[BUG] Setting only disableAutoUpdates locks Cowork and third-party inference panes as org-managed (macOS com.anthropic.claudefordesktop)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

On macOS, deploying a managed-preferences profile to the com.anthropic.claudefordesktop domain with only disableAutoUpdates set causes the Cowork and third-party inference settings panes to render greyed out with "This configuration is managed by your organisation, contact your IT administrator" — even though no key governing those panes (secureVmFeaturesEnabled, etc.) is configured.
Enforcement scope appears to be the entire preference domain rather than per-key. The presence of any one managed key flips all governed panes into their org-managed locked state, regardless of which key was set.

Environment:
macOS 26.5
Claude Desktop 1.9659.1
MDM: Jamf Pro, delivered as a configuration profile to the com.anthropic.claudefordesktop domain

What Should Happen?

Only auto-update behavior should be enforced. The Cowork and third-party inference panes should remain user-controllable, since no key governing them was set. Enforcement should be per-key: a pane should only show as org-managed when a key actually governing that pane is configured — not because an unrelated key (disableAutoUpdates) exists in the domain.

Error Messages/Logs

N/A — no error output; UI behavior only.

Steps to Reproduce

1. Deploy a configuration profile to the com.anthropic.claudefordesktop

preference domain (via Jamf Pro) with a single key:

   <key>disableAutoUpdates</key>
   <true/>

1. Confirm only that key is present:

defaults read /Library/Managed\ Preferences/com.anthropic.claudefordesktop
Output shows disableAutoUpdates = 1; and no other keys.

1. Open Claude Desktop → Settings → Cowork / third-party inference connections.
2. Both panes render greyed out with "This configuration is managed by your

organisation, contact your IT administrator," despite no key governing
those panes being set.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Claude Desktop 1.9659.1 (n/a — Claude for Desktop bug, not CLI)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

defaults read confirms only one key is present (payload type is a correct
plist boolean, not an integer):

$ defaults read /Library/Managed\ Preferences/com.anthropic.claudefordesktop
{
disableAutoUpdates = 1;
}

Requested fix: per-key enforcement scope (see "What Should Happen?").

<img width="1625" height="713" alt="Image" src="https://github.com/user-attachments/assets/8906858f-f8cb-4788-a68f-0c2e038dc046" />