[FEATURE] Propagate Admin Console settings into Desktop app gVisor VM sandbox for OTel telemetry

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

Summary

The Claude Code Desktop app runs code execution inside a gVisor Linux VM sandbox (a separate ARM64 ELF binary). This VM is fully isolated from the host macOS filesystem, which means settings configured via the Claude.ai Admin Console are never read by the sandboxed process. As a result, enterprise OTel telemetry configuration is silently ignored for all Desktop app sessions.

Expected Behavior

OTel environment variables configured via the Claude.ai Admin Console should be propagated into the VM session environment at launch time, the same way they are picked up by the CLI.

Admins should not need separate configuration paths for CLI vs Desktop app users.

Impact

Any enterprise using the Admin Console to configure OTel telemetry for compliance, cost tracking, or security monitoring has a complete blind spot for all Desktop app sessions.

There is currently no workaround.

Proposed Solution

Proposed Solution

When the Desktop app launches the gVisor VM, propagate environment variables from:

~/.claude/remote-settings.json (synced from Admin Console)

into the VM session environment, so telemetry configuration applies consistently across:

• CLI
• IDE extension (VS Code, IntelliJ, Cursor)
• Desktop app

Alternative Solutions

_No response_

Priority

Critical - Blocking my work

Feature Category

Developer tools/SDK

Use Case Example

Environment

• Claude Code Desktop app (claude-code-vm/2.1.76/claude)
• macOS (confirmed via "coworkNetworkMode": "gvisor" in Desktop app config)
• Enterprise plan with OTel/Datadog telemetry configured via the Claude.ai Admin Console

Current Behavior

1. Admin configures OTel telemetry settings via the Claude.ai Admin Console.

1. These settings are synced to enrolled users' machines as:

~/.claude/remote-settings.json

1. The CLI reads this file correctly — telemetry flows to the collector as expected.

1. The Desktop app launches a gVisor VM with a separate Linux binary. That VM:

• Cannot access the host macOS filesystem
• Never reads ~/.claude/remote-settings.json
• Has no mechanism for the host process to inject env vars into the sandbox
• Produces zero telemetry events in the collector

There is currently no workaround — the isolation is intentional by design.

Additional Context

_No response_