Claude cannot load required remote managed settings

Symptom: install/claude.sh stops at the marketplace inventory with Your organization requires remote managed settings to load, but they could not be loaded.

Root cause: an organization with forceRemoteSettingsRefresh requires a fresh policy fetch before Claude starts. A cached policy does not satisfy that requirement. Authentication commands remain available so the user can sign in again. See server-managed settings.

Confirm with claude plugin marketplace list. For the fetch cause, use a private debug log:

1
umask 077
2
debug_dir=$(mktemp -d "${TMPDIR:-/tmp}/claude-policy.XXXXXX")
3
claude --debug-file "$debug_dir/debug.log" plugin marketplace list

Inspect the Remote settings lines locally. http_401 means the server rejected the credential; claude auth status reporting loggedIn: true alone does not prove the server accepts it. Console API keys are static credentials, while OAuth profiles support automatic token refresh. See authentication.

Fix for an authentication rejection: refresh the sign-in, verify that the inventory loads, then rerun bootstrap:

1
claude auth login
2
claude plugin marketplace list
3
~/dotfiles/bootstrap.sh upgrade

claude auth login opens the supported sign-in flow. For network or policy-delivery failures instead, restore access to api.anthropic.com or contact the organization administrator. Preserve the managed policy and cache; changing them does not repair rejected credentials. The installer checks this prerequisite once and stops before dependent plugin operations if it fails.