[BUG] Apps gateway desktop overlay has no `chatTabEnabled` key, so bootstrap-configured Claude Desktop permanently loses the Chat tab (rejected at boot through 2.1.221)

What's Wrong?

The apps gateway's managed.policies[].desktop overlay can control two of Claude Desktop's three tabs — coworkTabEnabled and isClaudeCodeForDesktopEnabled — but there is no chatTabEnabled key. Adding one fails gateway boot:

"message": "Unrecognized key(s) in object: 'chatTabEnabled'"

Because the bootstrap response is authoritative and read-only, and Desktop's own chatTabEnabled has no default (unlike its two siblings, which default to true), the result is that pointing Claude Desktop at a gateway via bootstrapUrl silently and permanently removes the Chat tab, with no configuration on either side that can restore it:

• The gateway can't send chatTabEnabled — the strict schema rejects it at boot.
• A local chatTabEnabled: true in the user's config library is discarded once the bootstrap overlay applies (bootstrap values "override local settings and become read-only").

So a Desktop user who was using Chat loses it the moment they're onboarded to a gateway, and the admin has no lever. Only Cowork and Code remain.

Verified this is not version lag — the key is rejected by every currently published release, including the latest:

| Gateway binary | desktop: { chatTabEnabled: true } |
|---|---|
| 2.1.218 | Rejected at boot |
| 2.1.219 | Rejected at boot |
| 2.1.220 | Rejected at boot |
| 2.1.221 (latest) | Rejected at boot |
| 2.1.221, key removed (control) | Passes schema, boots normally |

chatTabEnabled has existed in Claude Desktop since build 1.13576.0 (I'm on 1.24012.11), and there is no chatTabEnabled entry anywhere in CHANGELOG.md.

What Should Happen?

chatTabEnabled should be accepted in the desktop overlay alongside coworkTabEnabled and isClaudeCodeForDesktopEnabled, so all three tabs are administrable and a gateway deployment doesn't remove a surface the user previously had.

Failing that, either:

• the gateway should pass chatTabEnabled through as an open key (Desktop validates it), or
• Desktop should default chatTabEnabled to true when the bootstrap overlay omits it, matching the other two tab keys, so an unspecified key means "unchanged" rather than "off".

The config reference describes these keys as "Show or hide individual tabs" and lists only the two, which reads as complete coverage; it should note that Chat can't be controlled, if that's intended.

Error Messages/Logs

claude gateway: [
  {
    "code": "unrecognized_keys",
    "keys": [
      "chatTabEnabled"
    ],
    "path": [
      "managed",
      "policies",
      0,
      "desktop"
    ],
    "message": "Unrecognized key(s) in object: 'chatTabEnabled'"
  }
]

Steps to Reproduce

A. Gateway rejects the key (no cloud account or Desktop needed):

1. Minimal gw.yaml — note the desktop block on the catch-all policy:

listen: { host: 127.0.0.1, port: 8099, public_url: https://x.example.com }
oidc: { issuer: https://example.okta.com, client_id: abc, client_secret: shhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh, allowed_email_domains: [example.com] }
session: { jwt_secret: "0123456789012345678901234567890123456789012", ttl_hours: 1 }
store: { postgres_url: "postgres://127.0.0.1:5999/nope?sslmode=disable" }
upstreams: [ { provider: bedrock, region: us-east-1, auth: {} } ]
managed:
  policies:
    - match: {}
      cli: { availableModels: [claude-haiku-4-5] }
      desktop:
        banner: { enabled: true, text: "probe" }
        chatTabEnabled: true

1. claude gateway --config gw.yaml → fails with the unrecognized_keys error above.
2. Delete the chatTabEnabled line and re-run → the schema passes (it then fails on the deliberately unreachable Postgres, which proves the rejection was specific to that key).

B. Chat tab disappears in practice:

1. Deploy a gateway whose match: {} policy carries a desktop block (e.g. desktop: {}) so /user/bootstrap serves.
2. In Claude Desktop's config, set bootstrapUrl to <public_url>/user/bootstrap. Note that the local config had chatTabEnabled: true.
3. Restart Desktop and sign in through the gateway.
4. Only Cowork and Code tabs appear; Chat is gone, and no setting restores it.

Is this a regression?

No — as far as I can tell the key has never been supported in the gateway overlay.

Environment

• Claude Code / gateway: 2.1.221 (also reproduced on 2.1.218, 2.1.219, 2.1.220)
• Claude Desktop: 1.24012.11
• macOS 26.6 (arm64)
• Upstream: Amazon Bedrock