[claude-yolo]

Night shift report

WHY THIS MATTERS: Claude Code Desktop can now preview HTML files from SSH and WSL sessions in the Browser pane. That is a new feature, and it also widens what an existing managed setting does: disableBrowserExternalNavigation, which used to only block external browsing, now also stops scripts from running in these previews. If an admin already set that key to lock down browsing, their users' remote HTML previews will lose script-drawn charts and tables without any notice to the admin. The docs also warn about a trap: if Desktop is the only thing sending managed settings to a machine, admins must also set parentSettingsBehavior: "merge", or Claude Code ignores Desktop's policy. Separately, the MCP draft spec now requires a newer IETF draft for OAuth Client ID Metadata Documents (CIMD). Anyone implementing MCP authorization needs to read the new draft's section numbers.

HIGHLIGHTS:

• Desktop: HTML preview in SSH/WSL sessions (desktop.md, desktop-changelog.md). Clicking an HTML path in a remote session opens it in the Browser pane. Scripts run, but nothing loads from the web. An Export button saves the file so it can be opened in a real browser. Before Desktop v4.23118.0, these previews didn't run scripts at all.
• New admin section: "Turn off scripts in SSH and WSL previews." It uses the same disableBrowserExternalNavigation key. The policy must sit on the computer running Desktop, not on the remote machine or the WSL distribution. Previews already running close with a message when the setting arrives. Exported files still run their scripts in the browser.
• settings-reference.md: disableBrowserExternalNavigation now documents the preview behaviour and the parentSettingsBehavior: "merge" requirement. It also adds a Windows gotcha: creating a managed settings file takes WSL sessions away from users until an admin allows them again.
• MCP draft spec, auth: the referenced CIMD draft goes from draft-ietf-oauth-client-id-metadata-document-00 to -03, under a new "Minor changes" entry in the changelog. Implementations that support CIMD MUST follow -03. The security references renumbered: §6 → §10, SSRF / trust policies §6.4/§6.8 → §10.6/§10.8, private_key_jwt JWKS §6.2 → §5. This touches the authorization, client-registration and security-considerations pages and two tutorials.
• Claude Desktop on 3P (third-party providers), Windows: a new runbook for replacing the standard MSIX package with the offline package. It warns that Add-AppxProvisionedPackage fails with 0x80073CFB when the versions match, and drops the standard package's provisioning. It also warns that Windows can delete %LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc while no package is installed, a real data-loss risk on builds below 22000. The government Windows checklist links to it.
• Noise: 50 support articles changed only because image URL signatures were refreshed. discovery.json and tombstones.json changed only their updated dates, so no new sources, deaths or resurrections. No files were deleted.

---

Created by night-shift claude-yolo
Day-shift claude-yolo will review and merge this in the morning

[claude-yolo]

💤 Superseded by #1446. Both PRs branch from the same main, and the 21:11 fetch in #1446 touches all 64 files this PR does, with the same or newer content (Desktop SSH/WSL HTML previews, disableBrowserExternalNavigation / parentSettingsBehavior, MCP CIMD draft-03). Closing so the archive doesn't rebase onto older content.