{
  "baselineVersion": 1,
  "appVersion": "1.20186.0",
  "agentVersion": "2.1.202",
  "agentBinary": {
    "stagedPath": "~/Library/Application Support/Claude/claude-code-vm/2.1.202/claude",
    "format": "elf-aarch64",
    "nativeStagedPath": "~/Library/Application Support/Claude/claude-code/2.1.205/claude.app/Contents/MacOS/claude",
    "sha256": "de5e0bb28e2b32409444ed4c1431e2931001c05ed270a3dc96c6706b0693867f",
    "shaProvenance": "measured-local",
    "manifestChecksumMatch": true
  },
  "guest": {
    "os": "linux",
    "arch": "arm64",
    "baseImage": "ubuntu:22.04"
  },
  "spawn": {
    "configDirInGuest": "mnt/.claude",
    "settingSources": [
      "user"
    ],
    "permissionMode": "default",
    "maxThinkingTokens": 31999,
    "effortDefault": "medium",
    "effortByModel": {
      "claude-haiku-4-5": {
        "modes": [
          "extended"
        ]
      },
      "claude-sonnet-4-5": {
        "modes": [
          "extended"
        ]
      },
      "claude-sonnet-4-6": {
        "effortLevels": [
          "low",
          "medium",
          "high",
          "max"
        ],
        "recommended": "low",
        "modes": [
          "auto"
        ]
      },
      "claude-opus-4-6": {
        "effortLevels": [
          "low",
          "medium",
          "high",
          "max"
        ],
        "recommended": "medium",
        "modes": [
          "extended"
        ]
      },
      "claude-opus-4-7": {
        "effortLevels": [
          "low",
          "medium",
          "high",
          "xhigh",
          "max"
        ],
        "recommended": "xhigh",
        "modes": [
          "auto"
        ]
      },
      "claude-opus-4-8": {
        "effortLevels": [
          "low",
          "medium",
          "high",
          "xhigh",
          "max"
        ],
        "recommended": "high",
        "modes": [
          "auto"
        ]
      }
    },
    "effortRegexDefault": {
      "pattern": "^(?:claude-)?(?:fable|mythos)(?:-|$)",
      "effortLevels": [
        "low",
        "medium",
        "high",
        "xhigh",
        "max"
      ],
      "recommended": "high",
      "modes": [
        "auto"
      ],
      "disallowThinkingDisabled": true
    },
    "tools": [
      "Task",
      "Bash",
      "Glob",
      "Grep",
      "Read",
      "Edit",
      "Write",
      "NotebookEdit",
      "WebFetch",
      "TaskCreate",
      "TaskUpdate",
      "TaskGet",
      "TaskList",
      "TaskStop",
      "WebSearch",
      "Skill",
      "REPL",
      "JavaScript",
      "AskUserQuestion",
      "ToolSearch"
    ],
    "allowedTools": [
      "Task",
      "Bash",
      "Glob",
      "Grep",
      "Read",
      "Edit",
      "Write",
      "NotebookEdit",
      "WebFetch",
      "TaskCreate",
      "TaskUpdate",
      "TaskGet",
      "TaskList",
      "TaskStop",
      "WebSearch",
      "Skill",
      "REPL",
      "JavaScript",
      "ToolSearch"
    ],
    "env": {
      "CLAUDE_CODE_IS_COWORK": "1",
      "CLAUDE_CODE_ENTRYPOINT": "local-agent",
      "CLAUDE_CODE_TAGS": "lam_session_type:chat",
      "CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST": "1",
      "CLAUDE_CODE_ENABLE_ASK_USER_QUESTION_TOOL": "true",
      "CLAUDE_CODE_DISABLE_CRON": "1",
      "CLAUDE_CODE_DISABLE_BACKGROUND_TASKS": "1",
      "CLAUDE_CODE_DISABLE_AGENTS_FLEET": "1",
      "CLAUDE_CODE_ENABLE_APPEND_SUBAGENT_PROMPT": "1",
      "CLAUDE_CODE_ENABLE_TASKS": "true",
      "CLAUDE_CODE_DISABLE_TERMINAL_TITLE": "1",
      "ENABLE_PROMPT_CACHING_1H": "1",
      "DISABLE_MICROCOMPACT": "1",
      "MCP_CONNECTION_NONBLOCKING": "true",
      "API_TIMEOUT_MS": "900000",
      "CLAUDE_CODE_EMIT_TOOL_USE_SUMMARIES": "",
      "CLAUDE_CODE_ENABLE_FINE_GRAINED_TOOL_STREAMING": "1",
      "DISABLE_AUTOUPDATER": "1",
      "MCP_TOOL_TIMEOUT": "60000",
      "USE_LOCAL_OAUTH": "",
      "USE_STAGING_OAUTH": ""
    },
    "promptTemplate": "prompts/desktop-1.18286.0/system-prompt-append.md",
    "subagentAppend": "prompts/desktop-1.15200.0/subagent-append-vm.md",
    "subagentAppendHostLoop": "prompts/desktop-1.18286.2/subagent-append-hl.md",
    "$comment": "Binary-verified Desktop->agent spawn contract, re-derived per release. spawn.env is GENERATED by deriveSpawnEnv() in src/sync/cowork-sync.ts (windowed enumeration of the asar env construction + gate/const value resolution); the scalar options, tools/allowedTools, and prompt-asset pointers are sentinel-guarded by checkSpawnContractFacts(). Do not hand-edit spawn.env — re-run sync.",
    "$comment_handPinned": "Why the NON-env spawn fields stay hand-pinned: each is built in the asar as a non-literal expression (a session-path template, a session-type ternary, a const indirection, or a head+spread+tail array), so the windowed-enumeration generator that derives spawn.env cannot construct their VALUES without a full JS evaluator; instead each value was binary-verified once and is drift-guarded by a checkSpawnContractFacts() sentinel (cowork-sync.ts) that re-asserts the asar-side FACT at every sync. Scope caveat: the sentinels make DESKTOP-side drift loud; they do not validate this committed JSON itself — an erroneous hand-edit here is invisible to them.",
    "$comment_configDirInGuest": "Hand-pinned: the asar builds it as a per-session path template (/sessions/${id}/mnt/.claude), not a constructable literal. Sentinel S1 pins the template shape.",
    "$comment_settingSources": "Hand-pinned: sentinel S2 pins the settingSources:[\"user\"] literal.",
    "$comment_permissionMode": "Hand-pinned: the asar computes it via a session ternary whose chat-session branch resolves to \"default\". Sentinel S3 pins the ternary shape.",
    "$comment_maxThinkingTokens": "Hand-pinned: the asar reaches the value through const indirection. Sentinel S4 VALUE-pins the resolved const to 31999.",
    "$comment_effortDefault": "Hand-pinned: sentinel S5 pins the .effort … :\"medium\" default.",
    "$comment_tools": "Hand-pinned: the asar builds tools[] as head-list + Task-tools spread + session-type tail, not one literal. Sentinels S6 (head), S7 (the TaskCreate…TaskStop spread), S8 (tail-guard after ToolSearch) pin all three parts.",
    "$comment_allowedTools": "Hand-pinned: same head+spread+tail construction as tools[], minus AskUserQuestion (tools-only by design). Sentinels S9 (head) and S10 (the built-in→mcp__ boundary tail-guard) pin it.",
    "$comment_promptTemplate": "Hand-pinned pointer to a RECONSTRUCTED asset (see $comment_prompts) — the generator cannot extract prose. Sentinel S15 pins the claude_code preset-append delivery site.",
    "$comment_subagentAppend": "Hand-pinned pointer to a reconstructed asset (see $comment_prompts). Sentinel S16 pins the per-session appendSubagentSystemPrompt generator call shape.",
    "$comment_notSet": "Deliberately NOT set: CLAUDE_CODE_USE_COWORK_PLUGINS (Desktop never sets it; would flip the agent to cowork_settings.json/cowork_plugins — asserted absent by the S17 negative invariant). Enumerated-but-not-pinned keys are enforced by SPAWN_ENV_ALLOWLIST in src/sync/cowork-sync.ts, each with a reason; categories: host-derived (CLAUDE_CONFIG_DIR, TZ, HOST_PLATFORM, OAUTH_TOKEN/BASE_URL/CUSTOM_HEADERS, account UUIDs, WORKSPACE_HOST_PATHS, OTEL), constructed-then-deleted (ANTHROPIC_API_KEY/AUTH_TOKEN via FnA), gate-conditional-off (MCP_CONNECT_TIMEOUT_MS, ENABLE_TOOL_SEARCH, SKIP_PRECOMPACT_LOAD), non-chat/project-session (BRIEF*, PROJECT*), user-settings (SUBAGENT_MODEL, AUTO_COMPACT_WINDOW, ...), and 3p-provider-only branches. The opaque ...g.env/...l session spreads are the known static-extraction blind spot (runtime lane backstop).",
    "$comment_prompts": "Reconstructed cowork-specific sections, re-paraphrased from asar 1.18286.0 const aui (system prompt; RESTRUCTURED at this release — see the asset header) and 1.15200.0 generator CVr (subagent; verified unchanged in the 1.18286.0 asar, generator Zgn). Not the full base prompt (not cleanly extractable); generic refusal/safety policy elided. Delivered via --append-system-prompt (layered on the agent's built-in base prompt), NOT the initialize handshake; only the subagent append goes over initialize (appendSubagentSystemPrompt), gated on CLAUDE_CODE_ENABLE_APPEND_SUBAGENT_PROMPT."
  },
  "mountLayout": {
    "sessionRoot": "/sessions/{sessionId}",
    "cwd": "/sessions/{sessionId}",
    "mntRoot": "/sessions/{sessionId}/mnt",
    "mounts": [
      {
        "name": "uploads",
        "mountPath": "uploads",
        "mode": "r",
        "purpose": "user-uploaded files (read-only — asar 'ro')"
      },
      {
        "name": "projects",
        "mountPath": ".projects/{projectId}",
        "mode": "rw",
        "purpose": "RESERVED namespace (and the separate UUID project-sync feature) — NOT the work-folder path. From Desktop 1.14271.0 selected work folders mount at mnt/<collision-resolved-basename> (dynamic, derived per session by buildLaunchPlan; see MOUNT_BARE_NAME_MIN_VERSION). This decorative row is not consumed for binding (staged paths come from plan.mounts)."
      },
      {
        "name": "local-plugins",
        "mountPath": ".local-plugins/marketplaces",
        "mode": "r",
        "purpose": "marketplace skills/plugins, runtime-discovered"
      },
      {
        "name": "remote-plugins",
        "mountPath": ".remote-plugins",
        "mode": "r",
        "purpose": "org-remote plugins, runtime-discovered"
      },
      {
        "name": "outputs",
        "mountPath": "outputs",
        "mode": "rw",
        "purpose": "session outputs/artifacts — delete denied by default (asar IX); rwd only when approved"
      },
      {
        "name": "skills",
        "mountPath": ".claude/skills",
        "mode": "r",
        "purpose": "personal/saved skill doc bodies (NOT plugin-bundled skills, which live under local-plugins/remote-plugins above) — real VM confirmed via systemd unit sessions-<name>-mnt-.claude-skills.mount in vm_bundles/claudevm.bundle/rootfs.img. Decorative row like 'projects' above (not consumed for binding — resolveMounts()'s mounts[] is destructured away at every call site); the harness reproduces this via CLAUDE_CONFIG_DIR staging (session.ts skill copy + stage.ts cpSync), not a plan.mounts bind — see hostloop-prompt.ts's asar-verified skills bullet."
      }
    ]
  },
  "network": {
    "mode": "gvisor",
    "allowKind": "allowlist",
    "allowDomains": [
      "preview.claude.ai",
      "downloads.claude.ai",
      "api.anthropic.com",
      "a-cdn.anthropic.com",
      "a-api.anthropic.com",
      "assets.claude.ai",
      "sentry.io",
      "console.anthropic.com",
      "api-staging.anthropic.com",
      "www.anthropic.com",
      "api.claude.ai",
      "support.anthropic.com",
      "docs.anthropic.com",
      "mcp-proxy.anthropic.com",
      "pivot.claude.ai"
    ]
  },
  "bgEnvStrip": {
    "knownVars": [
      "CLAUDE_CODE_OAUTH_TOKEN",
      "CLAUDE_CODE_SESSION_KIND",
      "CLAUDE_CODE_SESSION_ID",
      "CLAUDE_CODE_SESSION_NAME",
      "CLAUDE_CODE_SESSION_LOG"
    ]
  },
  "$comment": "Platform baseline auto-derived by `cowork-harness sync` from a live Claude Desktop install + app.asar. VOLATILE per-release facts only. Regenerate per release; review the diff. Captured 2026-07-10 on macOS arm64.",
  "capturedAt": "2026-07-10",
  "platform": "darwin-arm64",
  "settings": {
    "autoMountFolders": {
      "key": "autoMountFolders",
      "default": false
    },
    "localAgentModeTrustedFolders": {
      "key": "localAgentModeTrustedFolders",
      "default": []
    }
  },
  "provenance": {
    "asarPath": "/Applications/Claude.app/Contents/Resources/app.asar",
    "asarFingerprint": "e03da4c2a89f4a85",
    "gates": {
      "$comment": "Production GrowthBook gate states decoded from ~/Library/Application Support/Claude/fcache (standard interactive Anthropic account, 2026-06-13; binary-verified app.asar 1.12603.1). Pin per release. Behavior-affecting gates the harness models: 1143815894 (loop), 1648655587 (dispatch cap), 1978029737 (web_fetch routing). Telemetry/auth-internal gates omitted. Also pinned: 2614807392 (skeletonHome), 123929380 (autoMemoryStandardSessions), 1696890383 (memoryGuidelinesEnv), 2860753854 (memoryExtraGuidelines) — dormant drift-sentinels for dark-launched features (host-fs skeleton, auto-memory) the harness deliberately models as OFF (or, for memoryExtraGuidelines, as inert-default: on in production but its served value equals the hardcoded default); pinned so a production flip surfaces as a sync diff instead of silent drift.",
      "emitToolUseSummaries:66187241": {
        "on": false,
        "source": "defaultValue",
        "value": false
      },
      "autoMemoryStandardSessions:123929380": {
        "on": false,
        "source": "defaultValue",
        "value": false
      },
      "mcpConnectionNonblockingOff:434204418": {
        "on": false,
        "source": "defaultValue",
        "value": false
      },
      "bridgeSdkTransport:583857784": {
        "on": true,
        "source": "force",
        "value": true,
        "note": "— Cowork uses the SDK-based transport (control protocol), confirming the harness's sdkMcpServers/mcp_message path is the production transport."
      },
      "fineGrainedToolStreaming:714014285": {
        "on": true,
        "source": "force",
        "value": true
      },
      "enableToolSearchAuto:1129419822": {
        "on": false,
        "source": "absent"
      },
      "hostLoop:1143815894": {
        "on": true,
        "source": "force",
        "value": true
      },
      "scheduledTaskSessionLimiter:1648655587": {
        "on": true,
        "source": "force",
        "value": {
          "global": 3,
          "perTask": 1
        },
        "note": "SCHEDULED-TASK (cron) session limiter — NOT an in-conversation Task-tool cap (binary-verified 2026-07-04, asar 1.18286.0 class L9t [ScheduledTasks]). perTask=1: <=1 concurrent session PER SCHEDULED TASK; global=3: <=3 concurrent scheduled-task sessions globally (+_pendingTaskDispatches). Host-side SKIP (recordSkipAndEmit/PerTaskLimit|GlobalLimit — NOT queue/deny). Cowork imposes no cap on Task-tool sub-agent fan-out; the harness has no scheduled-task scheduler, so this gate has no applicable surface — pinned as a sync drift-sentinel only."
      },
      "memoryGuidelinesEnv:1696890383": {
        "on": false,
        "source": "defaultValue",
        "value": false
      },
      "oauthScopesEnv:1936081873": {
        "on": true,
        "source": "force",
        "value": true
      },
      "coworkRuntimeConfig:1978029737": {
        "on": true,
        "source": "force",
        "value": {
          "coworkNativeFilePreview": true,
          "coworkWebFetchPrompt": true,
          "coworkWebFetchViaApi": true,
          "sessionsBridgePollBlockMs": 30,
          "workspaceBashWaitLonger": true
        },
        "note": "coworkWebFetchViaApi=true coworkWebFetchPrompt=true workspaceBashWaitLonger=true sessionsBridgePollBlockMs=30 — web_fetch is host/API-routed (POST /api/organizations/<org>/cowork/web_fetch), NOT container egress; gated by a separate web-fetch hostname allowlist + URL provenance."
      },
      "cliPlugin:2307090146": {
        "on": false,
        "source": "defaultValue",
        "value": false,
        "note": "— the CLI-plugin credential broker is dark-launched off for standard interactive accounts (Ch23/L106)."
      },
      "pluginSyncSparkplug:2340532315": {
        "on": true,
        "source": "force",
        "value": true,
        "note": "— startup syncPlugins(); plugins load via --plugin-dir (registry inert in-VM)."
      },
      "skeletonHome:2614807392": {
        "on": false,
        "source": "absent"
      },
      "memoryExtraGuidelines:2860753854": {
        "on": true,
        "source": "defaultValue",
        "value": "## Sensitive personal information\n\nDo not save the following to memory unless the user explicitly asks you to remember it:\n\n- Protected attributes: race, ethnicity, national origin, religion, age, sex, sexual orientation, gender identity, immigration status, disability, serious illness, union membership\n- Government identifiers: Social Security numbers, driver's license numbers, passport numbers, government ID numbers\n- Financial account details: credit card numbers, bank account numbers\n- Health information: medical conditions, diagnoses, lab results, mental health details, therapy or counseling\n- Home or personal mailing addresses (work addresses are fine)\n- Account passwords, secret tokens, or secret keys\n\nIf any of the above appears in conversation context, complete the task but do not persist it to a memory file. If the user explicitly says \"remember my address is X\", saving it is acceptable — they've given consent."
      },
      "skipPrecompactLoad:4153934152": {
        "on": false,
        "source": "defaultValue",
        "value": false
      }
    },
    "eipcChannelUuid": "4f426349-8d6f-45f3-ae22-280fef323564",
    "$comment": "eipcChannelUuid is per-build; recorded for provenance only — the harness does not use Desktop IPC."
  },
  "requireFullVmSandbox": null
}