Claude Desktop 3.6556.1 shipped on 22 October with Claude Code 2.1.308 bundled. A 3.6556.2 followed the same day with no user-facing changes. The weight of this release sits in the Code section and in the connectors.
SSH hosts that come from a command of your own
New in the macOS and Linux apps: SSH connections whose host is supplied by your own command. You add an entry with id, name and command under sshHostCommands in your Claude Code settings, then pick “Create” with that name in the environment menu. Third-party deployments do not get it.
The allowlist tightens at the same time. On SSH hosts, an entry in allowedWorkspaceFolders only counts if it is a full path for that host — ~/work rather than work, on Windows C:\work rather than \work. A symlink sitting inside a listed folder drops out; list the folder it points to instead. And read-only entries holding an unset or unsupported %VAR% turn the surrounding folder read-only, or every allowed folder if the variable starts the entry.
Then there is the change you will actually feel. A folder’s permission mode is now stored separately for this computer, for each SSH host and for each WSL distribution. Folders that were set to “Bypass permissions” start back in their default mode until you pick it again and confirm.
Claude can type in the iOS Simulator
In the simulator Claude can now press keys such as Return, Delete and the arrows, rotate the device, and show or hide the on-screen keyboard. Also fixed: the cloud environment editor, which lost, changed or reordered environment variables and added backslashes whenever a value mixed both kinds of quote or contained backslashes.
Cowork loses a slash command
/schedule is gone from the slash menu. Typing it now fills in a request to schedule the task, the same as the button does. Fixed: Claude could not find your plugins and skills in scheduled tasks or in tasks that were not open on screen. MCP tools their server marks as needing a person now ask only on the in-app card — the notification has no Allow button, and scheduled tasks carry on without those calls.
The connectors ask more often
The built-in GitHub connector now asks before every call of issue_write, sub_issue_write, pull_request_review_write, add_reply_to_pull_request_comment and five further write tools that toolsets can enable. An exact toolPolicy key, or *, still allows them. For actions_run_trigger it asks regardless of what toolPolicy says, though you can still block it there. The Microsoft 365 connector asks once more for reading files, messages and folders, including where “Always allow” had been chosen.
Managed installs gain installedUpdateEnforcementEnabled and installedUpdateEnforcementHours, plus quickEntryScreenshotsEnabled and quickEntryFileSharingEnabled on macOS, which let admins switch off screenshots and attaching the file open in another app. And the usage page now shows cached tokens, read and written, per tab.
The extra prompts are not a step backwards
Three of these changes take back permissions people had already granted: bypass folders, GitHub write access, Microsoft 365 read access. That is inconvenient and correct. I wrote about the seven SSH changes marked as breaking in the previous version two days ago, and together they form a pattern: Anthropic is cleaning up permission handling, and doing it faster than the features grow.