/claude-tag) session's Slack tools. Requires Claude Code v2.1.193 or later.",
+            "type": "Boolean\n* `true`: Claude Code rejects `--plugin-dir`, `--plugin-url`, `--agents`, and `--mcp-config` at startup and exits with an error naming them. In cloud sessions, it instead starts the session and drops every server-delivered `--mcp-config` entry except in-process `type: \"sdk\"` entries and a Claude Tag session's Slack tools\n* `false`: Claude Code accepts those flags",
+            "default": "`false`"
+        },
+        "disableSkillShellExecution": {
+            "summary": "Stop [skills](https://code.claude.com/docs/en/skills) and custom commands from running inline shell",
+            "category": "Plugins and skills",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#disableskillshellexecution",
+            "about": "Turn off inline shell execution for `` !`...` `` and ` ```! ` blocks in [skills](/en/skills) and custom commands from user, project, plugin, or additional-directory sources. Claude Code replaces each command with `[shell command execution disabled by policy]` instead of running it.",
+            "type": "Boolean\n* `true`: Claude Code replaces each inline shell command with `[shell command execution disabled by policy]` instead of running it\n* `false`: inline shell runs",
+            "default": "unset, so inline shell runs"
+        },
+        "disableWorkflows": {
+            "summary": "Turn [dynamic workflows](https://code.claude.com/docs/en/workflows) off for everyone; use `enableWorkflows` for yourself",
+            "category": "Hooks and automation",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#disableworkflows",
+            "about": "Turn off [dynamic workflows](https://code.claude.com/docs/en/workflows#turn-workflows-off) and the bundled workflow commands for everyone your settings reach, such as an organization through managed settings. To turn workflows on or off just for yourself, use [`enableWorkflows`](https://code.claude.com/docs/en/settings-reference#enableworkflows) instead, which the **Dynamic workflows** toggle in `/config` writes to your user settings.",
+            "type": "Boolean\n* `true`: Claude Code turns off dynamic workflows and the bundled workflow commands for everyone your settings reach\n* `false`: the same as unset; whether workflows are on then follows [`enableWorkflows`](https://code.claude.com/docs/en/settings-reference#enableworkflows) and your plan's default",
+            "default": "`false`"
+        },
+        "editorMode": {
+            "summary": "Use [vim key bindings](https://code.claude.com/docs/en/interactive-mode#vim-editor-mode) in the input prompt",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#editormode",
+            "about": "Choose the key binding mode for the input prompt.",
+            "type": "string, one of:\n* `\"normal\"`: standard key bindings in the prompt input\n* `\"vim\"`: vim-style editing with NORMAL, INSERT, and VISUAL modes",
+            "default": "`\"normal\"`"
+        },
+        "effortLevel": {
+            "summary": "Set a default [effort level](https://code.claude.com/docs/en/model-config#adjust-effort-level) for models without a saved level of their own",
+            "category": "Model and responses",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#effortlevel",
+            "about": "Set a default [effort level](https://code.claude.com/docs/en/model-config#adjust-effort-level) for models you haven't saved a level for. Lower levels are faster and cheaper on straightforward tasks, and higher levels reason more deeply on complex problems.\n\nWhen you run `/effort low`, `medium`, `high`, or `xhigh` in an interactive session on your machine, Claude Code saves the level for the active model under [`modelSettings`](https://code.claude.com/docs/en/settings-reference#modelsettings) rather than writing this key. Before v2.1.251, `/effort` wrote this key.\n\nWithin the same settings file, Claude Code uses a model's saved level rather than this key. [`modelSettings`](https://code.claude.com/docs/en/settings-reference#modelsettings) states the cross-file precedence.\n\nIn a session attached to a remote worker, in a `-p` run, and in the Agent SDK, `/effort` applies to that session only. [Adjust effort level](https://code.claude.com/docs/en/model-config#adjust-effort-level) lists the interactive picks that also apply to that session only. The message that `/effort` prints says which happened.",
+            "type": "string, one of:\n* `\"low\"`: the least reasoning, for short, scoped, latency-sensitive tasks that aren't intelligence-sensitive\n* `\"medium\"`: reduces token usage for cost-sensitive work that can trade off some intelligence\n* `\"high\"`: balances token usage and intelligence\n* `\"xhigh\"`: deeper reasoning at higher token spend",
+            "default": "unset"
+        },
+        "emojiCompletionEnabled": {
+            "summary": "Turn off [`:shortcode:` emoji suggestions and replacement](https://code.claude.com/docs/en/interactive-mode#emoji-shortcodes) in the prompt input",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#emojicompletionenabled",
+            "about": "Show emoji suggestions when you type `:` plus a shortcode in the prompt input, and replace a completed shortcode such as `:heart:` with its emoji. Set it to `false` to turn off both.",
+            "type": "Boolean\n* `true`: Claude Code shows emoji suggestions after `:` and replaces a completed shortcode with its emoji\n* `false`: Claude Code neither suggests emoji nor replaces shortcodes",
+            "default": "`true`"
+        },
+        "enableAllProjectMcpServers": {
+            "summary": "Approve every server in project [`.mcp.json`](https://code.claude.com/docs/en/mcp#project-server-approvals-and-workspace-trust) files without a prompt",
+            "category": "MCP",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#enableallprojectmcpservers",
+            "about": "Approve every MCP server defined in project `.mcp.json` files without a prompt. Claude Code writes this key to `.claude/settings.local.json` when you choose to approve all servers in the approval dialog.",
+            "type": "Boolean\n* `true`: Claude Code approves every MCP server defined in project `.mcp.json` files without a prompt\n* `false`: Claude Code asks you to approve each server. In a trusted folder, a `false` in a higher-precedence file overrides a `true` in a lower one; in a folder you haven't trusted, a `true` in any honored file is enough",
+            "default": "unset, so Claude Code asks you to approve each server"
+        },
+        "enableArtifact": {
+            "summary": "Turn the [Artifact tool](https://code.claude.com/docs/en/artifacts) off with a `false` in any file; no file can turn it back on",
+            "category": "Remote, desktop, and notifications",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#enableartifact",
+            "about": "Turn off the [Artifact](https://code.claude.com/docs/en/artifacts) tool, which publishes session output as a private web page on claude.ai. When you turn the **Artifacts** row off in `/config`, Claude Code writes this key to your user settings, so you don't usually edit it by hand.",
+            "type": "Boolean\n* `false`: Claude Code turns the Artifact tool off for every session the file applies to\n* `true`: the same as leaving the key unset, because it never overrides a `false` from another file, from [`CLAUDE_CODE_DISABLE_ARTIFACT`](https://code.claude.com/docs/en/env-vars), or from your organization's [admin setting](https://code.claude.com/docs/en/artifacts#manage-artifacts-for-your-organization)",
+            "default": "unset, so the tool follows your account's [availability](https://code.claude.com/docs/en/artifacts#availability)"
+        },
+        "enabledMcpjsonServers": {
+            "summary": "Approve specific servers from a project's [`.mcp.json`](https://code.claude.com/docs/en/mcp#project-server-approvals-and-workspace-trust)",
+            "category": "MCP",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#enabledmcpjsonservers",
+            "about": "Approve specific servers defined in project `.mcp.json` files so Claude Code connects them without asking. Claude Code writes this key to `.claude/settings.local.json` when you approve a server in the approval dialog.",
+            "type": "array of strings, the server names as they appear in `.mcp.json`",
+            "default": "unset"
+        },
+        "enabledPlugins": {
+            "summary": "Turn individual [plugins](https://code.claude.com/docs/en/plugins/overview) on or off per scope",
+            "category": "Plugins and skills",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#enabledplugins",
+            "about": "Turn individual [plugins](https://code.claude.com/docs/en/plugins/overview) on or off, keyed by `plugin-name@marketplace-name`. A plugin with no entry at any scope falls back to its [`defaultEnabled`](https://code.claude.com/docs/en/plugins/manifest-reference#fields) value. When you enable or disable a plugin with `/plugin` or `claude plugin enable`, Claude Code writes this key for you.",
+            "type": "object mapping `plugin-name@marketplace-name` to a Boolean",
+            "default": "unset, so each plugin follows its `defaultEnabled` value"
+        },
+        "enableWorkflows": {
+            "summary": "Turn [dynamic workflows](https://code.claude.com/docs/en/workflows) on or off against your plan's default",
+            "category": "Hooks and automation",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#enableworkflows",
+            "about": "Turn [dynamic workflows](https://code.claude.com/docs/en/workflows) on or off for yourself when your plan's default isn't what you want. Appears in `/config` as **Dynamic workflows**, which writes this key to your user settings and removes it again when you toggle back to your plan's default. To turn workflows off for everyone from managed settings, use [`disableWorkflows`](https://code.claude.com/docs/en/settings-reference#disableworkflows) instead.",
+            "type": "Boolean\n* `true`: Claude Code turns dynamic workflows on for you\n* `false`: Claude Code turns dynamic workflows off for you",
+            "default": "unset, so workflows are on unless you're on the Pro plan, where they're off"
+        },
+        "enforceAvailableModels": {
+            "summary": "Keep the [`/model` Default choice](https://code.claude.com/docs/en/model-config#enforce-the-allowlist-for-the-default-model) inside your `availableModels` allowlist",
+            "category": "Model and responses",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#enforceavailablemodels",
+            "about": "The `/model` picker has a **Default** option, and [`default` model setting](https://code.claude.com/docs/en/model-config#default-model-setting) describes the model it resolves to. An [`availableModels`](https://code.claude.com/docs/en/settings-reference#availablemodels) allowlist limits the models you can name, but with the default [prefix matching](https://code.claude.com/docs/en/settings-reference#availablemodelsmatch) it doesn't remap your account type's default, so **Default** can still resolve to a model outside the list. This key closes that gap. Requires Claude Code v2.1.175 or later.\n\nWhen your organization deploys any managed settings, Claude Code reads this key from the managed source alone and ignores it in your other files.\n\nFor how this key applies to the startup model checks, see [Amazon Bedrock](https://code.claude.com/docs/en/amazon-bedrock#when-your-organization-enforces-a-model-allowlist) and [Google Cloud's Agent Platform](https://code.claude.com/docs/en/google-vertex-ai#when-your-organization-enforces-a-model-allowlist).",
+            "type": "Boolean\n* `true`: when **Default** would resolve to a model outside `availableModels`, Claude Code resolves it to the first available model in the list\n* `false`: this key doesn't change how **Default** resolves",
+            "default": "`false`"
+        },
+        "env": {
+            "summary": "Set [environment variables](https://code.claude.com/docs/en/env-vars#in-settings-files) for every session and its subprocesses",
+            "category": "Memory and context",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#env",
+            "about": "Set environment variables for every session and for the subprocesses Claude Code starts from it. Most variables in the [environment variables reference](https://code.claude.com/docs/en/env-vars) can go here, which is how you apply one to every session or roll it out to your team. Project and local settings can't set [some of them](https://code.claude.com/docs/en/settings-reference#variables-claude-code-ignores-in-env).",
+            "type": "object mapping variable names to string values",
+            "default": "unset"
+        },
+        "externalEditorContext": {
+            "summary": "Show Claude's last response as comments when you press [Ctrl+G](https://code.claude.com/docs/en/interactive-mode#general-controls) to edit",
+            "category": "Global config settings",
+            "scopes": [],
+            "docs": "https://code.claude.com/docs/en/settings-reference#externaleditorcontext",
+            "about": "When you press `Ctrl+G`, Claude Code opens the prompt you're typing in your [external editor](https://code.claude.com/docs/en/interactive-mode#general-controls). With this key on, the editor buffer starts with Claude's previous response as `#` comment lines, so you can read it while you write, and Claude Code strips those lines when you save. Appears in `/config` as **Show last response in external editor**.",
+            "type": "Boolean\n* `true`: the editor buffer starts with Claude's previous response as `#` comment lines, which Claude Code strips when you save\n* `false`: the editor buffer opens with only your prompt",
+            "default": "`false`"
+        },
+        "extraKnownMarketplaces": {
+            "summary": "Register [marketplaces](https://code.claude.com/docs/en/plugins/overview) for a repository or an organization",
+            "category": "Plugins and skills",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#extraknownmarketplaces",
+            "about": "Register additional plugin marketplaces by name, so that people who open the repository, or everyone your managed settings reach, get the marketplace without adding it themselves. Claude Code registers each marketplace it doesn't already know. Whether a plugin that [`enabledPlugins`](https://code.claude.com/docs/en/settings-reference#enabledplugins) names from it installs depends on the plugin's source and which file enables it; that entry has the rules.",
+            "type": "object mapping a marketplace name to an object with a `source` object and an optional `autoUpdate` Boolean",
+            "default": "unset"
+        },
+        "fallbackModel": {
+            "summary": "Name [backup models](https://code.claude.com/docs/en/model-config#fallback-model-chains) for when the primary is overloaded",
+            "category": "Model and responses",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#fallbackmodel",
+            "about": "Name backup models for Claude Code to try, in order, when your primary model is overloaded or unavailable. Claude Code switches to the next available model in the chain for the rest of the turn and shows a notice. Without a chain, Claude Code retries the same model and then surfaces the server's error, and you retry or switch models yourself.\n\nA switch means one turn with a cold [prompt cache](https://code.claude.com/docs/en/prompt-caching#switching-models) on the fallback model; your next message tries the primary model first again.",
+            "type": "array of model aliases or IDs; `\"default\"` expands to the default model",
+            "default": "unset, so a failed request isn't retried on another model"
+        },
+        "fastMode": {
+            "summary": "Turn [fast mode](https://code.claude.com/docs/en/fast-mode) on for sessions where it's available",
+            "category": "Model and responses",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#fastmode",
+            "about": "Turn [fast mode](https://code.claude.com/docs/en/fast-mode) on for sessions where it's available, for interactive work like rapid iteration or live debugging where you want speed at a higher cost per token. You don't usually edit this key by hand: running `/fast` writes `fastMode: true` to `~/.claude/settings.json`, and running it again to turn fast mode off removes the key. Fast mode runs only on Opus 5.5, Opus 5, and Opus 4.8: turning it on from another model switches you to Opus, and switching to an unsupported model turns it off. See [Switch models while fast mode is on](https://code.claude.com/docs/en/fast-mode#switch-models-while-fast-mode-is-on).",
+            "type": "Boolean\n* `true`: Claude Code turns fast mode on for sessions where it's available\n* `false`: fast mode stays off",
+            "default": "unset, so fast mode is off"
+        },
+        "fastModePerSessionOptIn": {
+            "summary": "Require people to turn [fast mode](https://code.claude.com/docs/en/fast-mode) on each session",
+            "category": "Model and responses",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#fastmodepersessionoptin",
+            "about": "Normally, running `/fast` saves [`fastMode`](https://code.claude.com/docs/en/settings-reference#fastmode) to a person's user settings, so fast mode is on at the start of every later session. Set this key to `true` to stop that: a saved `fastMode: true` no longer turns fast mode on at session start, and each person has to run `/fast` in each session they want it. Claude Code leaves the `fastMode` key in their file, so turning this key off restores the old behavior.\n\nOwners on Team or Enterprise plans can deploy it organization-wide through [server-managed settings](https://code.claude.com/docs/en/server-managed-settings). When managed settings set the key, `/fast on` is refused outside interactive terminal sessions and reports that your organization has disabled fast mode. That covers [non-interactive mode](https://code.claude.com/docs/en/headless), the [VS Code extension](https://code.claude.com/docs/en/vs-code), and [cloud sessions](https://code.claude.com/docs/en/claude-code-on-the-web).",
+            "type": "Boolean\n* `true`: a saved `fastMode: true` no longer turns fast mode on at session start, so each person runs `/fast` in each session they want it; a `fastMode: true` passed with `--settings` still counts for that session unless managed settings set this key\n* `false`: a saved `fastMode: true` turns fast mode on at the start of every later session",
+            "default": "`false`"
+        },
+        "feedbackDrafts": {
+            "summary": "Control whether Claude queues [feedback drafts](https://code.claude.com/docs/en/tools-reference#sendfeedback-tool-behavior) for you to review",
+            "category": "Privacy and telemetry",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#feedbackdrafts",
+            "about": "Control [Claude-drafted feedback](https://code.claude.com/docs/en/tools-reference#sendfeedback-tool-behavior): whether Claude can queue feedback drafts for you to review, and whether Claude Code shows a card when Claude queues one.",
+            "type": "string, one of `\"notify\"`, `\"quiet\"`, or `\"off\"`\n* `\"notify\"`: Claude Code shows a card above the prompt when Claude queues a draft, up to [three cards in a session](https://code.claude.com/docs/en/tools-reference#what-you-see-when-claude-drafts) by default\n* `\"quiet\"`: Claude drafts without a card. You see the count of queued drafts in the prompt footer and review them in `/feedback`\n* `\"off\"`: Claude Code removes the SendFeedback tool, so Claude can't queue drafts",
+            "default": "`\"notify\"`"
+        },
+        "feedbackSurveyRate": {
+            "summary": "Change how often the [session quality survey](https://code.claude.com/docs/en/data-usage#session-quality-surveys) appears",
+            "category": "Privacy and telemetry",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#feedbacksurveyrate",
+            "about": "Set the probability that the [session quality survey](https://code.claude.com/docs/en/data-usage#session-quality-surveys) appears when a session is eligible for it. Set `0` to keep the survey from appearing.",
+            "type": "number between `0` and `1`",
+            "default": "unset, so Claude Code uses the rate Anthropic sets remotely, or its built-in rate of `0.005` on Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry, which don't receive remote configuration"
+        },
+        "fileCheckpointingEnabled": {
+            "summary": "Turn off or on the file snapshots that [`/rewind`](https://code.claude.com/docs/en/checkpointing) restores",
+            "category": "Memory and context",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#filecheckpointingenabled",
+            "about": "Have Claude Code snapshot files before each edit so [`/rewind`](https://code.claude.com/docs/en/checkpointing) can restore them. Appears in `/config` as **Rewind code (checkpoints)**, and toggling it there writes this key to your user settings.",
+            "type": "Boolean\n* `true`: Claude Code snapshots files before each edit so `/rewind` can restore them\n* `false`: Claude Code doesn't snapshot files, so `/rewind` can't restore them",
+            "default": "`true`"
+        },
+        "fileSuggestion": {
+            "summary": "Supply [`@` file autocomplete](https://code.claude.com/docs/en/interactive-mode#quick-commands) from your own command",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#filesuggestion",
+            "about": "Run your own command to supply `@` file path autocomplete instead of the built-in file suggestion. The built-in suggestion uses fast filesystem traversal; a large monorepo may do better with project-specific indexing such as a pre-built file index.",
+            "type": "object with `type`, always `\"command\"`, and `command`, the shell command to run",
+            "default": "unset, so Claude Code uses the built-in file suggestion"
+        },
+        "footerLinksRegexes": {
+            "summary": "Make issue or review IDs in output into [clickable links](https://code.claude.com/docs/en/statusline#clickable-links) below the input box",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#footerlinksregexes",
+            "about": "Render extra clickable badges in the footer below the input box when a regex matches turn output: tool results, including file contents and fetched pages, and Claude's own responses. Use it to turn IDs printed by project CLIs, such as review tools and issue trackers, into session links.",
+            "type": "array of objects, each with `type` set to `\"regex\"`, a `pattern` regex, a `url` template, and an optional `label`; `{name}` placeholders in `url` and `label` are filled from named capture groups in `pattern`",
+            "default": "unset, so no badges render"
+        },
+        "forceLoginGatewayUrl": {
+            "summary": "Set the [gateway URL](https://code.claude.com/docs/en/claude-apps-gateway#set-the-gateway-url) the login screen connects to",
+            "category": "Authentication and providers",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#forcelogingatewayurl",
+            "about": "Set the gateway URL the `/login` Cloud gateway screen connects to, so people reach your [cloud gateway](https://code.claude.com/docs/en/claude-apps-gateway) without typing its address. The screen has no URL field: with this key set, it shows your gateway URL and connects when the person presses Enter; without it, it tells them to contact their IT administrator.\n\nIn managed settings, either this key or `forceLoginMethod: \"gateway\"` makes the machine gateway-only, except for sessions that select a cloud provider with `CLAUDE_CODE_USE_*`. `/login` then opens on the Cloud gateway screen with no login-method picker. See [Administrator policy requires a Cloud gateway sign-in](https://code.claude.com/docs/en/errors#administrator-policy-requires-a-cloud-gateway-sign-in) for what happens to a leftover first-party login or API key. Set both keys so the screen connects instead of showing an error.",
+            "type": "string, a full URL including the scheme",
+            "default": "unset, so the Cloud gateway screen shows an error telling people to contact their IT administrator"
+        },
+        "forceLoginMethod": {
+            "summary": "[Restrict login](https://code.claude.com/docs/en/authentication#restrict-login-to-your-organization) to claude.ai, Claude Console, or a [cloud gateway](https://code.claude.com/docs/en/claude-apps-gateway)",
+            "category": "Authentication and providers",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#forceloginmethod",
+            "about": "Restrict which kind of account people can log in with. Set `\"claudeai\"` to allow only claude.ai accounts, `\"console\"` to allow only Claude Console accounts, or `\"gateway\"` to send people to a [cloud gateway](https://code.claude.com/docs/en/claude-apps-gateway) instead of a first-party login. Administrators set it in managed settings and pair it with [`forceLoginOrgUUID`](https://code.claude.com/docs/en/settings-reference#forceloginorguuid) to keep developers' claude.ai logins inside one organization. If you set it to `\"claudeai\"` or `\"console\"` in any settings file, Claude Code also stops offering the [keyless Console sign-in](https://code.claude.com/docs/en/authentication#sign-in-without-an-api-key) in the sessions that file applies to.",
+            "type": "string, one of:\n* `\"claudeai\"`: only claude.ai accounts can log in\n* `\"console\"`: only Claude Console accounts can log in\n* `\"gateway\"`: Claude Code sends people to a cloud gateway instead of a first-party login",
+            "default": "unset, so people pick a login method"
+        },
+        "forceLoginOrgUUID": {
+            "summary": "[Pin claude.ai logins to your organization](https://code.claude.com/docs/en/authentication#restrict-login-to-your-organization); only a managed source enforces it",
+            "category": "Authentication and providers",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#forceloginorguuid",
+            "about": "From a managed source, require claude.ai account logins to belong to one Anthropic organization, given as a single UUID, or to any of several organizations, given as an array. From any settings file, Claude Code also uses a single UUID to pre-select that organization during a claude.ai or Claude Console login, and pre-selects nothing for an array. If you set the key in any settings file, Claude Code also stops offering the [keyless Console sign-in](https://code.claude.com/docs/en/authentication#sign-in-without-an-api-key) in the sessions that file applies to and creates an API key instead.",
+            "type": "string, one UUID, or array of strings, several UUIDs",
+            "default": "unset, so any organization can log in"
+        },
+        "forceRemoteSettingsRefresh": {
+            "summary": "Block startup until [server-managed settings](https://code.claude.com/docs/en/server-managed-settings) are freshly fetched",
+            "category": "Enterprise and managed settings",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#forceremotesettingsrefresh",
+            "about": "Block CLI startup until Claude Code has freshly fetched [server-managed settings](https://code.claude.com/docs/en/server-managed-settings). If the fetch fails, Claude Code exits instead of continuing with cached or no settings. Set it when your environment can't accept even a brief window in which a session runs without its managed policy.\n\nWhen the key is unset, Claude Code doesn't block startup on the fetch, though when the developer signs in at startup it waits up to five seconds for the fetch. A Cloud gateway session always waits, and exits if the gateway can't be reached.",
+            "type": "Boolean\n* `true`: Claude Code blocks startup until it has freshly fetched server-managed settings, and exits if the fetch fails\n* `false`: Claude Code doesn't block startup on the fetch, though at a sign-in startup it waits up to five seconds for the fetch",
+            "default": "`false`"
+        },
+        "gatewayInternalNetworks": {
+            "summary": "Let `/login` reach a [cloud gateway](https://code.claude.com/docs/en/claude-apps-gateway#allow-a-gateway-on-public-address-space-you-own) on public IPv4 space your organization uses internally",
+            "category": "Authentication and providers",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#gatewayinternalnetworks",
+            "about": "Declare the public IPv4 blocks that your organization numbers its internal network from, so `/login` accepts a [cloud gateway](https://code.claude.com/docs/en/claude-apps-gateway) there. Requires Claude Code v2.1.268 or later.\n\nWithout this key, `/login` connects to any gateway on a private address and nothing else. With it, `/login` also accepts a gateway inside a listed block, over a direct connection only. The machine's own address on that connection must also be inside the same block.",
+            "type": "array of strings, at most four IPv4 CIDR blocks, each `/8` to `/32`, not overlapping one another, and none overlapping private space.",
+            "default": "unset, so `/login` accepts only gateways on private addresses"
+        },
+        "gcpAuthRefresh": {
+            "summary": "Refresh [Google Cloud credentials](https://code.claude.com/docs/en/google-vertex-ai#advanced-credential-configuration) with your own command",
+            "category": "Authentication and providers",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#gcpauthrefresh",
+            "about": "Run your own command to refresh Google Cloud Application Default Credentials when Claude Code finds they've expired or can't be loaded, so [Google Cloud's Agent Platform](https://code.claude.com/docs/en/google-vertex-ai) requests keep working without you re-authenticating by hand.\n\nWhen several Claude Code processes that use the same command and credentials, such as separate terminals or IDE windows, find them expired at the same time, one process runs the command and the rest wait for that run instead of starting their own. A process that has waited 60 seconds with a request pending runs the command itself. To turn this off, set [`CLAUDE_CODE_DISABLE_AUTH_REFRESH_LOCK`](https://code.claude.com/docs/en/env-vars) to `1`.",
+            "type": "string, a shell command line",
+            "default": "unset, so Claude Code's credential error tells you to run `gcloud auth application-default login` yourself"
+        },
+        "hooks": {
+            "summary": "Run your own commands as [hooks](https://code.claude.com/docs/en/hooks) at points in Claude Code's lifecycle",
+            "category": "Hooks and automation",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#hooks",
+            "about": "Run your own commands, prompts, agents, HTTP requests, or MCP tools as [hooks](https://code.claude.com/docs/en/hooks) at points in Claude Code's lifecycle, such as before a tool call or when a session starts; the [hooks reference](https://code.claude.com/docs/en/hooks#hook-events) lists every event, its payload, and its exit codes. Each event maps to a list of matcher groups, and each group lists the handlers to run when the matcher applies.",
+            "type": "object keyed by [hook event](https://code.claude.com/docs/en/hooks#hook-events); each value is an array of `{ \"matcher\", \"hooks\" }` groups whose `hooks` entries have a `type` of `\"command\"`, `\"prompt\"`, `\"agent\"`, `\"http\"`, or `\"mcp_tool\"`",
+            "default": "unset, so no hooks run"
+        },
+        "httpHookAllowedEnvVars": {
+            "summary": "Limit which env vars [HTTP hooks](https://code.claude.com/docs/en/hooks) can put in headers",
+            "category": "Hooks and automation",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#httphookallowedenvvars",
+            "about": "An [HTTP hook](https://code.claude.com/docs/en/hooks#http-hook-fields) can put the value of an environment variable into a request header, for example an `Authorization: Bearer $HOOK_TOKEN` header, but only for variables the hook lists in its own `allowedEnvVars`. This key sets an outer limit on that list for every HTTP hook: a hook can use a variable only if both its own `allowedEnvVars` and this key name it. Use it to stop a hook from reading a secret it shouldn't, even when the hook's definition asks for it.",
+            "type": "array of environment variable names",
+            "default": "unset, so each hook's own `allowedEnvVars` list applies"
+        },
+        "includeCoAuthoredBy": {
+            "summary": "Deprecated; use `attribution` to hide or change commit and PR attribution",
+            "category": "Git and attribution",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#includecoauthoredby",
+            "about": "**Warning:** Deprecated since v2.0.62, when [`attribution`](https://code.claude.com/docs/en/settings-reference#attribution) replaced it. Claude Code still reads it, but new configurations should set `attribution`.\n\nUse [`attribution`](https://code.claude.com/docs/en/settings-reference#attribution) instead, which replaces this key and lets you change or hide the commit trailer, the pull request text, and the session link separately. Claude Code still honors `includeCoAuthoredBy: false` from settings files that predate `attribution`, but ignores it once you set `attribution.commit` or `attribution.pr`.",
+            "type": "Boolean\n* `true`: the same as unset; Claude Code adds the commit trailer and the pull request attribution text\n* `false`: Claude Code omits both the commit trailer and the pull request attribution text, unless `attribution` sets `commit` or `pr`, in which case the [`attribution`](https://code.claude.com/docs/en/settings-reference#attribution) rules apply",
+            "default": "`true`"
+        },
+        "includeGitInstructions": {
+            "summary": "Remove the built-in commit and PR instructions from Claude's context",
+            "category": "Git and attribution",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#includegitinstructions",
+            "about": "Claude Code gives Claude two git-related pieces of context: its built-in instructions for how to write commits and pull requests, in the Bash tool's description, and a git status snapshot of your repository. The snapshot holds the current branch, the main branch, `git status` output, and recent commits. Claude Code reads it when a conversation starts.\n\nSet this key to `false` to leave both out, for example when you use your own git workflow skills.",
+            "type": "Boolean\n* `true`: Claude Code includes its built-in commit and pull request workflow instructions and the git status snapshot. Cloud sessions never include the snapshot\n* `false`: Claude Code leaves both out",
+            "default": "`true`"
+        },
+        "inputNeededNotifEnabled": {
+            "summary": "Get a [push notification](https://code.claude.com/docs/en/remote-control#mobile-push-notifications) when Claude is waiting on you",
+            "category": "Remote, desktop, and notifications",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#inputneedednotifenabled",
+            "about": "Get a push notification on your phone when a permission prompt or question is waiting for your input. Claude Code sends these only while [Remote Control](https://code.claude.com/docs/en/remote-control) is connected. Appears in `/config` as **Push when actions required**.",
+            "type": "Boolean\n* `true`: you get a push notification on your phone when a permission prompt or question is waiting, while Remote Control is connected\n* `false`: Claude Code sends no such notifications",
+            "default": "`false`"
+        },
+        "isolatePeerMachines": {
+            "summary": "Ask you before Claude [messages one of your sessions on another machine](https://code.claude.com/docs/en/cross-session-messaging#require-approval-for-cross-machine-messages)",
+            "category": "Agents, sessions, and worktrees",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#isolatepeermachines",
+            "about": "Require your explicit approval before Claude's `SendMessage` reaches one of your sessions beyond this machine; see [Require approval for cross-machine messages](https://code.claude.com/docs/en/cross-session-messaging#require-approval-for-cross-machine-messages). The approval prompt appears even in [`bypassPermissions` mode](https://code.claude.com/docs/en/permission-modes#skip-all-checks-with-bypasspermissions-mode).",
+            "type": "Boolean\n* `true`: Claude Code asks for your approval before Claude's `SendMessage` reaches one of your sessions beyond this machine\n* `false`: cross-machine messages don't prompt",
+            "default": "unset, so cross-machine messages don't prompt"
+        },
+        "keybindingFlavor": {
+            "summary": "Deprecated and has no effect; the word-editing shortcuts always [follow readline conventions](https://code.claude.com/docs/en/interactive-mode#make-ctrl-w-delete-back-to-whitespace)",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#keybindingflavor",
+            "about": "**Warning:** Deprecated since v2.1.261 and has no effect. The prompt's word-editing keys always [follow readline conventions](https://code.claude.com/docs/en/interactive-mode#make-ctrl-w-delete-back-to-whitespace), as in Bash. Claude Code still accepts `keybindingFlavor`, so a settings file that sets it stays valid.\n\nIn v2.1.238 through v2.1.260, setting it to `\"readline\"` made `Ctrl+W` delete back to the previous whitespace instead of only the previous word.",
+            "type": "string, `\"classic\"` or `\"readline\"`",
+            "default": "unset"
+        },
+        "language": {
+            "summary": "Have Claude respond in a language other than English",
+            "category": "Model and responses",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#language",
+            "about": "Have Claude respond in a language other than English by default. There is no fixed list for responses: Claude Code passes the value verbatim to Claude as an instruction to always respond in that language, so any language name Claude can read works. Claude Code doesn't check the value, so a misspelled name reaches Claude as written rather than producing an error. The same value sets the language for [voice dictation](https://code.claude.com/docs/en/voice-dictation#change-the-dictation-language), which does have a fixed list of [supported dictation languages](https://code.claude.com/docs/en/voice-dictation#change-the-dictation-language), and for auto-generated session titles.",
+            "type": "string, any language name, such as `\"japanese\"`, `\"spanish\"`, or `\"french\"`; Claude Code doesn't validate it",
+            "default": "unset; session titles then match the language of your conversation"
+        },
+        "leftArrowOpensAgents": {
+            "summary": "Turn off the `←` shortcut that [backgrounds the session and opens agent view](https://code.claude.com/docs/en/agent-view#switch-sessions-without-leaving-the-terminal)",
+            "category": "Global config settings",
+            "scopes": [],
+            "docs": "https://code.claude.com/docs/en/settings-reference#leftarrowopensagents",
+            "about": "Press `←` on an empty prompt to [background the session and open agent view](https://code.claude.com/docs/en/agent-view#switch-sessions-without-leaving-the-terminal). Set this key to `false` to turn the shortcut off. Appears in `/config` as **← opens agents** when agent view is available.",
+            "type": "Boolean\n* `true`: pressing `←` on an empty prompt in a session you started in the terminal backgrounds it and opens agent view\n* `false`: Claude Code turns the shortcut off; in a session you [attached to from agent view](https://code.claude.com/docs/en/agent-view#attach-to-a-session), `←` on an empty prompt still detaches",
+            "default": "`true`"
+        },
+        "managedMcpServers": {
+            "summary": "Provide remote [MCP servers](https://code.claude.com/docs/en/managed-mcp#provide-servers-through-managed-settings) to every user alongside the ones they add",
+            "category": "MCP",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#managedmcpservers",
+            "about": "Provide remote MCP servers to every user from managed settings. Users keep the servers they add themselves and can't edit or remove the ones you provide. Requires Claude Code v2.1.259 or later.",
+            "type": "object keyed by server name. Each entry has the `.mcp.json` shape for an `http` or `sse` server: a required `https://` `url`, and optionally `headers`, `oauth`, and the other HTTP and SSE options. Claude Code drops entries that fail validation, and [What an entry can contain](https://code.claude.com/docs/en/managed-mcp#what-an-entry-can-contain) lists the conditions",
+            "default": "unset, so managed settings provide no servers"
+        },
+        "managedSourcesBehavior": {
+            "summary": "Compose every [managed source](https://code.claude.com/docs/en/managed-settings#how-claude-code-combines-managed-sources) you deploy instead of using the highest-priority one alone",
+            "category": "Enterprise and managed settings",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#managedsourcesbehavior",
+            "about": "Choose whether Claude Code applies only the highest-priority [managed source](https://code.claude.com/docs/en/managed-settings#how-claude-code-combines-managed-sources) your organization delivers, or combines every admin source it delivers. By default Claude Code takes the highest-priority source that carries a [policy key](https://code.claude.com/docs/en/managed-settings#how-claude-code-combines-managed-sources) and ignores the rest. A policy key is any settings key other than this one and `wslInheritsWindowsSettings`. Under that default, once server-managed settings or an MDM policy deliver a policy key, a `managed-settings.json` file contributes only the [keys Claude Code reads from every admin source](https://code.claude.com/docs/en/managed-settings#keys-read-from-every-admin-source). With `\"merge\"`, every admin source you deliver contributes its keys to one combined policy. Requires Claude Code v2.1.242 or later.\n\nSet `\"merge\"` only where every source [ranked](https://code.claude.com/docs/en/managed-settings#how-claude-code-combines-managed-sources) below your highest one is under an administrator's control, because Claude Code then adds entries from a lower source, such as `permissions.allow` rules, to the policy.",
+            "type": "string, one of:\n* `\"first-wins\"`: the highest-priority source that carries a policy key supplies the policy, and lower sources contribute only the [keys Claude Code reads from every admin source](https://code.claude.com/docs/en/managed-settings#keys-read-from-every-admin-source)\n* `\"merge\"`: every admin source you deliver contributes its keys, combined by the rules below",
+            "default": "`\"first-wins\"`"
+        },
+        "maxEffortLevel": {
+            "summary": "Cap the [effort level](https://code.claude.com/docs/en/model-config#adjust-effort-level) for every model or per model, on every provider",
+            "category": "Model and responses",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#maxeffortlevel",
+            "about": "Cap the [effort level](https://code.claude.com/docs/en/model-config#adjust-effort-level) a session can use, leaving lower levels available. Any higher level runs at the cap instead, including one from `/effort`, the `/model` picker, `--effort`, [`CLAUDE_CODE_EFFORT_LEVEL`](https://code.claude.com/docs/en/env-vars), a skill's or subagent's `effort` frontmatter, or the model's own default. Claude Code applies the cap itself before each request, so it holds on every provider, including Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry. Requires Claude Code v2.1.267 or later.",
+            "type": "string, one of `\"low\"`, `\"medium\"`, `\"high\"`, `\"xhigh\"`, or `\"max\"`. A `\"max\"` value sets no cap",
+            "default": "unset, so no cap applies"
+        },
+        "maxProseWidth": {
+            "summary": "Cap how wide the prose in Claude's responses runs in a wide terminal",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#maxprosewidth",
+            "about": "Cap the width of the prose in Claude's responses so lines stay readable in a wide terminal. Paragraphs, headings, lists, and blockquotes wrap within this many columns, while tables and code blocks keep the full terminal width. Requires Claude Code v2.1.282 or later.",
+            "type": "number of terminal columns, a whole number, minimum `40`. Claude Code ignores any other value",
+            "default": "unset, so prose wraps at the terminal edge"
+        },
+        "minimumVersion": {
+            "summary": "Keep [auto-updates](https://code.claude.com/docs/en/setup#pin-a-minimum-version) from installing anything below a version",
+            "category": "Updates and versioning",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#minimumversion",
+            "about": "Keep background auto-updates and `claude update` from installing any version below this one, so moving to the `\"stable\"` channel doesn't downgrade you from a newer `\"latest\"` build. Claude Code writes this key for you when you choose to stay on your current version while switching channels in `/config`, and clears it when you switch back to `\"latest\"`.",
+            "type": "string, a version number such as `\"2.1.100\"`; a value that isn't a valid version is ignored",
+            "default": "unset, so updates can install any version the channel offers"
+        },
+        "model": {
+            "summary": "Change the [model](https://code.claude.com/docs/en/model-config#set-a-default-model-for-new-sessions) Claude Code starts with",
+            "category": "Model and responses",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#model",
+            "about": "Set the model every new session uses, so you don't have to pick one with `/model` each time. Setting it here doesn't stop you from switching mid-session. If your admin set an [organization default model](https://code.claude.com/docs/en/model-config#organization-default-model) to override user selection, you get that model even when you set this key in user, project, or local settings.",
+            "type": "string, a model alias or full model ID",
+            "default": "unset, so Claude Code uses your account's default model"
+        },
+        "modelOverrides": {
+            "summary": "[Map model IDs](https://code.claude.com/docs/en/model-config#override-model-ids-per-version) to your provider's IDs, such as Bedrock ARNs",
+            "category": "Model and responses",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#modeloverrides",
+            "about": "Map Anthropic model IDs to provider-specific model IDs, such as Amazon Bedrock inference profile ARNs. Each model picker entry then uses its mapped value when calling the provider API. Administrators use this on [Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry](https://code.claude.com/docs/en/model-config#override-model-ids-per-version) to route each model version to a specific inference profile, version name, or deployment for governance, cost allocation, or regional routing.",
+            "type": "object mapping model ID to provider model ID",
+            "default": "unset"
+        },
+        "modelPicker": {
+            "summary": "Choose which models the [`/model` picker](https://code.claude.com/docs/en/model-config#available-models) lists, in your own order and with your own labels",
+            "category": "Model and responses",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#modelpicker",
+            "about": "List the models the `/model` picker offers, in the order you write them and under labels you choose, so the picker lists the models your organization runs, after the built-in lineup or instead of it. Each row's `model` is taken verbatim, so it accepts anything `--model` accepts: an alias such as `opus`, an Anthropic model ID, or a provider-format ID for Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry, or an LLM gateway. Requires Claude Code v2.1.242 or later.",
+            "type": "object with an `options` array of rows and an optional `replaceBuiltInOptions` Boolean",
+            "default": "unset, so the picker shows the built-in lineup"
+        },
+        "modelPricing": {
+            "summary": "Report spend at your organization's contracted rates instead of list price",
+            "category": "Model and responses",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#modelpricing",
+            "about": "Report spend at the rates your organization pays instead of list price. Set it when your organization has contracted rates, so the dollar figures developers see match your bill. Claude Code applies the rates in `/usage`, the [status line](https://code.claude.com/docs/en/statusline), the Agent SDK's `total_cost_usd`, the [`--max-budget-usd`](https://code.claude.com/docs/en/cli-reference) limit, and the [OpenTelemetry](https://code.claude.com/docs/en/monitoring-usage) cost metric and events. You supply the rates: Claude Code doesn't read them from your contract or the Claude Console. Requires Claude Code v2.1.242 or later.",
+            "type": "object with an optional `multiplier` and an optional `overrides` map",
+            "default": "unset, so Claude Code reports list price unless a host application supplies a table"
+        },
+        "modelSettings": {
+            "summary": "Keep a saved [effort level](https://code.claude.com/docs/en/model-config#adjust-effort-level) or [auto-compact window](https://code.claude.com/docs/en/model-config#set-the-auto-compact-window) per model, or cap one model's effort",
+            "category": "Model and responses",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#modelsettings",
+            "about": "Save an [effort level](https://code.claude.com/docs/en/model-config#adjust-effort-level) for each model you use. Requires Claude Code v2.1.251 or later.\n\nIn an interactive session on your machine, when you save `low`, `medium`, `high`, or `xhigh` as your default with `/effort` or the `/model` picker's effort slider, Claude Code writes that level here under the model you're using, so you rarely edit this key yourself. When you pick one of those levels in the [VS Code extension's model picker](https://code.claude.com/docs/en/vs-code#use-the-prompt-box), Claude Code saves it here the same way. The [`effortLevel`](https://code.claude.com/docs/en/settings-reference#effortlevel) entry lists the sessions where `/effort` applies to that session only.\n\nEdit the key by hand to change or remove a level you saved.\n\nA model's `effortLevel` here takes precedence over the top-level [`effortLevel`](https://code.claude.com/docs/en/settings-reference#effortlevel) in the same settings file. Across files, Claude Code resolves each model separately: the highest-precedence [settings file](https://code.claude.com/docs/en/settings#settings-precedence) that sets either an `effortLevel` for that model or a top-level `effortLevel` that [applies to that model](https://code.claude.com/docs/en/settings-reference#effortlevel) decides, so an `effortLevel` in managed settings outranks a level you saved in user settings. [Adjust effort level](https://code.claude.com/docs/en/model-config#adjust-effort-level) lists what else can override a saved level, such as `--effort` at launch.\n\nTo cap one model's effort rather than set its level, add a [`maxEffortLevel`](https://code.claude.com/docs/en/settings-reference#maxeffortlevel) field to that model's entry. The field requires Claude Code v2.1.267 or later.",
+            "type": "object mapping a model name to an object with any of these fields:\n* `effortLevel`: one of `\"low\"`, `\"medium\"`, `\"high\"`, or `\"xhigh\"`\n* [`maxEffortLevel`](https://code.claude.com/docs/en/settings-reference#maxeffortlevel): the highest effort level the model may run at\n* `autoCompactWindow`: a number of tokens from `100000` to `1000000`, or `\"auto\"` for the window tuned for the model. [`/autocompact`](https://code.claude.com/docs/en/model-config#set-the-auto-compact-window) saves here. For that model, the value takes precedence over a top-level [`autoCompactWindow`](https://code.claude.com/docs/en/settings-reference#autocompactwindow) in the same settings file. Requires Claude Code v2.1.288 or later",
+            "default": "unset"
+        },
+        "otelHeadersHelper": {
+            "summary": "Generate rotating [OpenTelemetry](https://code.claude.com/docs/en/monitoring-usage#dynamic-headers) headers with your own command",
+            "category": "Authentication and providers",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#otelheadershelper",
+            "about": "Run your own command to generate the headers Claude Code sends with OpenTelemetry exports, for backends whose tokens rotate. Claude Code runs it at startup and periodically after that, and expects a JSON object of string header values on stdout.",
+            "type": "string, an executable path or a shell command line",
+            "default": "unset, so Claude Code adds no helper-generated headers"
+        },
+        "outputStyle": {
+            "summary": "Change Claude's role, tone, and output format with an [output style](https://code.claude.com/docs/en/output-styles)",
+            "category": "Model and responses",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#outputstyle",
+            "about": "Select an [output style](https://code.claude.com/docs/en/output-styles) by name. An output style is a saved set of instructions that changes Claude's role, tone, and output format, such as the built-in Explanatory and Learning styles or one you wrote yourself.\n\nIf you change this key during a session, Claude uses the new style starting with your next message. For what that message costs in prompt caching, see [Changing output style](https://code.claude.com/docs/en/prompt-caching#changing-output-style). Before v2.1.251, the edit applied only after you ran `/clear` or started a new session.",
+            "type": "string, the name of a [built-in](https://code.claude.com/docs/en/output-styles#built-in-output-styles) or [custom](https://code.claude.com/docs/en/output-styles#create-a-custom-output-style) output style",
+            "default": "unset, so Claude Code uses the default style"
+        },
+        "parentSettingsBehavior": {
+            "summary": "Apply or drop restrictions an [SDK or IDE host](https://code.claude.com/docs/en/managed-settings#let-an-embedding-host-add-policy) passes when you deploy [managed settings](https://code.claude.com/docs/en/managed-settings)",
+            "category": "Enterprise and managed settings",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#parentsettingsbehavior",
+            "about": "Choose whether Claude Code applies managed settings supplied by an embedding host process, such as the Agent SDK or an IDE extension, when an admin-deployed managed tier is also present. With `\"first-wins\"`, Claude Code drops the host-supplied settings; with `\"merge\"`, it applies them under the admin tier through a restrictive-only filter. Set `\"merge\"` when a host needs to pass its own restrictions to the sessions it launches, for example Claude Desktop delivering a gateway's egress allowlist.",
+            "type": "string, one of:\n* `\"first-wins\"`: Claude Code drops the host-supplied settings when an admin-deployed managed tier is present\n* `\"merge\"`: Claude Code applies the host-supplied settings under the admin tier through a restrictive-only filter",
+            "default": "`\"first-wins\"`"
+        },
+        "permissionExplainerEnabled": {
+            "summary": "Removed in v2.1.257, together with the `Ctrl+E` command explanation on shell permission prompts",
+            "category": "Global config settings",
+            "scopes": [],
+            "docs": "https://code.claude.com/docs/en/settings-reference#permissionexplainerenabled",
+            "about": "**Warning:** Removed in v2.1.257, together with the `Ctrl+E` command explanation on Bash and PowerShell permission prompts. Setting it has no effect on current versions.\n\nThrough v2.1.256, you could press `Ctrl+E` on a Bash or PowerShell permission prompt to see a model-generated explanation of the command, and set this key to `false` to turn that shortcut off.",
+            "type": "Boolean",
+            "default": "`true`"
+        },
+        "permissions": {
+            "summary": "Set allow, ask, and deny rules and the starting [permission mode](https://code.claude.com/docs/en/permission-modes)",
+            "category": "Permission settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#permissions",
+            "about": "Control which tools Claude can use without asking, which ones always prompt, and which ones are blocked, and set the [permission mode](https://code.claude.com/docs/en/permission-modes) a session starts in. Every `permissions.*` key below nests under this object.",
+            "type": "object with `allow`, `ask`, `deny`, `additionalDirectories`, `blockReadsOutsideWorkingDirectories`, `defaultMode`, `disableBypassPermissionsMode`, and `disableAutoMode`",
+            "default": "unset"
+        },
+        "permissions.additionalDirectories": {
+            "summary": "Give Claude file access to [directories outside the current one](https://code.claude.com/docs/en/permissions#working-directories)",
+            "category": "Permission settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#permissions-additionaldirectories",
+            "about": "Give Claude file access to directories outside the one you started in, as additional [working directories](https://code.claude.com/docs/en/permissions#working-directories). Most `.claude/` configuration is [not discovered](https://code.claude.com/docs/en/permissions#additional-directories-grant-file-access-not-configuration) from these directories.",
+            "type": "array of directory paths",
+            "default": "unset"
+        },
+        "permissions.allow": {
+            "summary": "Approve listed [tool uses](https://code.claude.com/docs/en/permissions#permission-rule-syntax) without a prompt",
+            "category": "Permission settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#permissions-allow",
+            "about": "List the tool uses Claude Code approves without asking you. In an MCP rule, `*` can appear only in the tool name after the `mcp__<server>__` prefix, such as `mcp__github__get_*`; it can't appear in the server name.",
+            "type": "array of permission rule strings",
+            "default": "unset"
+        },
+        "permissions.ask": {
+            "summary": "Always prompt before listed [tool uses](https://code.claude.com/docs/en/permissions#permission-rule-syntax)",
+            "category": "Permission settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#permissions-ask",
+            "about": "List the tool uses that prompt you for confirmation even in a permission mode that would otherwise approve them, such as `acceptEdits` or `bypassPermissions`. In `dontAsk` mode Claude Code denies a matching tool use instead of prompting.",
+            "type": "array of permission rule strings",
+            "default": "unset"
+        },
+        "permissions.blockReadsOutsideWorkingDirectories": {
+            "summary": "Make the file tools refuse reads outside the [working directories](https://code.claude.com/docs/en/permissions#working-directories) in every permission mode",
+            "category": "Permission settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#permissions-blockreadsoutsideworkingdirectories",
+            "about": "Make Claude's file tools refuse reads outside your [working directories](https://code.claude.com/docs/en/permissions#working-directories) in every permission mode, including `bypassPermissions`. Claude Code denies `Read`, `Grep`, `Glob`, and `LSP` calls on those paths and tells Claude to ask you to add the directory with `/add-dir`. Files Claude Code itself needs stay readable, such as your skills, plugins, rules, agents, commands, and the `CLAUDE.md` memory file under `~/.claude/`. Requires Claude Code v2.1.257 or later.\n\nClaude Code doesn't refuse shell commands the same way:\n\n* [Actions no mode auto-approves](https://code.claude.com/docs/en/permission-modes#actions-no-mode-auto-approves) covers when a shell command that reads such a path prompts you\n* [Sandboxed commands under the block](https://code.claude.com/docs/en/settings-reference#sandboxed-commands-under-the-block) covers what a sandboxed command can read\n\nA Bash command the shell parser can't trace, such as one that changes directory more than once or runs a subshell, prompts you even in auto mode and `bypassPermissions` mode. The prompt appears even when the command names no path outside the working directories. This prompt doesn't apply when the command runs in the [sandbox](https://code.claude.com/docs/en/sandboxing) and the sandbox enforces the block.\n\nClaude Code also writes `true` here when you choose to block such reads on [auto mode's prompt before the first read outside the working directories](https://code.claude.com/docs/en/permission-modes#first-read-outside-the-working-directories).",
+            "type": "Boolean\n* `true`: Claude's file tools refuse reads outside the working directories\n* `false`: the same as unset; the block still applies if another file sets `true`",
+            "default": "unset, so reads outside the working directories follow your [permission mode](https://code.claude.com/docs/en/permission-modes)"
+        },
+        "permissions.defaultMode": {
+            "summary": "Set the [permission mode](https://code.claude.com/docs/en/permission-modes#which-mode-a-session-starts-in) new sessions start in",
+            "category": "Permission settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#permissions-defaultmode",
+            "about": "Set the [permission mode](https://code.claude.com/docs/en/permission-modes) new sessions start in. When you leave it unset, sessions start in the [built-in default](https://code.claude.com/docs/en/permission-modes#which-mode-a-session-starts-in) for your surface.",
+            "type": "string, one of:\n* `\"default\"`: Claude Code runs only reads without asking\n* `\"acceptEdits\"`: Claude Code also runs file edits and common filesystem commands such as `mkdir` and `mv` without asking\n* `\"plan\"`: Claude Code reads and plans but blocks edits until you approve a plan\n* `\"auto\"`: Claude Code runs without routine prompts; before actions such as shell commands and network requests run, a background classifier checks that they align with your request\n* `\"dontAsk\"`: Claude Code auto-denies every call that would otherwise prompt; file reads inside your working directories, other actions that need no approval, and pre-approved tools still run, apart from reads from [network paths](https://code.claude.com/docs/en/permissions#network-paths)\n* `\"bypassPermissions\"`: Claude Code runs everything without asking\n* `\"manual\"`: an alias for `\"default\"`",
+            "default": "unset"
+        },
+        "permissions.deny": {
+            "summary": "Block listed [tool uses](https://code.claude.com/docs/en/permissions#permission-rule-syntax), including reads of files that hold secrets",
+            "category": "Permission settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#permissions-deny",
+            "about": "List the tool uses Claude Code blocks. Use it for files that hold API keys, secrets, or environment values: Claude Code excludes matching files from file discovery and search results, denies reads of them, and blocks the [Edit and Write tools](https://code.claude.com/docs/en/permissions#read-and-edit) on the matching paths.\n\nRead and Edit deny rules apply to Claude's built-in file tools, to file commands Claude Code recognizes in Bash, such as `cat`, `head`, `tail`, `sed`, and `tee`, and to the targets of Bash [redirections](https://code.claude.com/docs/en/permissions#redirections) such as `> file` and `< file`; they don't apply to a command that reads files without naming them, such as `grep -r pattern .`, or to arbitrary subprocesses, so for OS-level enforcement [enable the sandbox](https://code.claude.com/docs/en/sandboxing).",
+            "type": "array of permission rule strings",
+            "default": "unset"
+        },
+        "permissions.disableBypassPermissionsMode": {
+            "summary": "Prevent anyone from entering [bypassPermissions mode](https://code.claude.com/docs/en/permission-modes#skip-all-checks-with-bypasspermissions-mode)",
+            "category": "Permission settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#permissions-disablebypasspermissionsmode",
+            "about": "Prevent anyone from entering `bypassPermissions` mode. Claude Code then rejects the `--dangerously-skip-permissions` flag, and ignores an [agent definition's](https://code.claude.com/docs/en/sub-agents#permission-modes) `permissionMode: bypassPermissions`, so the subagent runs with the parent session's permission mode.",
+            "type": "the string `\"disable\"`",
+            "default": "unset"
+        },
+        "plansDirectory": {
+            "summary": "Choose where [plan mode](https://code.claude.com/docs/en/permission-modes#analyze-before-you-edit-with-plan-mode) writes plan files",
+            "category": "Memory and context",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#plansdirectory",
+            "about": "Choose where Claude Code stores the plan files it writes in [plan mode](https://code.claude.com/docs/en/permission-modes#analyze-before-you-edit-with-plan-mode). Claude Code resolves the path relative to the project root.",
+            "type": "string, a path relative to the project root",
+            "default": "unset, so Claude Code uses `~/.claude/plans`"
+        },
+        "pluginConfigs": {
+            "summary": "Store the answers you gave a [plugin](https://code.claude.com/docs/en/plugins/overview)'s configuration dialog",
+            "category": "Plugins and skills",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#pluginconfigs",
+            "about": "Store the non-sensitive answers you give a plugin's [`userConfig`](https://code.claude.com/docs/en/plugins/manifest-reference#user-configuration) configuration dialog, keyed by plugin ID. Claude Code writes this key to your user settings when you fill in the dialog, so you don't need to edit it by hand. Claude Code stores sensitive options in the macOS Keychain instead, falling back to `~/.claude/.credentials.json` when the Keychain rejects the write; on platforms without a supported keychain, it stores them in `~/.claude/.credentials.json`.",
+            "type": "object mapping a plugin ID to an object with an `options` field, mapping each option name to a string, number, Boolean, or array of strings, and an optional `mcpServers` field holding per-server user configuration values in the same shape",
+            "default": "unset"
+        },
+        "pluginSuggestionMarketplaces": {
+            "summary": "Choose which [marketplaces](https://code.claude.com/docs/en/plugins/org#restrict-what-users-can-install) can surface plugin install suggestions in `/plugin`",
+            "category": "Plugins and skills",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#pluginsuggestionmarketplaces",
+            "about": "Name the marketplaces whose plugins can appear as contextual install suggestions, in spinner tips and pinned at the top of the `/plugin` **Discover** tab. The built-in first-party frontend-design tip is unaffected. Suggestions come from each plugin's `relevance` declaration in its marketplace entry.",
+            "type": "array of marketplace names",
+            "default": "unset, so no marketplace-declared suggestions surface"
+        },
+        "pluginTrustMessage": {
+            "summary": "Add your own text to the [plugin](https://code.claude.com/docs/en/plugins/overview) trust warning",
+            "category": "Plugins and skills",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#plugintrustmessage",
+            "about": "Add your organization's own text to the plugin trust warning Claude Code shows before installation, for example to confirm that plugins from your internal marketplace are vetted.",
+            "type": "string",
+            "default": "unset, so Claude Code shows the standard warning alone"
+        },
+        "policyHelper": {
+            "summary": "Run an executable that computes [managed settings](https://code.claude.com/docs/en/managed-settings#compute-the-policy-with-a-helper-program) at startup",
+            "category": "Enterprise and managed settings",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#policyhelper",
+            "about": "Run an executable you deploy that computes managed settings at startup, so you can derive policy from device posture, identity, or a remote service instead of a static file. Claude Code runs the helper before it accepts the first prompt and treats the settings it emits as the managed settings for the session.",
+            "type": "object with `path`, `timeoutMs`, and `refreshIntervalMs`",
+            "default": "unset, so no helper runs"
+        },
+        "policyHelper.path": {
+            "summary": "Name the [helper executable](https://code.claude.com/docs/en/managed-settings#compute-the-policy-with-a-helper-program) Claude Code runs",
+            "category": "Enterprise and managed settings",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#policyhelper-path",
+            "about": "Name the helper executable Claude Code runs. For what happens when the path breaks the rules below, see [Helper failures](https://code.claude.com/docs/en/settings-reference#helper-failures).",
+            "type": "string, an absolute path in normalized form, without `.` or `..` segments; on Windows, a drive-letter or UNC path that ends in `.exe`",
+            "default": "none; required when `policyHelper` is set"
+        },
+        "policyHelper.refreshIntervalMs": {
+            "summary": "Re-run the [helper](https://code.claude.com/docs/en/managed-settings#compute-the-policy-with-a-helper-program) in the background on an interval",
+            "category": "Enterprise and managed settings",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#policyhelper-refreshintervalms",
+            "about": "Have Claude Code re-run the helper in the background on an interval so policy changes reach a running session. When a refresh succeeds, its output replaces the previous managed settings without a restart; when a refresh fails, Claude Code keeps the policy it already has.",
+            "type": "integer, milliseconds: `0` to disable refresh, otherwise at least `60000`",
+            "default": "unset, so Claude Code runs the helper once at startup"
+        },
+        "policyHelper.timeoutMs": {
+            "summary": "Set how long Claude Code waits for the [helper](https://code.claude.com/docs/en/managed-settings#compute-the-policy-with-a-helper-program)",
+            "category": "Enterprise and managed settings",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#policyhelper-timeoutms",
+            "about": "Set how long Claude Code waits for the helper before treating the run as failed. A timed-out run fails the same way as a non-zero exit, so at startup Claude Code refuses to start.",
+            "type": "integer, milliseconds, minimum `1000`",
+            "default": "`10000`"
+        },
+        "preferredNotifChannel": {
+            "summary": "Choose a [terminal bell or desktop notification](https://code.claude.com/docs/en/terminal-config#get-a-terminal-bell-or-notification) for task completion",
+            "category": "Remote, desktop, and notifications",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#preferrednotifchannel",
+            "about": "Choose how Claude Code notifies you when a task completes or a permission prompt is waiting. Appears in `/config` as **Local notifications**.",
+            "type": "string, one of:\n* `\"auto\"`: Claude Code sends a desktop notification in iTerm2, Ghostty, and Kitty, rings the bell in Terminal.app only when its audible bell is off, and does nothing elsewhere\n* `\"terminal_bell\"`: Claude Code rings the bell character in any terminal\n* `\"iterm2\"`: Claude Code sends an iTerm2 desktop notification\n* `\"iterm2_with_bell\"`: Claude Code sends an iTerm2 desktop notification and rings the bell\n* `\"kitty\"`: Claude Code sends a Kitty desktop notification\n* `\"ghostty\"`: Claude Code sends a Ghostty desktop notification\n* `\"notifications_disabled\"`: Claude Code sends no notification",
+            "default": "`\"auto\"`"
+        },
+        "prefersReducedMotion": {
+            "summary": "[Reduce or turn off](https://code.claude.com/docs/en/accessibility#accessibility-settings) spinner, shimmer, and flash animations",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#prefersreducedmotion",
+            "about": "Reduce or turn off interface animations such as the spinner, shimmer, and flash effects. Appears in `/config` as **Reduce motion**.",
+            "type": "Boolean\n* `true`: Claude Code reduces or turns off interface animations such as the spinner, shimmer, and flash effects\n* `false`: the same as unset; Claude Code shows its animations",
+            "default": "`false`"
+        },
+        "prependPlugins": {
+            "summary": "Run your organization's [mods](https://code.claude.com/docs/en/plugins/mods/admin) before every mod a user installs",
+            "category": "Plugins and skills",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#prependplugins",
+            "about": "List the managed plugins whose [mods](https://code.claude.com/docs/en/plugins/mods/overview) run before every mod a user installs, in the listed order. When you set this key in managed settings, name `sec-default@builtin` in the list to keep the built-in guard. In managed settings, Claude Code skips an id whose plugin doesn't count as your organization's. See [Install your organization's mods and set the order](https://code.claude.com/docs/en/plugins/mods/admin#install-your-organizations-mods) for those conditions and for how the two ordering keys work together.",
+            "type": "array of `plugin-name@marketplace-name` strings",
+            "default": "unset"
+        },
+        "processWrapper": {
+            "summary": "Run Claude Code's background processes through a [corporate launcher](https://code.claude.com/docs/en/corporate-launcher) on macOS and Linux",
+            "category": "Agents, sessions, and worktrees",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#processwrapper",
+            "about": "On macOS and Linux, place a corporate launcher command in front of the [background processes Claude Code starts](https://code.claude.com/docs/en/corporate-launcher#what-the-launcher-covers). Claude Code runs the launcher with its own command line appended, so the launcher must exec into Claude Code; see [Run Claude Code behind a corporate launcher](https://code.claude.com/docs/en/corporate-launcher) for the launcher contract. Requires Claude Code v2.1.210 or later.",
+            "type": "string, the launcher command as an argv prefix, such as an absolute path with optional arguments",
+            "default": "unset, so background processes start unwrapped"
+        },
+        "promptCacheTtl": {
+            "summary": "Choose the [prompt cache lifetime](https://code.claude.com/docs/en/prompt-caching#cache-lifetime) for the main conversation",
+            "category": "Model and responses",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#promptcachettl",
+            "about": "Choose how long the [prompt cache](https://code.claude.com/docs/en/prompt-caching) holds the main conversation. This key applies to your interactive, `-p`, and Agent SDK turns, together with the helpers Claude Code runs inline with them. The one-hour lifetime keeps the cache warm across longer breaks, and the API [bills each cache write at a higher rate](https://platform.claude.com/docs/en/build-with-claude/prompt-caching#pricing) than at the five-minute lifetime. Requires Claude Code v2.1.242 or later.",
+            "type": "string, one of:\n* `\"5m\"`: the cache holds for five minutes\n* `\"1h\"`: the cache holds for an hour",
+            "default": "unset, so each main-conversation request gets [its default lifetime](https://code.claude.com/docs/en/prompt-caching#which-ttl-each-request-gets)"
+        },
+        "promptSuggestionEnabled": {
+            "summary": "Hide the grayed-out [prompt suggestions](https://code.claude.com/docs/en/interactive-mode#prompt-suggestions) in the input box",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#promptsuggestionenabled",
+            "about": "Show or hide [prompt suggestions](https://code.claude.com/docs/en/interactive-mode#prompt-suggestions), the grayed-out predictions that appear in your prompt input. Set it to `false`, or turn off **Prompt suggestions** in `/config`, to hide them.",
+            "type": "Boolean\n* `true`: you see prompt suggestions in your prompt input\n* `false`: Claude Code hides prompt suggestions",
+            "default": "`true`"
+        },
+        "prStatusFooterEnabled": {
+            "summary": "Turn off the prompt footer's [PR review status](https://code.claude.com/docs/en/interactive-mode#pr-review-status) badge and the pull request check behind it",
+            "category": "Global config settings",
+            "scopes": [],
+            "docs": "https://code.claude.com/docs/en/settings-reference#prstatusfooterenabled",
+            "about": "Show a badge in the prompt footer for the current branch's open pull request or merge request, with a colored underline that shows its [status](https://code.claude.com/docs/en/interactive-mode#pr-review-status). Appears in `/config` as **Show PR status footer**.",
+            "type": "Boolean\n* `true`: the footer shows the badge under the conditions in [PR review status](https://code.claude.com/docs/en/interactive-mode#pr-review-status)\n* `false`: Claude Code skips the footer's pull request and merge request check and doesn't show that badge. A session you [attached to from agent view](https://code.claude.com/docs/en/agent-view#attach-to-a-session) can still show a plain link to a pull request [linked to it](https://code.claude.com/docs/en/agent-view#pull-request-status)",
+            "default": "`true`"
+        },
+        "prUrlTemplate": {
+            "summary": "Point PR links at an internal code-review tool instead of github.com",
+            "category": "Git and attribution",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#prurltemplate",
+            "about": "Point the PR links Claude Code renders, in the footer badge and in tool-result summaries, at an internal code-review tool instead of `github.com`. Claude Code substitutes `{host}`, `{owner}`, `{repo}`, `{number}`, and `{url}` from the PR URL. [GitLab merge request](https://code.claude.com/docs/en/interactive-mode#gitlab-merge-requests) links on both surfaces keep their GitLab URL.",
+            "type": "string, a URL template using any of the five placeholders",
+            "default": "unset"
+        },
+        "remote.defaultEnvironmentId": {
+            "summary": "Pick the default [cloud environment](https://code.claude.com/docs/en/cloud-environments) for `claude --cloud`; a self-hosted `ccpool_` ID is read only from user and managed settings and `--settings`",
+            "category": "Remote, desktop, and notifications",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#remote-defaultenvironmentid",
+            "about": "Pick the default [cloud environment](https://code.claude.com/docs/en/cloud-environments) for cloud sessions you create from the CLI, such as with `claude --cloud`. Claude Code writes this key to your user settings when you pick an environment with [`/remote-env`](https://code.claude.com/docs/en/cloud-environments#select-an-environment-from-the-cli).",
+            "type": "string, an environment ID such as `env_...` or `ccpool_...`",
+            "default": "unset, so Claude Code uses the Anthropic-hosted environment when your list has one, and otherwise the first environment in your list that isn't a [Remote Control bridge environment](https://code.claude.com/docs/en/cloud-environments#the-default-environment), or the first environment when every one is a bridge environment"
+        },
+        "remoteControlAtStartup": {
+            "summary": "Connect [Remote Control](https://code.claude.com/docs/en/remote-control#enable-remote-control-for-all-sessions) automatically when a session starts",
+            "category": "Remote, desktop, and notifications",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#remotecontrolatstartup",
+            "about": "Connect [Remote Control](https://code.claude.com/docs/en/remote-control) automatically when each interactive session starts, instead of waiting for `/remote-control`. Set it to `true` to turn auto-connect on, `false` to turn it off. Appears in `/config` as **Enable Remote Control for all sessions**.",
+            "type": "Boolean\n* `true`: Claude Code connects Remote Control automatically when each interactive session starts\n* `false`: Claude Code waits for `/remote-control`",
+            "default": "unset, so the [auto-connect default](https://code.claude.com/docs/en/remote-control#enable-remote-control-for-all-sessions) applies"
+        },
+        "requiredMaximumVersion": {
+            "summary": "[Refuse to start](https://code.claude.com/docs/en/setup#pin-a-minimum-version) on a version newer than your organization allows",
+            "category": "Updates and versioning",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#requiredmaximumversion",
+            "about": "Set the newest Claude Code version your organization allows to start. When the running version is newer, Claude Code exits at startup and tells the user to install an approved version through your organization's approved method; `claude install <version>` may also work. Requires Claude Code v2.1.163 or later.",
+            "type": "string, a version number such as `\"2.1.150\"`; a value that isn't a valid version is ignored",
+            "default": "unset, so no ceiling applies"
+        },
+        "requiredMinimumVersion": {
+            "summary": "[Refuse to start](https://code.claude.com/docs/en/setup#pin-a-minimum-version) on a version older than your organization requires",
+            "category": "Updates and versioning",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#requiredminimumversion",
+            "about": "Set the oldest Claude Code version your organization allows to start. When the running version is older, Claude Code exits at startup and tells the user to update through your organization's approved method. The check runs at startup only, so a session that's already running continues. Requires Claude Code v2.1.163 or later.",
+            "type": "string, a version number such as `\"2.1.150\"`; a value that isn't a valid version is ignored",
+            "default": "unset, so no floor applies"
+        },
+        "respectGitignore": {
+            "summary": "Keep gitignored files out of the [`@` file picker](https://code.claude.com/docs/en/interactive-mode#quick-commands)",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#respectgitignore",
+            "about": "Control whether the `@` file picker leaves out files that match `.gitignore` patterns. Appears in `/config` as **Respect .gitignore in file picker**.",
+            "type": "Boolean\n* `true`: the `@` file picker leaves out files that match `.gitignore` patterns\n* `false`: the `@` file picker includes files that match `.gitignore` patterns",
+            "default": "`true`"
+        },
+        "respondToBashCommands": {
+            "summary": "Stop Claude from responding after a [`!` shell command](https://code.claude.com/docs/en/interactive-mode#shell-mode-with-prefix) runs",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#respondtobashcommands",
+            "about": "Choose whether Claude responds after you run a shell command with the [`!` prefix](https://code.claude.com/docs/en/interactive-mode#shell-mode-with-prefix) in the input box. By default, Claude Code adds the command's output to the conversation and Claude replies to it. Set this key to `false` to add the output to context without a reply, so you can run several commands and ask about them together.",
+            "type": "Boolean\n* `true`: Claude Code adds the command's output to the conversation and Claude replies to it\n* `false`: Claude Code adds the output to context without a reply",
+            "default": "`true`"
+        },
+        "sandbox": {
+            "summary": "[Isolate Bash commands](https://code.claude.com/docs/en/sandboxing) from your filesystem and network on macOS, Linux, and WSL2",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox",
+            "about": "Isolate the Bash commands Claude runs from your filesystem and network with [sandboxing](https://code.claude.com/docs/en/sandboxing). Turn the sandbox on with `enabled`, then narrow or widen what sandboxed commands can touch with the `filesystem`, `network`, and `credentials` sub-objects. The sandbox runs on macOS, Linux, and WSL2.",
+            "type": "object with `enabled`, `failIfUnavailable`, `autoAllowBashIfSandboxed`, `excludedCommands`, `allowUnsandboxedCommands`, `enableWeakerNestedSandbox`, `enableWeakerNetworkIsolation`, `allowAppleEvents`, `bwrapPath`, `socatPath`, `ignoreViolations`, and `ripgrep`, plus the `filesystem`, `network`, and `credentials` objects",
+            "default": "unset, so Claude Code runs commands without a sandbox"
+        },
+        "sandbox.allowAppleEvents": {
+            "summary": "Let [sandboxed](https://code.claude.com/docs/en/sandboxing) commands send Apple Events on macOS",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-allowappleevents",
+            "about": "Let sandboxed commands on macOS send Apple Events, which `open`, `osascript`, and tools that open URLs in a browser need; without it they fail with error `-600`. This removes code-execution isolation: sandboxed commands can launch other applications unsandboxed with no user prompt, and can send AppleScript commands to running applications such as Terminal, subject to the per-app macOS automation-consent prompt (TCC).",
+            "type": "Boolean\n* `true`: sandboxed commands on macOS can send Apple Events\n* `false`: sandboxed commands on macOS can't send Apple Events, so `open` and `osascript` fail with error `-600`",
+            "default": "`false`"
+        },
+        "sandbox.allowUnsandboxedCommands": {
+            "summary": "Let Claude retry a blocked command outside the [sandbox](https://code.claude.com/docs/en/sandboxing#the-unsandboxed-retry-escape-hatch), or forbid it",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-allowunsandboxedcommands",
+            "about": "Let Claude retry a command outside the sandbox with the `dangerouslyDisableSandbox` parameter after the sandbox blocks it. When it's `false`, Claude Code ignores that parameter. While the sandbox is running, commands Claude runs are then sandboxed unless they match an [`excludedCommands`](https://code.claude.com/docs/en/settings-reference#sandbox-excludedcommands) entry. The `/sandbox` **Overrides** tab shows that state as **Strict sandbox mode**. A `false` in managed settings turns on strict sandbox mode for the developers it covers.",
+            "type": "Boolean\n* `true`: Claude can retry a command outside the sandbox with the `dangerouslyDisableSandbox` parameter after the sandbox blocks it\n* `false`: Claude Code ignores that parameter, so while the sandbox is running, commands Claude runs are sandboxed unless they match an `excludedCommands` entry",
+            "default": "`true`"
+        },
+        "sandbox.autoAllowBashIfSandboxed": {
+            "summary": "Run [sandboxed](https://code.claude.com/docs/en/sandboxing#auto-allow-mode) commands without a permission prompt",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-autoallowbashifsandboxed",
+            "about": "Let Claude Code run sandboxed Bash commands without a permission prompt. Commands that can't run in the sandbox still go through the regular permission flow, and `deny` rules and content-scoped `ask` rules such as `Bash(git push *)` still apply; a bare `Bash` ask rule is skipped for sandboxed commands. Set it to `false` to send sandboxed commands through the regular permission flow too, which the `/sandbox` **Mode** tab calls regular permissions mode.",
+            "type": "Boolean\n* `true`: Claude Code runs sandboxed Bash commands without a permission prompt, except in the cases that [Auto-allow mode](https://code.claude.com/docs/en/sandboxing#auto-allow-mode) describes; `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB` turns auto-allow off\n* `false`: sandboxed commands go through the regular permission flow, so your allow rules and permission mode decide. The `/sandbox` **Mode** tab calls this regular permissions mode",
+            "default": "`true`"
+        },
+        "sandbox.bwrapPath": {
+            "summary": "Point the [sandbox](https://code.claude.com/docs/en/sandboxing) at a bubblewrap binary outside `PATH`",
+            "category": "Sandbox settings",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-bwrappath",
+            "about": "Point the sandbox at a bubblewrap binary installed outside `PATH`, such as a vendored copy on an air-gapped host. Claude Code uses the path both for the startup dependency check and when it wraps each sandboxed command.",
+            "type": "string, an absolute path; Claude Code drops a relative path and falls back to `PATH` lookup",
+            "default": "unset, so Claude Code finds `bwrap` on `PATH`"
+        },
+        "sandbox.credentials": {
+            "summary": "Hide or mask credential files and variables inside the [sandbox](https://code.claude.com/docs/en/sandboxing#protect-credentials)",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-credentials",
+            "about": "Declare the credential files and environment variables to [protect from sandboxed commands](https://code.claude.com/docs/en/sandboxing#protect-credentials). Each entry names a file `path` or a variable `name` and a `mode`: `deny` hides the credential inside the sandbox, and `mask` shows sandboxed commands a placeholder while the [sandbox proxy](https://code.claude.com/docs/en/sandboxing#mask-credentials) substitutes the real value on outbound requests. Claude Code protects only the entries you list; there is no built-in credential deny list.",
+            "type": "object with `files`, `envVars`, `allowPlaintextInject`, `awsPairs`, and `sigv4`",
+            "default": "unset, so no credentials are protected"
+        },
+        "sandbox.credentials.allowPlaintextInject": {
+            "summary": "Let [masked credentials](https://code.claude.com/docs/en/sandboxing#mask-credentials) reach plain HTTP services on trusted test networks",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-credentials-allowplaintextinject",
+            "about": "Allow `mask` substitution on plain HTTP requests as well as TLS-terminated HTTPS. On plain HTTP the upstream identity is unverified and the credential travels in cleartext, so leave this off outside trusted test networks.",
+            "type": "Boolean\n* `true`: Claude Code allows `mask` substitution on plain HTTP requests as well as TLS-terminated HTTPS\n* `false`: Claude Code allows `mask` substitution only on TLS-terminated HTTPS",
+            "default": "`false`"
+        },
+        "sandbox.credentials.awsPairs": {
+            "summary": "Link custom-named AWS key variables into one credential for [re-signing](https://code.claude.com/docs/en/sandboxing#re-sign-aws-requests)",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-credentials-awspairs",
+            "about": "Group masked environment variables that form one AWS credential for [SigV4 re-signing](https://code.claude.com/docs/en/sandboxing#re-sign-aws-requests) when your credential lives in variables with non-standard names. Claude Code links the conventional `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION_TOKEN` trio automatically when you mask their whole values, so you need this key only for other names. Requires Claude Code v2.1.224 or later.",
+            "type": "array of objects, each with `accessKeyIdVar`, `secretAccessKeyVar`, and optionally `sessionTokenVar`, naming `sandbox.credentials.envVars` entries",
+            "default": "unset, so only the conventional trio is paired"
+        },
+        "sandbox.credentials.envVars": {
+            "summary": "Unset or mask an environment variable inside the [sandbox](https://code.claude.com/docs/en/sandboxing#mask-environment-variables)",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-credentials-envvars",
+            "about": "Protect environment variables from sandboxed commands. With `\"mode\": \"deny\"`, Claude Code removes the variable from the environment of sandboxed commands. With `\"mode\": \"mask\"`, sandboxed commands see a per-session sentinel value, and the sandbox proxy substitutes the real value on outbound requests to that entry's `injectHosts`, so tools such as `gh` and `npm` keep authenticating without ever holding the real credential.",
+            "type": "array of objects, each with `name` and a `mode` of `\"deny\"` or `\"mask\"`, plus the optional [mask fields for environment variables](https://code.claude.com/docs/en/settings-reference#mask-fields-for-environment-variables)",
+            "default": "unset, so no environment variables are protected"
+        },
+        "sandbox.credentials.files": {
+            "summary": "Block or mask reads of a credential file inside the [sandbox](https://code.claude.com/docs/en/sandboxing#mask-credential-files)",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-credentials-files",
+            "about": "Protect credential files or directories from sandboxed commands. With `\"mode\": \"deny\"`, Claude Code blocks reads of the path inside the sandbox, the same read block as [`sandbox.filesystem.denyRead`](https://code.claude.com/docs/en/settings-reference#sandbox-filesystem-denyread). With `\"mode\": \"mask\"`, sandboxed commands on Linux and WSL2 read a sentinel copy of the file, and the sandbox proxy substitutes the real value on outbound requests to that entry's `injectHosts`; on macOS the file is unreadable inside the sandbox instead. `\"mode\": \"mask\"` requires Claude Code v2.1.221 or later.",
+            "type": "array of objects, each with `path` and a `mode` of `\"deny\"` or `\"mask\"`, plus the optional [mask fields for files](https://code.claude.com/docs/en/settings-reference#mask-fields-for-files)",
+            "default": "unset, so no credential files are protected"
+        },
+        "sandbox.credentials.sigv4": {
+            "summary": "Choose whether streaming, presigned, or [SigV4A AWS requests](https://code.claude.com/docs/en/sandboxing#re-sign-aws-requests) fail or pass through",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-credentials-sigv4",
+            "about": "Choose what the sandbox proxy does with AWS request forms it [can't re-sign](https://code.claude.com/docs/en/sandboxing#re-sign-aws-requests): `streaming` for aws-chunked streaming uploads, `presigned` for presigned URLs, and `sigv4a` for SigV4A asymmetric signatures. This applies only to requests signed with a masked pair's placeholder access key ID. Requires Claude Code v2.1.224 or later.",
+            "type": "object with `streaming`, `presigned`, and `sigv4a`, each one of:\n* `\"deny\"`: the proxy fails the request\n* `\"passthrough\"`: the proxy forwards the request signed with the masked placeholder, so the tool receives AWS's own rejection",
+            "default": "unset, so every form is `\"deny\"`"
+        },
+        "sandbox.enabled": {
+            "summary": "Turn on [Bash sandboxing](https://code.claude.com/docs/en/sandboxing#get-started) on macOS, Linux, and WSL2",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-enabled",
+            "about": "Turn on [sandboxing](https://code.claude.com/docs/en/sandboxing) for Bash commands. When you pick a mode in the `/sandbox` panel, Claude Code writes this key to `.claude/settings.local.json` for the current project; set it in `~/.claude/settings.json` to sandbox every project.",
+            "type": "Boolean\n* `true`: Claude Code sandboxes Bash commands\n* `false`: Bash commands run unsandboxed",
+            "default": "`false`"
+        },
+        "sandbox.enableWeakerNestedSandbox": {
+            "summary": "Run the Linux [sandbox](https://code.claude.com/docs/en/sandboxing) inside an unprivileged container",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-enableweakernestedsandbox",
+            "about": "Run the Linux sandbox inside an unprivileged Docker container, where bubblewrap can't mount a fresh `/proc`. Instead the inner sandbox bind-mounts the container's existing `/proc`, which exposes process information that a fresh mount would hide. This reduces security; use it only when the outer container already provides the isolation you need.",
+            "type": "Boolean\n* `true`: the inner sandbox bind-mounts the container's existing `/proc` instead of mounting a fresh one\n* `false`: the sandbox mounts a fresh `/proc`, which doesn't work in an unprivileged Docker container",
+            "default": "`false`"
+        },
+        "sandbox.enableWeakerNetworkIsolation": {
+            "summary": "Let `gh`, `gcloud`, and `terraform` verify TLS behind a MITM proxy inside the [sandbox](https://code.claude.com/docs/en/sandboxing#go-based-clis-fail-tls-verification-on-macos) on macOS",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-enableweakernetworkisolation",
+            "about": "Let sandboxed commands on macOS reach the system TLS trust service, `com.apple.trustd.agent`. Go-based tools such as `gh`, `gcloud`, and `terraform` need it to verify TLS certificates when you use [`network.httpProxyPort`](https://code.claude.com/docs/en/settings-reference#sandbox-network-httpproxyport) with a MITM proxy and a custom CA. This reduces security by opening a potential data exfiltration path through the trust service.",
+            "type": "Boolean\n* `true`: sandboxed commands on macOS can reach `com.apple.trustd.agent`\n* `false`: sandboxed commands on macOS can't reach the system TLS trust service",
+            "default": "`false`"
+        },
+        "sandbox.excludedCommands": {
+            "summary": "Name commands Claude Code can run outside the [sandbox](https://code.claude.com/docs/en/sandboxing)",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-excludedcommands",
+            "about": "Name commands that Claude Code runs outside the sandbox, such as tools that don't work under it. Each entry uses the same syntax as the content of a `Bash(...)` [permission rule](https://code.claude.com/docs/en/permissions#permission-rule-syntax): an exact command, a prefix such as `docker *`, or a wildcard pattern. A pattern with no wildcard is an exact match, so `docker` matches only `docker` with no arguments.\n\nYour entries take a Bash call out of the sandbox only when they cover every command in it, and some call shapes stay sandboxed even then. A `docker *` entry alone doesn't take `npm ci && docker build .` out of the sandbox.",
+            "type": "array of command patterns",
+            "default": "unset, so no command is excluded"
+        },
+        "sandbox.failIfUnavailable": {
+            "summary": "Refuse to start when the [sandbox](https://code.claude.com/docs/en/sandboxing) can't, instead of running unsandboxed",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-failifunavailable",
+            "about": "Make Claude Code exit with an error at startup when `sandbox.enabled` is `true` but the sandbox can't start, because a dependency is missing or the platform is unsupported. Without this key, Claude Code runs commands unsandboxed. Managed deployments that require sandboxing as a security gate can use this setting.\n\nOn a platform the sandbox doesn't support, Claude Code doesn't start with this key on. See [Enforce sandboxing with managed settings](https://code.claude.com/docs/en/sandboxing#enforce-sandboxing-with-managed-settings).",
+            "type": "Boolean\n* `true`: Claude Code exits with an error at startup when `sandbox.enabled` is `true` but the sandbox can't start\n* `false`: Claude Code runs commands unsandboxed when the sandbox can't start",
+            "default": "`false`"
+        },
+        "sandbox.filesystem": {
+            "summary": "Control which paths [sandboxed](https://code.claude.com/docs/en/sandboxing#filesystem-isolation) commands can read and write",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-filesystem",
+            "about": "Control which paths sandboxed commands can read and write. By default they can write to the working directory, the per-user temp directory, and directories you add with `--add-dir`, `/add-dir`, or `permissions.additionalDirectories`, and can read the rest of the filesystem, including credential files. Widen or narrow that with the four path lists, or switch the filesystem layer off with `disabled`. See [Filesystem isolation](https://code.claude.com/docs/en/sandboxing#filesystem-isolation) for the default boundaries.",
+            "type": "object with `allowWrite`, `denyWrite`, `denyRead`, and `allowRead` arrays, plus the `allowManagedReadPathsOnly` and `disabled` Booleans",
+            "default": "unset, so the default read and write boundaries apply"
+        },
+        "sandbox.filesystem.allowManagedReadPathsOnly": {
+            "summary": "Stop developers from re-opening [read paths your organization blocked](https://code.claude.com/docs/en/sandboxing#keep-developers-from-widening-the-policy)",
+            "category": "Sandbox settings",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-filesystem-allowmanagedreadpathsonly",
+            "about": "Honor only the [`allowRead`](https://code.claude.com/docs/en/settings-reference#sandbox-filesystem-allowread) entries that come from managed settings, so developers can't re-open read access to paths your organization blocked. Claude Code still merges `denyRead` entries from every settings scope the session loads.",
+            "type": "Boolean\n* `true`: Claude Code honors only the `allowRead` entries from managed settings\n* `false`: `allowRead` entries from other settings files can merge in",
+            "default": "`false`"
+        },
+        "sandbox.filesystem.allowRead": {
+            "summary": "Re-open reading inside a region [`denyRead`](https://code.claude.com/docs/en/settings-reference#sandbox-filesystem-denyread) blocks",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-filesystem-allowread",
+            "about": "Re-open reading for specific paths inside a region that [`denyRead`](https://code.claude.com/docs/en/settings-reference#sandbox-filesystem-denyread) blocks, to build workspace-only read access. An exact or wildcard `denyRead` entry stays blocked inside a broader `allowRead`, as the [overlap table](https://code.claude.com/docs/en/sandboxing#configure-sandboxing) shows. When a wildcard `denyRead` entry such as `~/**/.env` matches a directory, Claude Code blocks reads of its contents as well. Before v2.1.236 on macOS, Claude Code re-opened the paths a wildcard `denyRead` entry matched wherever a broader `allowRead` entry covered them, and left a matched directory's contents readable.",
+            "type": "array of path strings, using the [sandbox path prefixes](https://code.claude.com/docs/en/settings-reference#sandbox-path-prefixes)",
+            "default": "unset"
+        },
+        "sandbox.filesystem.allowWrite": {
+            "summary": "Add paths [sandboxed](https://code.claude.com/docs/en/sandboxing) commands can write to",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-filesystem-allowwrite",
+            "about": "Add paths where sandboxed commands can write, beyond the working directory, the per-user temp directory, and the directories you've added with `--add-dir`, `/add-dir`, or `permissions.additionalDirectories`. Use it when a subprocess such as `kubectl` or a build tool needs to write outside the project.",
+            "type": "array of path strings, using the [sandbox path prefixes](https://code.claude.com/docs/en/settings-reference#sandbox-path-prefixes)",
+            "default": "unset, so sandboxed commands can write to the working directory, the per-user temp directory, directories you've added with `--add-dir` or `/add-dir`, and directories in [`permissions.additionalDirectories`](https://code.claude.com/docs/en/settings-reference#permissions-additionaldirectories)"
+        },
+        "sandbox.filesystem.denyRead": {
+            "summary": "Block [sandboxed](https://code.claude.com/docs/en/sandboxing) commands from reading specific paths",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-filesystem-denyread",
+            "about": "Block sandboxed commands from reading specific paths, such as credential files that the default read policy would otherwise expose. To protect a credential file and keep it usable through the sandbox proxy, see [`sandbox.credentials`](https://code.claude.com/docs/en/settings-reference#sandbox-credentials) instead.",
+            "type": "array of path strings, using the [sandbox path prefixes](https://code.claude.com/docs/en/settings-reference#sandbox-path-prefixes)",
+            "default": "unset, so sandboxed commands keep the [default read access](https://code.claude.com/docs/en/sandboxing#filesystem-isolation), which includes credential files such as `~/.aws/credentials`"
+        },
+        "sandbox.filesystem.denyWrite": {
+            "summary": "Block [sandboxed](https://code.claude.com/docs/en/sandboxing) commands from writing to specific paths",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-filesystem-denywrite",
+            "about": "Block sandboxed commands from writing to specific paths, including paths inside a directory that is otherwise writable.",
+            "type": "array of path strings, using the [sandbox path prefixes](https://code.claude.com/docs/en/settings-reference#sandbox-path-prefixes)",
+            "default": "unset"
+        },
+        "sandbox.filesystem.disabled": {
+            "summary": "[Turn off filesystem isolation](https://code.claude.com/docs/en/sandboxing#disable-filesystem-isolation) while keeping network isolation",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-filesystem-disabled",
+            "about": "Skip filesystem isolation while keeping network isolation. Sandboxed commands get unrestricted read and write access to the host filesystem, and their network egress stays confined to [`network.allowedDomains`](https://code.claude.com/docs/en/settings-reference#sandbox-network-alloweddomains). Use it when you sandbox to control where commands connect rather than what they write. Requires Claude Code v2.1.216 or later.",
+            "type": "Boolean\n* `true`: Claude Code skips filesystem isolation and keeps network isolation\n* `false`: filesystem isolation stays on",
+            "default": "`false`, so filesystem isolation stays on"
+        },
+        "sandbox.ignoreViolations": {
+            "summary": "Silence violation reports for paths a command is expected to probe",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-ignoreviolations",
+            "about": "Silence sandbox violation reports for paths you expect a command to probe and be refused, such as a tool that checks `/etc/hosts` on startup, so those denials don't show up as violations or in what Claude sees. The sandbox still blocks the access; only the report is suppressed. Keys are substrings to match against the command, with `*` matching every command, and values are substrings of the violation to ignore for that command, such as a filesystem path.",
+            "type": "object mapping a command substring to an array of violation substrings, usually paths",
+            "default": "unset, so every violation is reported"
+        },
+        "sandbox.network": {
+            "summary": "Control which hosts, ports, and sockets [sandboxed](https://code.claude.com/docs/en/sandboxing#network-isolation) commands reach",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-network",
+            "about": "Control which hosts, ports, and sockets sandboxed commands can reach. The sandbox routes outbound traffic through a proxy that enforces these lists; see [Network isolation](https://code.claude.com/docs/en/sandboxing#network-isolation) for how the proxy decides and when it prompts.",
+            "type": "object with the sub-keys below",
+            "default": "unset, so no domains are pre-allowed and your permission mode decides [what happens to each new host](https://code.claude.com/docs/en/sandboxing#hosts-outside-your-allowed-domains)"
+        },
+        "sandbox.network.allowAllUnixSockets": {
+            "summary": "Let [sandboxed](https://code.claude.com/docs/en/sandboxing) commands connect to every Unix socket",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-network-allowallunixsockets",
+            "about": "Let sandboxed commands connect to every Unix socket. On Linux and WSL2, the sandbox's [seccomp filter](https://code.claude.com/docs/en/sandboxing#set-up-linux-and-wsl2) blocks `socket(AF_UNIX, ...)` calls, so this is the only way to permit Unix sockets there. When the filter is missing, which `/sandbox` reports on its Dependencies tab, the sandbox doesn't block Unix-socket calls. See [Set up Linux and WSL2](https://code.claude.com/docs/en/sandboxing#set-up-linux-and-wsl2) for where the filter comes from.",
+            "type": "Boolean\n* `true`: sandboxed commands can connect to every Unix socket\n* `false`: the sandbox blocks Unix-socket connections: on macOS except the paths in `allowUnixSockets`, and on Linux and WSL2 through the seccomp filter when it's present",
+            "default": "`false`"
+        },
+        "sandbox.network.allowedDomains": {
+            "summary": "Pre-allow domains so [sandboxed](https://code.claude.com/docs/en/sandboxing) commands don't prompt for them",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-network-alloweddomains",
+            "about": "Pre-allow domains for outbound traffic from sandboxed commands, so the sandbox doesn't prompt for them. Wildcards such as `*.example.com` match subdomains, and an optional `:port` suffix limits an entry to one port; an entry without a port matches every port.",
+            "type": "array of strings, each a domain, wildcard pattern, or IP literal, with an optional `:port` suffix",
+            "default": "unset, so your permission mode decides [what happens to each new host](https://code.claude.com/docs/en/sandboxing#hosts-outside-your-allowed-domains)"
+        },
+        "sandbox.network.allowLocalBinding": {
+            "summary": "Let [sandboxed](https://code.claude.com/docs/en/sandboxing) commands listen on network ports and connect to localhost on macOS",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-network-allowlocalbinding",
+            "about": "Let sandboxed commands on macOS listen on network ports, for example to start a dev server, and connect to any port on localhost. A command that listens on a non-loopback address accepts connections from other machines. The key has no effect on Linux and WSL2, where each sandboxed command has its own loopback interface. To reach a server on the host from Linux or WSL2, see [A command fails to reach a server on localhost](https://code.claude.com/docs/en/sandboxing#a-command-fails-to-reach-a-server-on-localhost).",
+            "type": "Boolean\n* `true`: sandboxed commands on macOS can listen on any local address and connect to any port on localhost\n* `false`: sandboxed commands on macOS can't listen on a port or connect directly to servers on localhost",
+            "default": "`false`"
+        },
+        "sandbox.network.allowMachLookup": {
+            "summary": "Let macOS [sandboxed](https://code.claude.com/docs/en/sandboxing) tools like the iOS Simulator or Playwright reach their XPC services",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-network-allowmachlookup",
+            "about": "List additional XPC and Mach service names the macOS sandbox may look up. Tools that communicate over XPC, such as the iOS Simulator or Playwright, need their services listed here.",
+            "type": "array of strings, each a service name; a single trailing `*` matches a prefix, and `\"*\"` alone matches every service",
+            "default": "unset"
+        },
+        "sandbox.network.allowManagedDomainsOnly": {
+            "summary": "Lock the network allowlist to [managed settings](https://code.claude.com/docs/en/sandboxing#keep-developers-from-widening-the-policy)",
+            "category": "Sandbox settings",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-network-allowmanageddomainsonly",
+            "about": "Lock the network allowlist to what managed settings define. Claude Code then honors only `allowedDomains` and `WebFetch(domain:...)` allow rules from managed settings, ignores domains from user, project, local, and `--settings` settings, and blocks a non-allowed domain automatically instead of prompting.",
+            "type": "Boolean\n* `true`: Claude Code honors only `allowedDomains` and `WebFetch(domain:...)` allow rules from managed settings and blocks a non-allowed domain instead of prompting\n* `false`: domains from other settings files can merge into the allowlist",
+            "default": "`false`"
+        },
+        "sandbox.network.allowUnixSockets": {
+            "summary": "List Unix socket paths [sandboxed](https://code.claude.com/docs/en/sandboxing) commands can use on macOS",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-network-allowunixsockets",
+            "about": "List the Unix socket paths sandboxed commands can connect to on macOS. Claude Code ignores this list on Linux and WSL2, where the seccomp filter can't inspect socket paths; use [`allowAllUnixSockets`](https://code.claude.com/docs/en/settings-reference#sandbox-network-allowallunixsockets) there instead.",
+            "type": "array of strings, each a socket path",
+            "default": "unset, so the macOS sandbox blocks every Unix socket"
+        },
+        "sandbox.network.deniedDomains": {
+            "summary": "Block domains for [sandboxed](https://code.claude.com/docs/en/sandboxing) commands, even inside an allowed wildcard",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-network-denieddomains",
+            "about": "Block domains for outbound traffic from sandboxed commands, using the same wildcard, port, and IPv6 syntax as [`allowedDomains`](https://code.claude.com/docs/en/settings-reference#sandbox-network-alloweddomains). A denied domain stays blocked even when an `allowedDomains` entry matches it too.",
+            "type": "array of strings, each a domain, wildcard pattern, or IP literal, with an optional `:port` suffix",
+            "default": "unset"
+        },
+        "sandbox.network.httpProxyPort": {
+            "summary": "Route [sandbox](https://code.claude.com/docs/en/sandboxing#custom-proxy-configuration) HTTP traffic through your own proxy",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-network-httpproxyport",
+            "about": "Point the sandbox at your own HTTP proxy instead of the one Claude Code runs. Organizations do this to inspect HTTPS traffic, apply their own filtering rules, or log requests. Your proxy takes over filtering, and Claude Code stops applying its domain lists and network prompts to traffic sent there. When unset, Claude Code starts its own proxy for HTTP traffic.",
+            "type": "number, a local TCP port",
+            "default": "unset, so Claude Code runs its own proxy"
+        },
+        "sandbox.network.socksProxyPort": {
+            "summary": "Route [sandbox](https://code.claude.com/docs/en/sandboxing#custom-proxy-configuration) SOCKS traffic through your own proxy",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-network-socksproxyport",
+            "about": "Point the sandbox at your own SOCKS5 proxy instead of the one Claude Code runs. Your proxy takes over filtering, and Claude Code stops applying its domain lists and network prompts to traffic sent there. When unset, Claude Code starts its own proxy for SOCKS traffic.",
+            "type": "number, a local TCP port",
+            "default": "unset, so Claude Code runs its own proxy"
+        },
+        "sandbox.network.strictAllowlist": {
+            "summary": "Deny hosts outside the [allowlist](https://code.claude.com/docs/en/sandboxing#network-isolation) instead of prompting",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-network-strictallowlist",
+            "about": "Deny sandboxed commands access to hosts outside the allowlist instead of prompting for approval. The allowlist is [`allowedDomains`](https://code.claude.com/docs/en/settings-reference#sandbox-network-alloweddomains) plus domains from `WebFetch(domain:...)` allow rules, or only the managed settings entries when [`allowManagedDomainsOnly`](https://code.claude.com/docs/en/settings-reference#sandbox-network-allowmanageddomainsonly) is set. [Locks that apply without an admin-required sandbox](https://code.claude.com/docs/en/sandboxing#locks-that-apply-without-an-admin-required-sandbox) covers a repository's entries. Requires Claude Code v2.1.219 or later.",
+            "type": "Boolean\n* `true`: Claude Code denies sandboxed commands access to hosts outside the allowlist\n* `false`: unless another trusted settings file sets `true`, Claude Code decides a host outside the allowlist by permission mode instead of denying it outright: in auto mode it checks the host against the command's [per-command allowed domains](https://code.claude.com/docs/en/sandboxing#per-command-allowed-domains-in-auto-mode), in `dontAsk` mode it denies, in `bypassPermissions` mode and in interactive terminal plan-mode sessions where bypass is available it allows, and otherwise it asks you",
+            "default": "`false`"
+        },
+        "sandbox.network.tlsTerminate": {
+            "summary": "Have the [sandbox](https://code.claude.com/docs/en/sandboxing#network-isolation) proxy terminate TLS so it can read HTTPS requests",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-network-tlsterminate",
+            "about": "Make the sandbox proxy terminate TLS so it can read the contents of HTTPS requests. This is experimental, and `mask` [credential substitution](https://code.claude.com/docs/en/sandboxing#mask-credentials) requires it. Set `{}` to generate an ephemeral certificate authority for the session, or set `caCertPath` and `caKeyPath` to use your own.",
+            "type": "object with optional `caCertPath` and `caKeyPath` strings, each a file path",
+            "default": "unset, so the proxy doesn't terminate or inspect TLS"
+        },
+        "sandbox.ripgrep": {
+            "summary": "Use your own ripgrep binary inside the [sandbox](https://code.claude.com/docs/en/sandboxing)",
+            "category": "Sandbox settings",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-ripgrep",
+            "about": "Point the sandbox at a ripgrep binary of your own instead of the one Claude Code uses, for example when your platform needs a differently built `rg`.",
+            "type": "object with `command`, the path to the ripgrep binary, and optional `args`, an array of arguments to prepend",
+            "default": "unset, so the sandbox uses the same ripgrep binary as Claude Code. That is the bundled binary unless you set [`USE_BUILTIN_RIPGREP`](https://code.claude.com/docs/en/env-vars) to `0`"
+        },
+        "sandbox.socatPath": {
+            "summary": "Point the [sandbox](https://code.claude.com/docs/en/sandboxing) proxy at a `socat` binary outside `PATH`",
+            "category": "Sandbox settings",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sandbox-socatpath",
+            "about": "Point the sandbox network proxy at a `socat` binary installed outside `PATH`.",
+            "type": "string, an absolute path; Claude Code drops a relative path and falls back to `PATH` lookup",
+            "default": "unset, so Claude Code finds `socat` on `PATH`"
+        },
+        "showClearContextOnPlanAccept": {
+            "summary": "Show a \"clear context\" option on the [plan accept screen](https://code.claude.com/docs/en/permission-modes#review-and-approve-a-plan)",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#showclearcontextonplanaccept",
+            "about": "When Claude finishes a plan in [plan mode](https://code.claude.com/docs/en/permission-modes#review-and-approve-a-plan), it shows an approval menu. Planning can use a lot of context, so this key adds a first option to that menu, **Yes, clear context and …**, that approves the plan, clears the conversation context, and starts implementing from the plan alone. The rest of the label names the permission mode the session continues in, and shows how much of your context the planning used.",
+            "type": "Boolean\n* `true`: the plan approval menu gets a first option, **Yes, clear context and …**, that approves the plan and clears the conversation context\n* `false`: the plan approval menu shows no clear-context option",
+            "default": "`false`"
+        },
+        "showThinkingSummaries": {
+            "summary": "See summaries of Claude's [thinking](https://code.claude.com/docs/en/model-config#extended-thinking) instead of a collapsed stub",
+            "category": "Model and responses",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#showthinkingsummaries",
+            "about": "See summaries of Claude's [extended thinking](https://code.claude.com/docs/en/model-config#extended-thinking) in interactive sessions. Set it if you want the full summaries when you expand thinking with `Ctrl+O`. When unset or `false`, the Anthropic API redacts thinking blocks and Claude Code shows a collapsed stub; third-party providers don't redact.",
+            "type": "Boolean\n* `true`: you see full thinking summaries when you expand thinking with `Ctrl+O`\n* `false`: the Anthropic API redacts thinking blocks and Claude Code shows a collapsed stub",
+            "default": "`false`"
+        },
+        "showTurnDuration": {
+            "summary": "Hide the \"Cooked for\" duration after each response",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#showturnduration",
+            "about": "Show or hide the turn duration message after each response, such as \"Cooked for 1m 6s · done 6:05 PM\". The clock after \"done\" shows when the turn finished; [`timeFormat`](https://code.claude.com/docs/en/settings-reference#timeformat) and [`timeZone`](https://code.claude.com/docs/en/settings-reference#timezone) control its format and zone. Appears in `/config` as **Show turn duration**.",
+            "type": "Boolean\n* `true`: you see the turn duration message after each response\n* `false`: Claude Code hides the turn duration message",
+            "default": "`true`"
+        },
+        "skillListingBudgetFraction": {
+            "summary": "Reserve more or less context for the [skill listing](https://code.claude.com/docs/en/skills#skill-descriptions-are-cut-short)",
+            "category": "Memory and context",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#skilllistingbudgetfraction",
+            "about": "Each turn, Claude sees a [listing of your skills](https://code.claude.com/docs/en/skills#skill-descriptions-are-cut-short) with their descriptions, and Claude Code caps that listing at a share of the context window. When the listing is over the cap, Claude Code keeps every skill's name but drops the descriptions of the least-used skills, so Claude can still invoke those skills but is less likely to choose one on its own. Raise this key to keep more descriptions visible at the cost of more context per turn.",
+            "type": "number, a fraction greater than `0` and at most `1`",
+            "default": "`0.01`, which reserves 1% of the context window"
+        },
+        "skillListingMaxDescChars": {
+            "summary": "Cap each skill's description length in the [skill listing](https://code.claude.com/docs/en/skills#skill-descriptions-are-cut-short)",
+            "category": "Memory and context",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#skilllistingmaxdescchars",
+            "about": "Each turn, Claude sees a [listing of your skills](https://code.claude.com/docs/en/skills#skill-descriptions-are-cut-short) that shows each skill's `description` and `when_to_use` text. This key caps how many characters of that text Claude Code shows per skill; longer text is cut at the cap.",
+            "type": "number of characters, a positive integer",
+            "default": "`1536`"
+        },
+        "skillOverrides": {
+            "summary": "[Hide or collapse a skill](https://code.claude.com/docs/en/skills#override-skill-visibility-from-settings) without editing its SKILL.md",
+            "category": "Plugins and skills",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#skilloverrides",
+            "about": "Hide or collapse a [skill](https://code.claude.com/docs/en/skills#override-skill-visibility-from-settings) without editing its `SKILL.md`. Claude Code applies the value under each skill's name to the skill list Claude sees and to your `/` autocomplete.",
+            "type": "object mapping skill name to one of:\n* `\"on\"`: Claude sees the skill and you can type `/name`\n* `\"name-only\"`: Claude sees the skill by name without its description\n* `\"user-invocable-only\"`: Claude doesn't see the skill, but you can still type `/name`\n* `\"off\"`: Claude doesn't see the skill and `/name` is hidden from autocomplete",
+            "default": "unset, so every skill is `\"on\"`"
+        },
+        "skipAutoPermissionPrompt": {
+            "summary": "Skip the one-time notice Claude Code shows when you first enter [auto mode](https://code.claude.com/docs/en/permission-modes#eliminate-prompts-with-auto-mode) yourself rather than through the built-in default",
+            "category": "Permission settings",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#skipautopermissionprompt",
+            "about": "Skip the one-time notice describing [auto mode](https://code.claude.com/docs/en/permission-modes#eliminate-prompts-with-auto-mode) that Claude Code shows when you first enter auto mode yourself, for example through your own settings or the mode selector, rather than when the built-in default starts a session in it. Claude Code shows that notice once and then records that it was shown, so this key only matters where the notice hasn't appeared yet.",
+            "type": "Boolean\n* `true`: Claude Code skips the notice\n* `false`: the same as unset; the notice appears once unless another of these files sets `true`",
+            "default": "unset, so the notice appears once"
+        },
+        "skipDangerousModePermissionPrompt": {
+            "summary": "Skip the confirmation dialog before [bypassPermissions mode](https://code.claude.com/docs/en/permission-modes#skip-all-checks-with-bypasspermissions-mode)",
+            "category": "Permission settings",
+            "scopes": ["managed", "user", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#skipdangerousmodepermissionprompt",
+            "about": "Skip the confirmation dialog Claude Code shows before a session enters `bypassPermissions` mode, whether from `--dangerously-skip-permissions` or from `defaultMode: \"bypassPermissions\"`. Claude Code writes `true` here in your user settings when you accept that dialog once.",
+            "type": "Boolean\n* `true`: Claude Code skips the confirmation dialog before a session enters `bypassPermissions` mode\n* `false`: the same as unset; the dialog appears unless another of these files sets `true`",
+            "default": "unset, so the dialog appears"
+        },
+        "skipWebFetchPreflight": {
+            "summary": "Skip the [WebFetch hostname check](https://code.claude.com/docs/en/tools-reference#webfetch-tool-behavior) when Anthropic is unreachable",
+            "category": "Privacy and telemetry",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#skipwebfetchpreflight",
+            "about": "Skip the [WebFetch domain safety check](https://code.claude.com/docs/en/data-usage#webfetch-domain-safety-check), which sends each requested hostname to `api.anthropic.com` before fetching. Set `true` in environments that block traffic to Anthropic, such as Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry deployments with restrictive egress.",
+            "type": "Boolean\n* `true`: Claude Code skips the WebFetch domain safety check\n* `false`: the check runs before the first fetch to each hostname in a session, and again for a hostname whose earlier check was blocked or failed",
+            "default": "unset, so the check runs before the first fetch to each hostname in a session"
+        },
+        "spellcheck": {
+            "summary": "Underline misspelled words in the prompt input with a [spell checker](https://code.claude.com/docs/en/interactive-mode#check-spelling-as-you-type) you install",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#spellcheck",
+            "about": "Underline misspelled words in the prompt input as you type, using a spell checker you install. Claude Code checks only the text in the input box. [Check spelling as you type](https://code.claude.com/docs/en/interactive-mode#check-spelling-as-you-type) covers installing aspell, hunspell, or ispell and what the checker covers. Requires Claude Code v2.1.235 or later.",
+            "type": "object with `enabled` (Boolean), `checker` (`\"aspell\"`, `\"hunspell\"`, `\"ispell\"`, or `\"auto\"`), `language` (string, passed to the checker as its dictionary name), and `color` (string, a terminal color name, `#rrggbb`, `rgb(r,g,b)`, `ansi256(n)`, or `ansi:<name>`)",
+            "default": "unset, so spell checking is off; `checker` defaults to `\"auto\"`, the first of the three found on `PATH`; `language` defaults to the checker's own dictionary; `color` defaults to the theme's error color"
+        },
+        "spinnerTipsEnabled": {
+            "summary": "Hide tips in the spinner while Claude works",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#spinnertipsenabled",
+            "about": "While Claude works, the spinner line rotates through short tips about Claude Code features, such as \"Use Plan Mode to prepare for a complex request before making changes. Press Shift+Tab twice to enable.\" Set this key to `false` to hide them. Appears in `/config` as **Show tips**.",
+            "type": "Boolean\n* `true`: you see tips in the spinner while Claude is working\n* `false`: Claude Code hides spinner tips",
+            "default": "`true`"
+        },
+        "spinnerTipsOverride": {
+            "summary": "Add your own tips to the spinner rotation, or replace the built-in tips",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#spinnertipsoverride",
+            "about": "Add your own tips to the [spinner tips](https://code.claude.com/docs/en/settings-reference#spinnertipsenabled) that Claude Code shows while Claude works, or replace the built-in tips with yours. Claude Code puts your tips in the same rotation as the built-in ones.\n\nIf you set [`spinnerTipsEnabled`](https://code.claude.com/docs/en/settings-reference#spinnertipsenabled) to `false`, Claude Code hides all tips, yours included.",
+            "type": "object with `tips`, `tipsFile`, `label`, and `excludeDefault` fields, each optional",
+            "default": "unset, so Claude Code shows only the built-in tips"
+        },
+        "spinnerVerbs": {
+            "summary": "Add or replace the verbs shown while a turn runs",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#spinnerverbs",
+            "about": "While a turn is in progress, the spinner shows a rotating verb such as \"Accomplishing\", \"Architecting\", or \"Baking\". Use this key to add your own verbs to that rotation or replace the built-in list with yours.",
+            "type": "object with a `verbs` array of strings and `mode`, one of:\n* `\"append\"`: Claude Code adds your verbs to the built-in set\n* `\"replace\"`: Claude Code shows only your verbs",
+            "default": "unset, so Claude Code uses the built-in verbs"
+        },
+        "sshConfigs": {
+            "summary": "Add [SSH connections](https://code.claude.com/docs/en/desktop#pre-configure-ssh-connections-for-your-team) to the Desktop environment dropdown",
+            "category": "Remote, desktop, and notifications",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sshconfigs",
+            "about": "Add SSH connections to the [Desktop](https://code.claude.com/docs/en/desktop#pre-configure-ssh-connections-for-your-team) environment dropdown. Administrators use it to distribute shared connections to a team. Connections you define in managed settings show as managed. Users can select them and [set their own **Worktree folder**](https://code.claude.com/docs/en/desktop#choose-where-ssh-session-worktrees-go) for them, but can't edit anything else or delete them in the app.",
+            "type": "array of objects, each with required `id`, `name`, and `sshHost` and optional `sshPort` and `sshIdentityFile`",
+            "default": "unset"
+        },
+        "sshHostAllowlist": {
+            "summary": "Limit which hosts [Desktop SSH sessions](https://code.claude.com/docs/en/desktop#restrict-which-ssh-hosts-users-can-connect-to) can reach",
+            "category": "Remote, desktop, and notifications",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#sshhostallowlist",
+            "about": "Limit the hosts a [Desktop SSH session](https://code.claude.com/docs/en/desktop#restrict-which-ssh-hosts-users-can-connect-to) can connect to. Only the Desktop app reads this key; the CLI doesn't. Patterns are case-insensitive: `*` matches any host, `*.example.com` matches `example.com` and every subdomain, and anything else is an exact match against the hostname after `~/.ssh/config` resolution. An empty array turns SSH sessions off.",
+            "type": "array of hostname patterns",
+            "default": "unset, so any host is allowed"
+        },
+        "statusLine": {
+            "summary": "Run your own command to render a [status line](https://code.claude.com/docs/en/statusline) below the prompt",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#statusline",
+            "about": "Run your own command to render a [status line](https://code.claude.com/docs/en/statusline) below the prompt with context such as the model, cost, or git branch. Optional fields adjust spacing, add periodic re-runs, and hide the built-in vim mode indicator when your script renders `vim.mode` itself.",
+            "type": "object with `type` set to `\"command\"` and a `command` string, plus optional `padding` as a number of characters, `refreshInterval` as a number of seconds, minimum `1`, and `hideVimModeIndicator` as a Boolean",
+            "default": "unset, so no status line"
+        },
+        "strictKnownMarketplaces": {
+            "summary": "Allowlist the [marketplace](https://code.claude.com/docs/en/plugins/overview) sources users can add and install from",
+            "category": "Plugins and skills",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#strictknownmarketplaces",
+            "about": "Restrict which plugin marketplace sources people in your organization can add and install plugins from. Claude Code enforces the allowlist on marketplace add and on plugin install, update, refresh, and auto-update, before any network or filesystem operation, so a marketplace someone added before you set the policy can't be used to fetch plugins once its source no longer matches. Blocked users see an error naming the managed policy.\n\nIf you set this key in the [claude.ai admin console](https://code.claude.com/docs/en/server-managed-settings), claude.ai also applies it when anyone in your organization adds a marketplace from a git repository on claude.ai, as [How restrictions work](https://code.claude.com/docs/en/plugins/org#restrict-what-users-can-install) describes.",
+            "type": "array of marketplace source objects; see [Allowed source types](https://code.claude.com/docs/en/settings-reference#allowed-source-types)",
+            "default": "unset, so users can add any marketplace. An empty array is a complete lockdown that blocks every marketplace source, including the official Anthropic marketplace"
+        },
+        "strictPluginOnlyCustomization": {
+            "summary": "Block [skills](https://code.claude.com/docs/en/skills), [agents](https://code.claude.com/docs/en/sub-agents), [hooks](https://code.claude.com/docs/en/hooks), and [MCP servers](https://code.claude.com/docs/en/mcp) from user and project sources",
+            "category": "Plugins and skills",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#strictpluginonlycustomization",
+            "about": "Block skills, agents, hooks, and MCP servers from user and project sources, so they can come only from plugins or managed settings. Combine it with [`strictKnownMarketplaces`](https://code.claude.com/docs/en/settings-reference#strictknownmarketplaces) to control the full customization supply chain: the marketplace allowlist controls which plugins users can install.",
+            "type": "`true` to lock all four kinds of customization, or an array naming the kinds to lock, from `\"skills\"`, `\"agents\"`, `\"hooks\"`, and `\"mcp\"`",
+            "default": "unset, so nothing is locked"
+        },
+        "strictPluginOnlyCustomization.agents": {
+            "summary": "Lock [agents](https://code.claude.com/docs/en/sub-agents) to plugin and managed sources",
+            "category": "Plugins and skills",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#strictpluginonlycustomization-agents",
+            "about": "Lock the `agents` surface. Claude Code stops loading agents from `~/.claude/agents/`, `.claude/agents/`, and `--add-dir` directories. It keeps loading plugin agents, built-in agents, and agents in the managed policy directory.",
+            "type": "the string `\"agents\"` in the [`strictPluginOnlyCustomization`](https://code.claude.com/docs/en/settings-reference#strictpluginonlycustomization) array",
+            "default": "not locked"
+        },
+        "strictPluginOnlyCustomization.hooks": {
+            "summary": "Lock [hooks](https://code.claude.com/docs/en/hooks) to plugin and managed sources",
+            "category": "Plugins and skills",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#strictpluginonlycustomization-hooks",
+            "about": "Lock the `hooks` surface. Claude Code stops running hooks from user, project, and local `settings.json`, and keeps running plugin hooks and hooks in managed settings.",
+            "type": "the string `\"hooks\"` in the [`strictPluginOnlyCustomization`](https://code.claude.com/docs/en/settings-reference#strictpluginonlycustomization) array",
+            "default": "not locked"
+        },
+        "strictPluginOnlyCustomization.mcp": {
+            "summary": "Lock [MCP servers](https://code.claude.com/docs/en/mcp) to plugin and managed sources",
+            "category": "Plugins and skills",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#strictpluginonlycustomization-mcp",
+            "about": "Lock the `mcp` surface. Claude Code stops loading MCP servers from `~/.claude.json` and `.mcp.json`, and keeps loading plugin MCP servers, [`managed-mcp.json`](https://code.claude.com/docs/en/managed-mcp) servers, and servers from [`managedMcpServers`](https://code.claude.com/docs/en/settings-reference#managedmcpservers).",
+            "type": "the string `\"mcp\"` in the [`strictPluginOnlyCustomization`](https://code.claude.com/docs/en/settings-reference#strictpluginonlycustomization) array",
+            "default": "not locked"
+        },
+        "strictPluginOnlyCustomization.skills": {
+            "summary": "Lock [skills](https://code.claude.com/docs/en/skills) to plugin and managed sources",
+            "category": "Plugins and skills",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#strictpluginonlycustomization-skills",
+            "about": "Lock the `skills` surface. Claude Code stops loading skills from `~/.claude/skills/` and `.claude/skills/`, custom commands from `~/.claude/commands/` and `.claude/commands/`, skills and commands under `--add-dir` directories, and skills synced from your claude.ai account. It keeps loading plugin skills, bundled skills, and skills in the managed policy directory.",
+            "type": "the string `\"skills\"` in the [`strictPluginOnlyCustomization`](https://code.claude.com/docs/en/settings-reference#strictpluginonlycustomization) array",
+            "default": "not locked"
+        },
+        "subagentPromptCacheTtl": {
+            "summary": "Choose the [prompt cache lifetime](https://code.claude.com/docs/en/prompt-caching#cache-lifetime) for subagents and other requests outside the main conversation",
+            "category": "Model and responses",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#subagentpromptcachettl",
+            "about": "Choose how long the [prompt cache](https://code.claude.com/docs/en/prompt-caching) holds the requests Claude Code makes outside the main conversation. This key applies to [subagents](https://code.claude.com/docs/en/sub-agents), [workflows](https://code.claude.com/docs/en/workflows), and Claude Code's own background and helper requests, such as compaction and session titles. The one-hour lifetime keeps the cache warm across longer breaks, and the API [bills each cache write at a higher rate](https://platform.claude.com/docs/en/build-with-claude/prompt-caching#pricing) than at the five-minute lifetime. Requires Claude Code v2.1.242 or later.",
+            "type": "string, one of:\n* `\"5m\"`: the cache holds for five minutes\n* `\"1h\"`: the cache holds for an hour",
+            "default": "unset, so each of these requests gets [its default lifetime](https://code.claude.com/docs/en/prompt-caching#which-ttl-each-request-gets)"
+        },
+        "subagentStatusLine": {
+            "summary": "Rewrite rows in the [subagent](https://code.claude.com/docs/en/sub-agents) task display with your own command",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#subagentstatusline",
+            "about": "When Claude runs [subagents](https://code.claude.com/docs/en/sub-agents), Claude Code lists them in a task display below the prompt, one row per subagent showing `name · description · token count`. This key lets you run your own command to rewrite those rows, for example to show each subagent's context usage as a percentage. On each refresh, Claude Code sends the visible rows as one JSON object on stdin, with a `tasks` array carrying each subagent's `id`, `name`, `status`, `model`, `tokenCount`, and more, and replaces the row for each `id` you write back as a `{\"id\", \"content\"}` line. Rows you don't write back keep the default rendering.",
+            "type": "object with `type` set to `\"command\"` and a `command` string",
+            "default": "unset, so Claude Code renders the default rows"
+        },
+        "switchModelsOnFlag": {
+            "summary": "Switch models automatically or pause when a [safety classifier](https://code.claude.com/docs/en/model-config#ask-before-switching) flags a request",
+            "category": "Model and responses",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#switchmodelsonflag",
+            "about": "Choose what happens when a [safety classifier flags a request](https://code.claude.com/docs/en/model-config#automatic-model-fallback): switch to the fallback model and continue, or pause so you can choose between switching and editing the prompt.",
+            "type": "Boolean\n* `true`: Claude Code switches to the fallback model and continues\n* `false`: in an interactive session Claude Code pauses so you can choose between switching and editing the prompt; where no dialog can show, such as a `-p` run, the flagged request ends as an error",
+            "default": "unset. Claude Code switches automatically, though it may [ask first](https://code.claude.com/docs/en/model-config#ask-before-switching) in an interactive session"
+        },
+        "syncClaudeAiPlugins": {
+            "summary": "Stop loading the [plugins enabled on your claude.ai account](https://code.claude.com/docs/en/plugins/loading#synced-plugins) and stop downloading new ones",
+            "category": "Plugins and skills",
+            "scopes": ["managed", "user", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#syncclaudeaiplugins",
+            "about": "Turn off the download of the [plugins enabled for your claude.ai account](https://code.claude.com/docs/en/plugins/loading#synced-plugins). Claude Code downloads them into `~/.claude/plugins/synced/` at the start of terminal sessions where you sign in with your claude.ai account and in Cowork sessions, and loads each one as `<name>@synced`. Set `false` to stop that download and stop loading the plugins it already synced. Claude Code honors only `false`: `true` is the same as unset and doesn't turn syncing on where it's otherwise off. Requires Claude Code v2.1.273 or later.",
+            "type": "Boolean\n* `false`: Claude Code stops downloading synced plugins and stops loading the ones already in `~/.claude/plugins/synced/`. In user or managed settings, it also moves them to `~/.claude/plugins/.trash/`\n* `true`: the same as unset",
+            "default": "unset, so sessions signed in with your claude.ai account sync your plugins"
+        },
+        "syncClaudeAiSkills": {
+            "summary": "Stop loading the [skills enabled on your claude.ai account](https://code.claude.com/docs/en/skills#how-synced-skills-behave) and stop downloading new ones",
+            "category": "Plugins and skills",
+            "scopes": ["managed", "user", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#syncclaudeaiskills",
+            "about": "Turn off the download of the [skills enabled for your claude.ai account](https://code.claude.com/docs/en/skills#how-synced-skills-behave). Claude Code downloads them into `~/.claude/skills/synced/` in [terminal sessions where you sign in with your claude.ai account](https://code.claude.com/docs/en/skills#where-synced-skills-load), interactive or non-interactive, and in Cowork and cloud sessions. Set `false` to stop that download and stop loading the skills it already synced. Claude Code honors only `false`: `true` is the same as unset and doesn't turn syncing on where it's otherwise off.",
+            "type": "Boolean\n* `false`: Claude Code stops downloading synced skills and stops loading the ones already in `~/.claude/skills/synced/`. In user or managed settings, it also moves them to `~/.claude/skills/.trash/`\n* `true`: the same as unset",
+            "default": "unset, so sessions signed in with your claude.ai account sync your skills"
+        },
+        "syntaxHighlightingDisabled": {
+            "summary": "Turn off syntax highlighting in diffs and code blocks",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#syntaxhighlightingdisabled",
+            "about": "Claude Code colors code by language in the diffs, code blocks, and file previews it shows in the terminal, with its built-in highlighter; no plugin or language server is involved. Set this key to `true` to show them as plain text instead, for example if the colors clash with your terminal theme or slow a screen reader.",
+            "type": "Boolean\n* `true`: Claude Code turns off syntax highlighting in diffs, code blocks, and file previews\n* `false`: Claude Code highlights syntax",
+            "default": "`false`"
+        },
+        "taskOutputMaxChars": {
+            "summary": "Removed in v2.1.277, together with the `TaskOutput` tool it sized",
+            "category": "Memory and context",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#taskoutputmaxchars",
+            "about": "**Warning:** Removed in v2.1.277, together with the `TaskOutput` tool it sized. Setting it has no effect on current versions. Claude reads a background task's [output file](https://code.claude.com/docs/en/tools-reference#background-commands) with `Read` instead.\n\nThrough v2.1.276, you set this key to the number of characters of a [background task's](https://code.claude.com/docs/en/tools-reference#background-commands) output that Claude received inline when it read the task with the `TaskOutput` tool."
+        },
+        "teammateDefaultModel": {
+            "summary": "Removed in v2.1.234; see [Specify teammates and models](https://code.claude.com/docs/en/agent-teams#specify-teammates-and-models) for how Claude Code picks a teammate's model",
+            "category": "Global config settings",
+            "scopes": [],
+            "docs": "https://code.claude.com/docs/en/settings-reference#teammatedefaultmodel",
+            "about": "**Warning:** Removed in v2.1.234, together with its `/config` row **Default teammate model**. Setting it has no effect on current versions.\n\nThrough v2.1.233, you set this key to the model for [agent team](https://code.claude.com/docs/en/agent-teams#specify-teammates-and-models) teammates your prompt didn't name a model for: an alias such as `\"sonnet\"`, or `null` to follow the lead's model. For the model Claude Code picks for such teammates now, see [specify teammates and models](https://code.claude.com/docs/en/agent-teams#specify-teammates-and-models).",
+            "type": "string, a model alias or full model ID, or `null`",
+            "default": "unset"
+        },
+        "teammateMode": {
+            "summary": "Choose how [agent team teammates display](https://code.claude.com/docs/en/agent-teams#choose-a-display-mode)",
+            "category": "Agents, sessions, and worktrees",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#teammatemode",
+            "about": "Choose where Claude Code shows [agent team](https://code.claude.com/docs/en/agent-teams) teammates: inside your main terminal pane, or in split panes when your terminal supports them. See [Choose a display mode](https://code.claude.com/docs/en/agent-teams#choose-a-display-mode).",
+            "type": "string, one of:\n* `\"in-process\"`: teammates run inside your main terminal pane\n* `\"auto\"`: split panes when you're running inside tmux, or inside iTerm2 with `it2` on your `PATH` or tmux installed; in-process otherwise\n* `\"tmux\"`: split panes using tmux or iTerm2, detected from your terminal\n* `\"iterm2\"`: iTerm2 native split panes through the `it2` CLI",
+            "default": "`\"in-process\"`"
+        },
+        "terminalProgressBarEnabled": {
+            "summary": "Hide the terminal progress bar in terminals that support it",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#terminalprogressbarenabled",
+            "about": "Some terminals can show a progress indicator on the tab or in the taskbar for the program running in them. While Claude is working, Claude Code reports an in-progress state to the terminal, so you can see from another tab or window whether the session is still busy. The indicator stays visible after the turn ends while [background subagents](https://code.claude.com/docs/en/sub-agents#run-subagents-in-foreground-or-background) or [dynamic workflows](https://code.claude.com/docs/en/workflows) are still running, and clears once the session is idle.\n\nClaude Code reports it only in terminals that support the indicator: ConEmu, Ghostty 1.2.0 or later, and iTerm2 3.6.6 or later. Set this key to `false` to stop Claude Code from reporting it. Appears in `/config` as **Terminal progress bar**.",
+            "type": "Boolean\n* `true`: you see the terminal progress bar in terminals that support it\n* `false`: Claude Code hides the terminal progress bar",
+            "default": "`true`"
+        },
+        "terminalTitleFromRename": {
+            "summary": "Stop [`/rename`](https://code.claude.com/docs/en/sessions#name-your-sessions) and `--name` from changing the terminal tab title",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#terminaltitlefromrename",
+            "about": "Claude Code sets your terminal tab's title. By default it uses a title it generates from the conversation, and once you give the session a [name](https://code.claude.com/docs/en/sessions#name-your-sessions) with `/rename` or `--name`, the tab shows that name instead. Set this key to `false` to keep the generated title on the tab even after you name the session. The name itself still applies, so `/resume <name>` and the session picker find it.",
+            "type": "Boolean\n* `true`: the terminal tab title shows the session name you set\n* `false`: the tab keeps the title Claude Code generates from your conversation",
+            "default": "`true`"
+        },
+        "theme": {
+            "summary": "Pick the interface [color theme](https://code.claude.com/docs/en/terminal-config#match-the-color-theme), built-in or custom",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#theme",
+            "about": "Pick the color theme for the interface. Appears in `/config` as **Theme**.",
+            "type": "string, one of:\n* `\"auto\"`: matches your terminal's light or dark background\n* `\"dark\"`: the dark theme\n* `\"light\"`: the light theme\n* `\"dark-daltonized\"`: the dark theme with colorblind-friendly colors\n* `\"light-daltonized\"`: the light theme with colorblind-friendly colors\n* `\"dark-ansi\"`: the dark theme using only your terminal's ANSI color palette\n* `\"light-ansi\"`: the light theme using only your terminal's ANSI color palette\n* `\"custom:<slug>\"` or `\"custom:<plugin-name>:<slug>\"`: a custom theme from `~/.claude/themes/` or a plugin",
+            "default": "`\"dark\"`"
+        },
+        "timeFormat": {
+            "summary": "Show the times in the interface on a 12-hour or 24-hour clock, in UTC, or with a strftime pattern",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#timeformat",
+            "about": "Choose how Claude Code writes the times it shows in the interface, such as the `done 6:05 PM` at the end of each turn duration message and the timestamps in the [transcript viewer](https://code.claude.com/docs/en/interactive-mode#transcript-viewer). To pick a preset, run `/config` and set **Time format**. Requires Claude Code v2.1.257 or later.",
+            "type": "string, one of:\n* `\"auto\"`: the same as unset; each time keeps its built-in format, which follows your locale on the turn duration message\n* `\"12-hour\"`: a 12-hour clock\n* `\"24-hour\"`: a 24-hour clock\n* `\"24-hour-utc\"`: a 24-hour clock in UTC with `Z` after the minutes, such as `18:05Z`; Claude Code ignores [`timeZone`](https://code.claude.com/docs/en/settings-reference#timezone) for this preset\n* A strftime pattern such as `\"%H:%M\"`: Claude Code writes each time with the pattern. Any value that contains a `%` is a pattern, and any other value outside the presets counts as `\"auto\"`",
+            "default": "`\"auto\"`"
+        },
+        "timeZone": {
+            "summary": "Show the times in the interface in a time zone other than your system's",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#timezone",
+            "about": "Show the times in the interface in a time zone other than your system's. Set it to an [IANA time zone name](https://www.iana.org/time-zones), such as `\"UTC\"` or `\"Europe/Dublin\"`. The times that [`timeFormat`](https://code.claude.com/docs/en/settings-reference#timeformat) controls then show in this zone. If `timeFormat` is `\"24-hour-utc\"`, times stay in UTC and Claude Code ignores this key. `/config` has no row for this key, so set it in a settings file. Requires Claude Code v2.1.257 or later.",
+            "type": "string, an IANA time zone name. When Claude Code doesn't recognize the name, it uses your system time zone",
+            "default": "unset, so times show in your system time zone"
+        },
+        "tui": {
+            "summary": "Choose the [fullscreen](https://code.claude.com/docs/en/fullscreen) or classic terminal renderer",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#tui",
+            "about": "Choose the terminal UI renderer. Use `\"fullscreen\"` for the flicker-free [alt-screen renderer](https://code.claude.com/docs/en/fullscreen) with virtualized scrollback, or `\"default\"` for the classic main-screen renderer. Running `/tui fullscreen` or `/tui default` writes this key for you.",
+            "type": "string, one of:\n* `\"default\"`: the classic main-screen renderer\n* `\"fullscreen\"`: the flicker-free alt-screen renderer with virtualized scrollback",
+            "default": "unset, so Claude Code [picks the renderer for you](https://code.claude.com/docs/en/fullscreen#fullscreen-by-default)"
+        },
+        "ultracode": {
+            "summary": "Have Claude plan a [workflow](https://code.claude.com/docs/en/workflows#let-claude-decide-with-ultracode) for each substantive task without being asked",
+            "category": "Model and responses",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#ultracode",
+            "about": "Start sessions with [ultracode](https://code.claude.com/docs/en/workflows#let-claude-decide-with-ultracode) on. With it on, Claude plans a workflow for each substantive task instead of waiting for you to ask. Claude plans workflows only when [dynamic workflows](https://code.claude.com/docs/en/workflows) are enabled for you and your model supports `xhigh` effort. The key doesn't change the session's effort level: ultracode runs at whichever level the session uses. Claude Code reads this key but never writes it: `/effort ultracode` turns ultracode on for the current session only.",
+            "type": "Boolean\n* `true`: sessions start with ultracode on when dynamic workflows are enabled for you and your model supports `xhigh`\n* `false`: sessions start with ultracode off",
+            "default": "unset, so ultracode is off"
+        },
+        "useAutoModeDuringPlan": {
+            "summary": "Let the [auto mode](https://code.claude.com/docs/en/permission-modes#eliminate-prompts-with-auto-mode) classifier review shell commands in [plan mode](https://code.claude.com/docs/en/permission-modes#analyze-before-you-edit-with-plan-mode); set `false` to get prompts instead",
+            "category": "Permission settings",
+            "scopes": ["managed", "user", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#useautomodeduringplan",
+            "about": "Choose whether Claude Code uses the auto mode classifier to review shell commands in plan mode. With the default `true`, the classifier reviews each command during planning when auto mode is available and you see no prompt, except for [critical-path removals](https://code.claude.com/docs/en/permission-modes#critical-paths). Set `false` to get a permission prompt for every command outside the built-in read-only set. Appears in `/config` as **Use auto mode during plan**.",
+            "type": "Boolean\n* `true`: the same as unset; when auto mode is available, the classifier reviews each shell command during planning instead of prompting you for it, except [critical-path removals](https://code.claude.com/docs/en/permission-modes#critical-paths). A `false` in any of these files still turns it off\n* `false`: you get a permission prompt for every command outside the built-in read-only set",
+            "default": "`true`"
+        },
+        "verbose": {
+            "summary": "Show [full tool output](https://code.claude.com/docs/en/cli-reference#cli-flags) instead of truncated summaries; `viewMode` takes precedence when both are set",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#verbose",
+            "about": "By default, the transcript collapses each tool call to a short summary, such as the command Claude ran and a line count of its output, and you press `Ctrl+O` to switch the whole transcript to the expanded view when you want the details. Set this key to `true` to show every tool call's full input and output inline as it happens, which is useful when you're debugging a hook, an MCP server, or a long shell command. Appears in `/config` as **Verbose output**.",
+            "type": "Boolean\n* `true`: you see full tool output\n* `false`: you see truncated summaries of tool output",
+            "default": "`false`"
+        },
+        "viewMode": {
+            "summary": "Start every session in [default, verbose, or focus view](https://code.claude.com/docs/en/cli-reference#cli-flags)",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#viewmode",
+            "about": "Set the transcript view Claude Code starts in: `\"default\"`, `\"verbose\"`, or `\"focus\"`. When set, it overrides both the sticky `/focus` selection and the [`verbose`](https://code.claude.com/docs/en/settings-reference#verbose) setting.",
+            "type": "string, one of:\n* `\"default\"`: the normal transcript with truncated tool output\n* `\"verbose\"`: the transcript with full tool output\n* `\"focus\"`: only your last prompt, a one-line summary of tool calls with edit diffstats, and the final response. Focus view needs the [fullscreen renderer](https://code.claude.com/docs/en/settings-reference#tui)",
+            "default": "unset, so the `verbose` setting and your last `/focus` choice apply"
+        },
+        "vimInsertModeRemaps": {
+            "summary": "Map a two-key [INSERT-mode sequence](https://code.claude.com/docs/en/interactive-mode#remap-insert-mode-key-sequences) such as `jj` to Escape",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#viminsertmoderemaps",
+            "about": "Map two-key INSERT-mode sequences to Escape in [vim editor mode](https://code.claude.com/docs/en/interactive-mode#vim-editor-mode). Each key is exactly two printable characters typed in sequence, and `\"<Esc>\"` is the only supported target; Claude Code ignores other entries. Requires Claude Code v2.1.208 or later.",
+            "type": "object mapping a two-character sequence to `\"<Esc>\"`",
+            "default": "unset"
+        },
+        "voice": {
+            "summary": "Turn on [voice dictation](https://code.claude.com/docs/en/voice-dictation) and pick hold or tap mode",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#voice",
+            "about": "Turn on [voice dictation](https://code.claude.com/docs/en/voice-dictation) and choose how the dictation key behaves. Claude Code writes this object for you when you run `/voice`.",
+            "type": "object with `enabled` as a Boolean, `autoSubmit` as a Boolean that applies in hold mode only, and `mode`, one of:\n* `\"hold\"`: you hold the dictation key while speaking and release it to stop\n* `\"tap\"`: you tap the key once to start recording and again to send",
+            "default": "unset, so dictation is off; when `enabled` is `true` and `mode` is unset, Claude Code uses `\"hold\"`"
+        },
+        "voiceEnabled": {
+            "summary": "Turn on [voice dictation](https://code.claude.com/docs/en/voice-dictation) with the older single-key form",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#voiceenabled",
+            "about": "**Warning:** Deprecated since v2.1.92, when the [`voice`](https://code.claude.com/docs/en/settings-reference#voice) object replaced it. Claude Code still reads it so older settings files keep working, but new configurations should set `voice.enabled`.\n\nTurn voice dictation on with the single Boolean form that predates the `voice` object. When both are set, `voice.enabled` applies.",
+            "type": "Boolean\n* `true`: voice dictation is on when you're logged in with a claude.ai account and your organization's policy allows voice, unless `voice.enabled` is set\n* `false`: voice dictation is off, unless `voice.enabled` is set",
+            "default": "unset"
+        },
+        "wheelScrollAccelerationEnabled": {
+            "summary": "Turn off [mouse-wheel acceleration](https://code.claude.com/docs/en/fullscreen#mouse-wheel-scrolling) in fullscreen rendering",
+            "category": "Interface and terminal",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#wheelscrollaccelerationenabled",
+            "about": "Accelerate mouse-wheel scroll speed during fast scrolls in [fullscreen rendering](https://code.claude.com/docs/en/fullscreen#mouse-wheel-scrolling). Set it to `false` for a constant scroll rate per wheel notch.",
+            "type": "Boolean\n* `true`: Claude Code accelerates mouse-wheel scroll speed during fast scrolls\n* `false`: Claude Code scrolls at a constant rate per wheel notch",
+            "default": "`true`"
+        },
+        "workflowKeywordTriggerEnabled": {
+            "summary": "Let the word `ultracode` in a prompt start a [workflow](https://code.claude.com/docs/en/workflows); set `false` to type it without starting one",
+            "category": "Hooks and automation",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#workflowkeywordtriggerenabled",
+            "about": "Choose whether typing the keyword `ultracode` in a prompt triggers a [dynamic workflow](https://code.claude.com/docs/en/workflows#ask-for-a-workflow-in-your-prompt). Set it to `false` to type the word without triggering one.",
+            "type": "Boolean\n* `true`: typing `ultracode` in a prompt triggers a dynamic workflow\n* `false`: you can type the word without triggering one",
+            "default": "`true`"
+        },
+        "workflowSizeGuideline": {
+            "summary": "Set the agent count Claude aims for in [dynamic workflows](https://code.claude.com/docs/en/workflows)",
+            "category": "Hooks and automation",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#workflowsizeguideline",
+            "about": "Set the [agent count Claude aims for](https://code.claude.com/docs/en/workflows#set-a-size-guideline) in the dynamic workflows it writes. Claude Code sends the value to Claude as advice, not an enforced cap: `\"small\"` asks for fewer than 5 agents, `\"medium\"` fewer than 10, and `\"large\"` fewer than 50. Choose `\"small\"` when you want to bound what a workflow spends. Requires Claude Code v2.1.219 or later.",
+            "type": "string, one of:\n* `\"unrestricted\"`: no guideline, so Claude sizes the workflow to the task\n* `\"small\"`: Claude aims for fewer than 5 agents\n* `\"medium\"`: Claude aims for fewer than 10 agents\n* `\"large\"`: Claude aims for fewer than 50 agents",
+            "default": "`\"medium\"`, or `\"small\"` when you're signed in on a Pro plan with Claude Code v2.1.271 or later"
+        },
+        "worktree": {
+            "summary": "Configure how Claude Code creates git [worktrees](https://code.claude.com/docs/en/worktrees)",
+            "category": "Agents, sessions, and worktrees",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#worktree",
+            "about": "Configure how Claude Code creates and manages [git worktrees](https://code.claude.com/docs/en/worktrees) for `--worktree`, the `EnterWorktree` tool, and isolated subagents and background sessions.",
+            "type": "object with `baseRef`, `symlinkDirectories`, `sparsePaths`, and `bgIsolation`",
+            "default": "unset"
+        },
+        "worktree.baseRef": {
+            "summary": "Branch new [worktrees](https://code.claude.com/docs/en/worktrees) from the remote default branch or your local HEAD",
+            "category": "Agents, sessions, and worktrees",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#worktree-baseref",
+            "about": "Choose which ref new worktrees branch from. `\"fresh\"` branches from `origin/<default-branch>` for a clean tree matching the remote; `\"head\"` branches from your current local `HEAD`, so unpushed commits and feature-branch state are present in the worktree.",
+            "type": "string, one of:\n* `\"fresh\"`: new worktrees branch from `origin/<default-branch>`\n* `\"head\"`: new worktrees branch from your current local `HEAD`, including unpushed commits",
+            "default": "`\"fresh\"`"
+        },
+        "worktree.bgIsolation": {
+            "summary": "Let background sessions edit the working copy without a [worktree](https://code.claude.com/docs/en/worktrees)",
+            "category": "Agents, sessions, and worktrees",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#worktree-bgisolation",
+            "about": "Choose how [background sessions](https://code.claude.com/docs/en/agent-view#how-file-edits-are-isolated) isolate their file edits. If you moved a session to the background with `←` or `/background`, that session edits files in place whatever this key says. With `\"worktree\"`, Claude Code blocks `Edit` and `Write` in the main checkout until the session calls `EnterWorktree`; with `\"none\"`, background jobs edit the working copy directly. Set `\"none\"` for a repository where git worktrees are impractical.",
+            "type": "string, one of:\n* `\"worktree\"`: Claude Code blocks `Edit` and `Write` in the main checkout until the session calls `EnterWorktree`\n* `\"none\"`: background jobs edit the working copy directly",
+            "default": "`\"worktree\"`"
+        },
+        "worktree.location": {
+            "summary": "Choose where [Desktop SSH sessions](https://code.claude.com/docs/en/desktop#ssh-sessions) create their worktrees on a remote machine",
+            "category": "Agents, sessions, and worktrees",
+            "scopes": ["user"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#worktree-location",
+            "about": "Choose the folder on a remote machine where [Desktop SSH sessions](https://code.claude.com/docs/en/desktop#choose-where-ssh-session-worktrees-go) create their worktrees, instead of `<project-root>/.claude/worktrees/`. Only the desktop app reads this key: `--worktree`, the `EnterWorktree` tool, isolated subagents, and background sessions ignore it. Requires Claude Desktop v1.44121.0 or later.",
+            "type": "string, an absolute path or one that starts with `~/`",
+            "default": "unset, so worktrees go inside the project"
+        },
+        "worktree.sparsePaths": {
+            "summary": "Check out only the directories you need in each [worktree](https://code.claude.com/docs/en/worktrees)",
+            "category": "Agents, sessions, and worktrees",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#worktree-sparsepaths",
+            "about": "Check out only the listed directories in each worktree through git sparse-checkout. Claude Code writes only those directories plus root-level files to disk, which is faster in large monorepos; see [Check out only the directories you need](https://code.claude.com/docs/en/large-codebases#check-out-only-the-directories-you-need).",
+            "type": "array of strings, directory paths relative to the repository root",
+            "default": "unset, so each worktree checks out the whole tree"
+        },
+        "worktree.symlinkDirectories": {
+            "summary": "Symlink large directories into each [worktree](https://code.claude.com/docs/en/worktrees) instead of duplicating them",
+            "category": "Agents, sessions, and worktrees",
+            "scopes": ["managed", "user", "project", "local"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#worktree-symlinkdirectories",
+            "about": "Symlink directories from the main repository into each worktree so you don't duplicate large directories on disk.",
+            "type": "array of strings, directory paths relative to the repository root",
+            "default": "unset, so Claude Code symlinks no directories"
+        },
+        "wslInheritsWindowsSettings": {
+            "summary": "Have WSL read [managed settings](https://code.claude.com/docs/en/managed-settings) from the Windows policy chain",
+            "category": "Enterprise and managed settings",
+            "scopes": ["managed"],
+            "docs": "https://code.claude.com/docs/en/settings-reference#wslinheritswindowssettings",
+            "about": "Have Claude Code on WSL read managed settings from the Windows policy chain, with HKLM and the Windows managed settings file taking priority over `/etc/claude-code` and HKCU below it. While the chain is on, Claude Code reads `/etc/claude-code` only when [no Windows admin document is present](https://code.claude.com/docs/en/managed-settings#present-admin-documents) in the HKLM registry value or the `C:\\Program Files\\ClaudeCode\\` folder. Set it to extend the policy you already deploy on Windows to WSL sessions on the same machine, so they follow the same rules as host sessions. Claude Code honors it only when set in the HKLM registry key or in a managed settings file or drop-in under `C:\\Program Files\\ClaudeCode\\`, both of which require Windows admin to write.",
+            "type": "Boolean\n* `true`: Claude Code on WSL reads managed settings from the Windows policy chain, and reads `/etc/claude-code` only when no Windows admin document is present\n* `false`: WSL reads only `/etc/claude-code`",
+            "default": "`false`, so WSL reads only `/etc/claude-code`"
+        }
+    }
+}