docs: Claude Code v2.1.322 - Compliance API Security posture, fast mode on Vertex, Trusted/Custom fold into Limited, safety_event OTel dropped

content/claude/claude-science/command-line-settings.md

@@ -24,7 +24,7 @@ claude-science serve starts Claude Science and opens the web app in your browser
 | `claude-science sandbox approve` | Linux only, version 0.1.71 or later. Approve your own copy of bubblewrap or socat for the sandbox. `--bwrap <path>` and `--socat <path>` name the programs, `--yes` skips the confirmation and is required when no terminal is attached, and `--remove` (alone, or with `--bwrap` or `--socat` and no path) removes the approval. Stop Claude Science first. See [Approve your own copy of bubblewrap or socat](https://claude.com/docs/claude-science/run-on-remote-linux-server.md#approve-your-own-copy-of-bubblewrap-or-socat). |
 | `claude-science sandbox status` | On Linux, version 0.1.71 or later, print which bubblewrap and socat the next start would try, the system's first, then yours. |
 | `claude-science install` | Windows only. Install the app for your user account, with a PATH entry, a Start menu shortcut, and an uninstall entry under Windows **Settings > Apps > Installed apps**. Run it again to repair them. |
-| `claude-science uninstall` | Windows only. Remove the app, its shortcuts, and its PATH entry while keeping your data; `--purge` also deletes the data directory. Quit Claude Science first. |
+| `claude-science uninstall` | Windows only. Remove the app, its shortcuts, and its PATH entry while keeping your data. `--purge` also permanently deletes your whole data directory, even if you moved it, with your projects, your conversation history, and any files of your own in it. It doesn't ask you to confirm. Quit Claude Science first. See [Uninstall Claude Science](https://claude.com/docs/claude-science/get-started.md#uninstall-claude-science). |
 | `claude-science --version` | Print the version. |
 | `claude-science <command> --help` | Print help for any command. |
 

content/claude/claude-science/get-started.md

@@ -102,11 +102,11 @@ After sign-in, a setup wizard walks you through enabling connectors and skills,
 
 ## Uninstall Claude Science
 
-Uninstalling removes the application and keeps your data folder. Your projects, artifacts, and conversation history stay on your computer until you delete that folder.
+Uninstalling removes the application and keeps your data folder. Your projects, artifacts, and conversation history stay on your computer until you delete that folder or, on Windows, run `claude-science uninstall --purge`.
 
 > [!WARNING]
 >
-> Deleting the data folder (`~/.claude-science`, or `%USERPROFILE%\.claude-science` on Windows) removes all your projects, artifacts, conversation history, environments, and settings, and signs you out. Copy anything you want to keep first, with **Download** on an artifact or by copying the project's folder from inside the data folder.
+> Deleting the data folder (`~/.claude-science`, or `%USERPROFILE%\.claude-science` on Windows) removes all your projects, artifacts, conversation history, environments, and settings, and signs you out. You can't restore your work from your Claude account, so copy any files you want to keep before you delete the folder. Use **Download** on an artifact, or copy the project's folder from inside the data folder. Conversations aren't in a project's folder. To keep them, don't delete the data folder or the folder shown under **Settings > Storage > Data location**.
 >
 > Before you uninstall, check where your data is under **Settings > Storage > Data location**. If it shows a folder other than the default, the default folder still holds your environments and your sign-in, and it can also hold projects from before that location was set. To remove all your data:
 >
@@ -139,11 +139,13 @@ Uninstalling removes the application and keeps your data folder. Your projects,
 >
 > **2. Uninstall the app**
 >
-> In Windows **Settings**, go to **Apps > Installed apps** and uninstall **Claude Science**, or run `claude-science uninstall` in a terminal.
+> In Windows **Settings**, go to **Apps > Installed apps** and uninstall **Claude Science**, or run `claude-science uninstall` in a terminal. Both keep your data.
 >
-> To remove the app and your data together, use `claude-science uninstall --purge` instead. It deletes the whole folder your data location points to, including anything you stored there yourself, so move those files out first.
+> > [!WARNING]
+> >
+> > `claude-science uninstall --purge` removes the app and permanently deletes your projects, artifacts, and conversation history, along with everything else in the folder that **Data location** shows, including your own files. It doesn't ask you to confirm, and the files don't go to the Recycle Bin. To keep your work, leave out `--purge`.
 >
-> When your data location isn't `%USERPROFILE%\.claude-science`, `--purge` leaves that folder in place. It still holds your environments and your sign-in, and it can also hold projects from before that location was set. To remove those too, delete `%USERPROFILE%\.claude-science` yourself.
+> When your data location isn't `%USERPROFILE%\.claude-science`, `--purge` leaves `%USERPROFILE%\.claude-science` in place. It still holds your environments and your sign-in, and it can also hold projects from before that location was set. To remove those too, delete `%USERPROFILE%\.claude-science` yourself.
 
 > [tab] Linux
 >

content/claude/claude-science/manage-on-devices.md

@@ -19,11 +19,15 @@ Authentication tokens and the shared package environment live under the default
 
 On Windows and macOS, the program is in these places:
 
-* **Windows**: the program itself installs per user to `%LOCALAPPDATA%\Programs\ClaudeScience` and registers under the signed-in user's **Settings** > **Apps** > **Installed apps** rather than machine-wide. The app also writes launch logs and state to `%LOCALAPPDATA%\ClaudeScience` and keeps a sandbox state folder under `%LOCALAPPDATA%`, and it unpacks components it runs, such as the app window engine and the sandbox launcher, under the data folder, so allow-listing by path needs both the program folder and the data folder. Uninstalling removes the program and sandbox state; `claude-science uninstall --purge` also removes the data and state folders.
+* **Windows**: the program itself installs per user to `%LOCALAPPDATA%\Programs\ClaudeScience` and registers under the signed-in user's **Settings > Apps > Installed apps** rather than machine-wide. The app also writes launch logs and state to `%LOCALAPPDATA%\ClaudeScience` and keeps a sandbox state folder under `%LOCALAPPDATA%`, and it unpacks components it runs, such as the app window engine and the sandbox launcher, under the data folder, so allow-listing by path needs both the program folder and the data folder. Uninstalling from Windows **Settings**, with `claude-science uninstall`, or with the uninstall entry's `QuietUninstallString` removes the program and sandbox state and keeps the data directory and `%LOCALAPPDATA%\ClaudeScience`.
 * **macOS**: the app is **Claude Science** in the **Applications** folder, or in the **Applications** folder inside the member's home folder. When Claude Science opens in a browser tab, it runs its program from a copy at `~/.claude-science/bin/claude-science`. When it opens in its own window, it runs the program from inside the app. In its own window, Claude Science also keeps window settings, logs, and the window's page storage, which includes unsent message drafts, in `~/Library/Application Support/Claude Science` (see [Macs where Claude Science opens in its own window](#macs-where-claude-science-opens-in-its-own-window)).
 
 Your endpoint tooling governs these folders the same way it governs any other local application data. Anthropic doesn't host a copy of these folders, so Custom Data Retention and Org Data Export don't reach them. [How Claude Science works with your data](https://claude.com/docs/claude-science/how-claude-science-works-with-your-data.md) covers what Anthropic does receive from the app, including the session transcripts available to Enterprise organizations with the Compliance API enabled.
 
+> [!WARNING]
+>
+> On Windows, `claude-science uninstall --purge` removes the program and deletes the data directory and `%LOCALAPPDATA%\ClaudeScience`, with everything in them, without asking to confirm. If the data directory was moved, it's deleted where it is now, and the default data folder stays. Leave `--purge` out of removal scripts unless you want to delete the member's work.
+
 ## Deploy configuration with device management
 
 To set configuration keys organization-wide, deploy the per-member config.toml (at the path given under [Where the app stores data](#where-the-app-stores-data)) through your MDM or endpoint tool. Claude Science doesn't read its settings from a system-level managed-preferences file or registry policy keys, so there's no native MDM configuration channel on any operating system. Deploying the per-member config.toml is the supported approach. The sandbox network allowlist and the package mirror can instead be set once for every member under **Organization settings** > **Claude Science** (see [Organization settings](https://claude.com/docs/claude-science/admin-controls.md#organization-settings)). The keys most relevant to admins are:

content/claude/claude-tag/admins/audit.md

@@ -10,16 +10,17 @@
 >
 > Claude Tag is in public beta. Features and behavior described here may change before general availability.
 
-Use this page to review what Claude Tag is doing across your organization: which routines are scheduled, what memory it has saved, and where to find a record of each action it took.
+Use this page to review what Claude Tag is doing across your organization: which routines are scheduled, what memory it has saved, and where to find records of its actions.
 
 The **Activity** page opens for Owners of your Claude organization. The other trails on this page are visible to anyone with access to the underlying surface.
 
-Claude Tag activity is auditable in four places:
+Claude Tag activity is auditable in these places:
 
 * **[The Activity page](#what-the-activity-page-lists)** in admin settings, with tabs for scheduled work, memory, and network events
 * **Memory files** for each workspace, and for each channel that has memory of its own (open the workspace's or channel's page from the **Channels** tab under **Claude's access**, then choose **View memory files** from its **⋯** menu, if the menu lists it), where you can review what Claude has saved
 * **[Attribution on each action](#trace-an-action-to-its-source)** Claude takes in a connected tool
 * **[The audit logs of each connected service](#trace-an-action-to-its-source)**, where its actions appear under the service account you provisioned
+* **[Session transcripts](#read-claude-tag-session-transcripts)**, which you read through the Compliance API on the Enterprise plan
 
 ## What the Activity page lists
 
@@ -29,9 +30,19 @@ To open the **Activity** page, go to [`claude.ai/admin-settings/claude-tag/audit
 | :- | :- |
 | **Scheduled work** | The routines set up in channels across your organization, with a **Scope** filter and a per-row **⋮** menu with actions such as **View details**, **Pause** or **Resume**, and **Delete** |
 | **Memory** | Each scope's memory files, where you can read what Claude has saved for that workspace or channel. Owners can also edit or delete entries there. |
-| **Network events** | An hourly JSON export of the outbound requests Claude made through [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy). Git and MCP traffic are not included. Select a date and hour to download. |
+| **Network events** | A best-effort hourly JSON export of the outbound requests Claude made through [Agent Proxy](https://claude.com/docs/claude-tag/concepts/agent-identity.md#agent-proxy). Git and MCP traffic are not included, and [other requests can be missing](#what-the-network-events-export-can-miss). Select a date and hour to download. |
 
-Each routine on the **Scheduled work** tab shows **Created by** (the member who set it up) in its **View details** dialog. There is no per-action log of every task and who asked; for that, use the trails below.
+Each routine on the **Scheduled work** tab shows **Created by** (the member who set it up) in its **View details** dialog. There is no per-action log of every task and who asked. To follow up on one action, see [Trace an action to its source](#trace-an-action-to-its-source).
+
+### What the network events export can miss
+
+The export on the [**Activity** page's](https://claude.ai/admin-settings/claude-tag/audit) **Network events** tab is best effort. A request can go through without an entry in the export, so a missing entry doesn't show that Claude didn't make the request.
+
+To find out whether Claude made a request to a connected service, check [that service's audit log](#trace-an-action-to-its-source) as well as the export. On the Enterprise plan with the [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api-access) enabled, also check the [session's transcript](#read-claude-tag-session-transcripts), which includes Claude's tool calls and their results.
+
+## Read Claude Tag session transcripts
+
+If your organization is on the Enterprise plan and has the [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api-access) enabled, you can [list Claude Tag sessions and read their transcripts](https://platform.claude.com/docs/en/manage-claude/compliance-sessions#retrieve-remote-sessions) through the API. A transcript includes the text of prompts, Claude's responses, and tool calls with their results.
 
 ## Trace an action to its source
 
@@ -41,7 +52,7 @@ In channels, Claude acts as itself unless a task uses a member's [personal conne
 * **On code**, commits and pull requests show the Claude GitHub App as the author, and each one links back to the Slack thread it came from.
 * **In every other connected service**, actions appear under the service account you created for the connector.
 
-That last one is the general-purpose trail: because you provisioned the credential, the connected service's audit log shows everything Claude did there, under an account your security team already monitors.
+That last one is the general-purpose trail: because you provisioned the credential, the connected service's audit log shows Claude's actions under an account your security team already monitors.
 
 ## See what's scheduled in a channel
 

content/claude/claude-tag/admins/network-requirements.md

@@ -49,6 +49,10 @@ The IP allowlist on your service and the [allowed websites](https://claude.com/d
 
 Events from connected services, like GitHub activity, are delivered directly to Anthropic, so there is no inbound listener to configure on your side.
 
+## IP allowlist and tenant restrictions for your Claude organization
+
+Your Claude organization's [IP allowlist](https://platform.claude.com/docs/en/manage-claude/ip-allowlist) and [tenant restrictions](https://support.claude.com/en/articles/13198485-enforce-network-level-access-control-with-tenant-restrictions), available on the Enterprise plan, don't cover the messages people send Claude in Slack. For the reason, see [Controls that aren't available](https://claude.com/docs/claude-tag/admins/restrict-access.md#controls-that-aren%E2%80%99t-available).
+
 ## Related resources
 
 * [Add connections](https://claude.com/docs/claude-tag/admins/add-connections.md#set-allowed-websites): the allowed-websites setting (the other direction: what Claude is allowed to reach)

content/claude/claude-tag/admins/restrict-access.md

@@ -545,6 +545,7 @@ These are controls an admin might look for that Claude Tag doesn't have.
 * **A web search toggle for channels.** No setting turns web search off for channel sessions; the web search capability setting in claude.ai admin settings governs claude.ai chat, not channels. Web search runs on Anthropic's servers rather than from the channel sandbox, so Domains entries and egress settings don't govern it, and a search opens no new path out of the sandbox; search requests travel to Anthropic the same way the session's model traffic already does. See [Web search vs. network requests](https://claude.com/docs/claude-tag/concepts/agent-identity.md#web-search-vs-network-requests).
 * **A switch to turn workspace search off.** Claude can search public channels by keyword the same way any Slack user can; it can't read a channel's full history unless it's been added there. No setting turns workspace search off. The [**Channels Claude can search**](#limit-which-channels-claude-can-search) setting narrows it to channels Claude is in. No setting enables search in [channels that include guests](#restrict-guest-channels), where it's unavailable.
 * **Session length enforcement.** Your organization's Slack session-length policy is not enforced on this surface.
+* **IP allowlist and tenant restrictions for Slack messages.** Your Claude organization's [IP allowlist](https://platform.claude.com/docs/en/manage-claude/ip-allowlist) and [tenant restrictions](https://support.claude.com/en/articles/13198485-enforce-network-level-access-control-with-tenant-restrictions), available on the Enterprise plan, don't cover the messages people send Claude in Slack. Those messages reach Anthropic from Slack's servers rather than from the sender's network. Both controls still apply to your organization on claude.ai, for example when an Owner changes Claude Tag settings. To limit who can message Claude in Slack, see [Restrict who can use Claude](#restrict-who-can-use-claude).
 
 ## Related resources
 

content/claude/claude-tag/concepts/security-and-data.md

@@ -116,6 +116,8 @@ By default, anyone in a connected Slack workspace can invoke Claude in channels,
 
 See [Restrict who can use Claude](https://claude.com/docs/claude-tag/admins/restrict-access.md#restrict-who-can-use-claude). The restriction governs DMs as well as channels.
 
+Your Claude organization's [IP allowlist](https://platform.claude.com/docs/en/manage-claude/ip-allowlist) and [tenant restrictions](https://support.claude.com/en/articles/13198485-enforce-network-level-access-control-with-tenant-restrictions), available on the Enterprise plan, don't cover the messages people send Claude in Slack. For the reason, see [Controls that aren't available](https://claude.com/docs/claude-tag/admins/restrict-access.md#controls-that-aren%E2%80%99t-available).
+
 ## Related resources
 
 * [How agent identity works](https://claude.com/docs/claude-tag/concepts/agent-identity.md): the identity model in full, including DM attribution