ug/ucode hard-fails on macOS when the user lacks admin rights (cannot write /Library/Application Support/ClaudeCode/managed-settings.json)

[deepak-databricks]

Summary

PR #415 ("Reconcile Claude OS-managed settings", merged 2026-09-01) introduced a
privileged write to the OS-managed Claude Code settings path during interactive
configure. On managed macOS machines where the user has no local admin
rights (a standard enterprise security policy), this hard-fails and blocks the
launch entirely. There is no admin-free path: the non-interactive mode does not
degrade gracefully — it refuses outright. This is a regression for users who
previously ran ucode successfully before this feature shipped.

Regression / when it changed

• Worked before: earlier ucode versions did not write OS-scope managed settings.
• Broke: PR Reconcile Claude OS-managed settings #415 (2026-09-01) added src/ucode/managed_files.py, which runs
  sudo mkdir -p, sudo cp, sudo chown/chmod, and immutable-flag commands to
  install /Library/Application Support/ClaudeCode/managed-settings.json.
  Companion PR Manage Codex settings at OS scope #416 did the same for Codex at /etc/codex/managed_config.toml.
• This shipped in the same version stream as the ug rename (Introduce ug command and Phase 1 migration path #458, Prepare repository references for Unity Gateway rename #489), so
  users experience it as "upgraded to ug → broke", but the root cause is the
  Reconcile Claude OS-managed settings #415 OS-managed-settings feature.

Environment

• OS: macOS (MDM/JAMF-managed fleet)
• CLI: ug (post-Reconcile Claude OS-managed settings #415 unity-gateway CLI)
• Auth: Databricks AI Gateway — auth succeeds
• User privilege: standard user, no admin rights (org security policy)
• Shell: interactive terminal

Steps to reproduce

1. macOS machine where the user is not a local admin and cannot elevate via sudo.
2. /Library/Application Support/ClaudeCode/managed-settings.json is not
   already present (not pre-provisioned by MDM).
3. Run ug claude.

Actual behavior

Auth and gateway connection succeed, then:

✔ Databricks auth already available for https://.azuredatabricks.net
✔ Unity AI Gateway connected
• Enter password to configure settings for Claude Code.

Application requires administrative privileges
Justification:
Execution blocked: does not have Admin rights

ERROR Claude Code cannot start because ucode could not update
/Library/Application Support/ClaudeCode/managed-settings.json:
Command '['/usr/bin/sudo', 'mkdir', '-p', '/Library/Application Support/ClaudeCode']'
returned non-zero exit status 1.. Run the ucode command from an interactive
terminal and approve the administrator prompt, or contact your administrator.

The launch aborts. The user cannot proceed.

Why non-interactive mode is not a workaround

src/ucode/managed_files.py refuses the sudo write when non-interactive rather
than falling back to user scope:

• Refusing to invoke sudo for managed settings non-interactively.
• Refusing to update <agent> managed settings at <path> non-interactively.

So a no-admin user is blocked either way — interactively (denied sudo prompt) or
non-interactively (hard refusal). The README statement that "non-interactive and
CI runs use local files without invoking sudo" does not translate into a working
launch for a no-admin machine.

Expected behavior

On a machine where sudo/admin is unavailable, ug should degrade gracefully:
fall back to user-scoped configuration delivery, warn that OS-managed-settings-only
enforcement is skipped, and still launch the interactive session — rather than
aborting. No-admin, MDM-managed fleets are a mainstream enterprise configuration.

Requests

1. Graceful degradation (primary): when the OS-managed write is unavailable
   or denied, fall back to user-scoped delivery + warning and continue the
   launch, instead of aborting.
2. Supported skip switch: provide a documented env var / flag to opt out of
   the OS-managed-settings write on machines that deliver it via MDM, so users
   never hit the sudo path. Document it in the "Managed Local Files" section.
3. MDM pre-provisioning guidance: document the supported way for IT to
   pre-deploy /Library/Application Support/ClaudeCode/managed-settings.json
   (and the Codex /etc/codex/managed_config.toml from Manage Codex settings at OS scope #416) via MDM/JAMF —
   including what the template must contain so the reconcile/drift check treats
   it as satisfied and skips the sudo write on every launch, and how per-user
   values (OTEL / gateway routing) are handled in that model.

Impact

Complete blocker for any standard (no-admin) macOS fleet. A regression for users
who ran ucode successfully before #415.