docs: Claude Code v2.1.316 - Message threads API beta, blockWritesOutsideWorkingDirectories, per-team gateway upstreams

content/claude/third-party/claude-desktop/admin-console.md

@@ -35,7 +35,7 @@ Anthropic stores your organization's user accounts and the configuration you sav
 | Data | Does Anthropic store it? |
 | - | - |
 | Prompts, model responses, and tool inputs and outputs | **No.** They go to your inference provider, and tool calls go to the connectors you configure. Data handling at the provider depends on the provider, as described under [Data handling by provider](https://claude.com/docs/third-party/claude-desktop/overview.md#data-handling-by-provider). |
-| Conversation history, projects, memory, and uploaded files | **No.** They stay on the device. |
+| Conversation history, projects, memory, and uploaded files | **No.** They stay on the device. To take them to another device, see [Move a user to a new device](https://claude.com/docs/third-party/claude-desktop/data-storage.md#move-a-user-to-a-new-device). |
 | Provider credentials, API keys, bearer tokens, and MCP secrets | **No**, except the client secret of a Google Desktop-app OAuth client, which Google doesn't treat as confidential. You can enter one for [Google sign-in to your provider](#choose-how-users-authenticate-to-your-provider) or for a [managed MCP server that signs in with Google](https://claude.com/docs/third-party/claude-desktop/mcp-sign-in.md#where-the-client-secret-goes). Everything else stays on the device, and the console refuses to save it. |
 | Plugin and skill content | **No.** It stays in your own repositories or on devices. The console stores marketplace locations and installation settings, not content. |
 | OpenTelemetry export, if you configure a collector | **No.** It goes to your collector only. |
@@ -312,6 +312,38 @@ To remove **Not now**, turn on **Require this organization in Claude Desktop** u
 
 On a device whose managed profile sets an inference provider or bootstrap keys, no prompt appears while the app is open on the profile's configuration. If the profile is complete, this setting doesn't remove the profile from the prompt, as described under [Devices with a managed profile](#devices-with-a-managed-profile).
 
+### Block other accounts in Claude Desktop
+
+To keep personal accounts and other organizations' accounts out of Claude Desktop without device management, turn on the **Block other accounts after a member signs in** switch. After a user uses Claude Desktop signed in to your organization, the app blocks other accounts for that computer login from its next start. The block also applies on personal devices. A blocked person sees a page that reads "This account is not approved by your enterprise admin" and can only log out.
+
+> [!WARNING]
+>
+> The person at the device can [remove the block](#unblock-other-accounts-in-claude-desktop), so the switch doesn't enforce sign-in. To enforce sign-in to your organization, deploy [`forceLoginOrgUUID`](#keep-a-device-on-its-managed-profile) through device management. On a device that has the key, the key's value applies instead of the switch and the **Allowed organizations** list.
+
+Check what the block covers:
+
+* **Accounts that stay allowed**: accounts in your organization and in the organizations on your **Allowed organizations** list. An account in your organization can also be in another organization that has this switch on. Where that account uses Claude Desktop, that organization and the organizations on its list stay allowed too.
+* **Outside the block**: sign-ins outside Claude Desktop, such as claude.ai in a browser and the mobile apps, and other computer logins on the same device. A person can also set up their own inference provider in the app, or use the [Claude API account sign-in](https://claude.com/docs/third-party/claude-desktop/claude-api.md#which-devices-offer-the-claude-api-account-sign-in).
+
+To turn on the block:
+
+1. Check that devices run Claude Desktop 4.29.0 or later. Devices on the [`staggered` release channel](https://claude.com/docs/third-party/claude-desktop/installation#updates) get releases later. Releases 3.6556.1 and 3.6556.2 apply the block but ignore the list, so they also block the organizations on it. Earlier releases ignore the switch.
+2. In the admin console, go to **Desktop sign-in** on the **Connection** page. Turn on the [**Require this organization in Claude Desktop**](#users-in-more-than-one-claude-organization) switch. Without that switch, the block's switch is unavailable.
+3. If people at your company use other Claude organizations, save the list before you turn on the block. Otherwise, a device can block those organizations until it gets the list and restarts. Click **Edit list** in the **Allowed organizations** row. Add each organization's ID on its own line, below your own organization's ID. Click **Copy list**. Then click **Save**.
+4. Turn on the **Block other accounts after a member signs in** switch. Then click **Block other accounts**.
+5. Set up the block in each Claude Enterprise organization on the list too. Without this step, on devices where only that organization's users use Claude Desktop, the block ends about 30 days after your users last used Claude Desktop there.
+   * **With a Connection page**: follow the same steps and paste the same list.
+   * **Without a Connection page**: go to **Organization settings > Organization and access**. Under **Security**, click **Edit list** in the **Allowed organizations** row, paste the same list, and click **Save**. Then turn on the switch above that row and confirm.
+
+#### Unblock other accounts in Claude Desktop
+
+Remove the [block](#block-other-accounts-in-claude-desktop) from every device or from one:
+
+* **Every device**: turn off the **Block other accounts after a member signs in** switch under **Desktop sign-in** on the **Connection** page of the admin console. Each device gets the change when a user next uses Claude Desktop there signed in to your organization. The device removes the block at the start after that, so the change can take two restarts. A removed user's device can't get the change, so remove users after their devices get it.
+* **One device**: ask the person at the device to sign out of your organization, quit Claude Desktop, and delete the `saved-org-lock.json` file from the [application data directory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#where-data-lives). The block returns if a user signs in to your organization there while the switch is on.
+
+The block also ends by itself at the first app start about 30 days after a user last used Claude Desktop on the device signed in to your organization.
+
 ### Configuration updates
 
 From Claude Desktop 1.46388.1, a running app checks for a changed configuration about every 10 minutes, and after the device wakes. Some settings, such as the token limit and the banner, apply to the running app without a relaunch. For any other change, a card in the sidebar counts down to a required restart, and the user has 24 hours to relaunch. When the window ends, the app requires a restart and restarts itself after 2 minutes of inactivity. Earlier releases check about every 30 minutes and allow 1 hour.
@@ -454,6 +486,8 @@ A user returns a device to standard Claude Desktop by choosing **Sign out** from
 
 When you remove a user from the organization, Anthropic revokes their Claude Desktop sign-in to that organization. A running app isn't interrupted. At its next launch the app can no longer download the organization's configuration. It shows either your organization's sign-in screen, where **Return to Claude.ai sign-in** returns the device to standard Claude Desktop, or a **Restart required** prompt whose **Restart** button does the same.
 
+A removed user's device that [blocks other accounts](#block-other-accounts-in-claude-desktop) keeps the block. The block ends about 30 days after the user's last use, or when the person at the device [removes it](#unblock-other-accounts-in-claude-desktop).
+
 > [!NOTE]
 >
 > Removing a user doesn't end their access to your inference provider. To stop model requests from an app that is still running, also end their access at your provider or identity provider.

content/claude/third-party/claude-desktop/data-storage.md

@@ -172,7 +172,7 @@ You can't hide the **Storage** window or the **Low disk space** notice with a co
 
 ## Move a user to a new device
 
-On devices that get their managed configuration from MDM, you can move a user to a new device by copying their data. The copy moves:
+On devices that get their configuration from MDM or from the [Enterprise Admin Console](https://claude.com/docs/third-party/claude-desktop/admin-console.md), you can move a user to a new device by copying their data. The copy moves:
 
 * Chats, Cowork tasks, and Code sessions
 * Projects, project instructions, and memory
@@ -197,7 +197,10 @@ The new device needs:
 
 * The same platform (macOS, Windows, or Linux) and CPU architecture as the old device
 * The same OS user name and home-directory path. Otherwise, Code sessions, scheduled tasks, plugins, and project folders stop working.
-* The managed configuration, with the same [`deploymentOrganizationUuid`](https://claude.com/docs/third-party/claude-desktop/configuration#deploymentorganizationuuid), in place before Claude Desktop launches
+* The same organization as the old device:
+  * **MDM**: the managed configuration, with the same [`deploymentOrganizationUuid`](https://claude.com/docs/third-party/claude-desktop/configuration#deploymentorganizationuuid), in place before Claude Desktop launches
+  * **Enterprise Admin Console**: no managed configuration to deploy. When the app asks the user to sign in to Claude, they use the same account and organization as on the old device.
+* Anything on the device that your configuration relies on for credentials, set up as on the old device. For example, a [credential helper](https://claude.com/docs/third-party/claude-desktop/credential-helper.md) or other helper script, an [AWS named profile](https://claude.com/docs/third-party/claude-desktop/bedrock.md#named-profile), or a [Google Cloud credentials file](https://claude.com/docs/third-party/claude-desktop/vertex.md#credentials-file).
 * The same Claude Desktop version, or a newer one
 
 ### Copy the data to the new device
@@ -206,7 +209,7 @@ The new device needs:
 >
 > The copy holds full conversations. Encrypt any intermediate copy, restrict access to it, and delete it when you're done.
 
-1. Quit Claude Desktop on both devices. Closing its window isn't enough.
+1. Quit Claude Desktop on both devices, without signing out. Closing its window isn't enough.
 2. If the new device has an application-data directory (see [Where data lives](#where-data-lives)), delete it. This removes anything the user created in it.
 3. Copy these to the same paths. On Windows, use a copy tool that supports paths longer than 260 characters.
    * The application-data directory, except these files in it, which the app creates again when it needs them:
@@ -222,9 +225,13 @@ The new device needs:
    * `~/.claude/` and `~/.claude.json`
    * The folders and repositories that the user's projects, scheduled tasks, and Code sessions use
 4. Make the user the owner of the copied files, with read and write access. Give no other user account access to the application-data directory, `~/Claude/` or `~/Documents/Claude/`, `~/.claude/`, or `~/.claude.json`.
-5. Have the user launch Claude Desktop, sign in if the app asks, and confirm that their chats, Cowork tasks, Code sessions, and projects appear. If they don't, check that the managed configuration has the old device's `deploymentOrganizationUuid` and that the user owns the copied files. Soon after launch, a scheduled task runs once if it recently missed a run.
+5. Have the user launch Claude Desktop, sign in if the app asks, and confirm that their chats, Cowork tasks, Code sessions, and projects appear. If any are missing, check that:
+   * The user owns the copied files
+   * The [`ant-did`](#identity) file in the application-data directory has the same contents as on the old device. If it doesn't, start again from step 1.
+   * With MDM, the managed configuration has the old device's `deploymentOrganizationUuid`
+   * With the Enterprise Admin Console, the account menu at the bottom of the sidebar shows the same organization as on the old device. If it shows another name, look for a managed profile that [keeps the device off the admin console](https://claude.com/docs/third-party/claude-desktop/admin-console.md#keep-a-device-on-its-managed-profile). If you find one, remove it, then have the user relaunch Claude Desktop and sign in. Otherwise, have the user choose your organization from the account menu and sign in.
 6. Have the user [set up what the copy doesn't move](#what-the-user-sets-up-again).
-7. If the old device stays in use, its enabled scheduled tasks run on both devices. Retire the old device, or turn off its scheduled tasks in Claude Desktop there. To remove the user's data from it, see [Removing data](#removing-data).
+7. Soon after launch on the new device, a scheduled task runs once if it recently missed a run. If the old device stays in use, its enabled scheduled tasks run on both devices. Retire the old device, or turn off its scheduled tasks in Claude Desktop there. To remove the user's data from it, see [Removing data](#removing-data).
 
 ## Removing data
 

content/en/agents-and-tools/mcp-connector.md

@@ -1302,8 +1302,8 @@ Install both the Anthropic SDK and the MCP SDK:
     <Tabs>
       <Tab title="Gradle">
         ```kotlin
-        implementation("com.anthropic:anthropic-java:3.3.0")
-        implementation("com.anthropic:anthropic-java-mcp:3.3.0")
+        implementation("com.anthropic:anthropic-java:3.4.0")
+        implementation("com.anthropic:anthropic-java-mcp:3.4.0")
         ```
       </Tab>
 
@@ -1312,12 +1312,12 @@ Install both the Anthropic SDK and the MCP SDK:
         <dependency>
             <groupId>com.anthropic</groupId>
             <artifactId>anthropic-java</artifactId>
-            <version>3.3.0</version>
+            <version>3.4.0</version>
         </dependency>
         <dependency>
             <groupId>com.anthropic</groupId>
             <artifactId>anthropic-java-mcp</artifactId>
-            <version>3.3.0</version>
+            <version>3.4.0</version>
         </dependency>
         ```
       </Tab>

content/en/build-with-claude/claude-in-amazon-bedrock.md

@@ -102,8 +102,8 @@ Anthropic’s [client SDKs](https://platform.claude.com/docs/en/cli-sdks-librari
     <Tabs>
       <Tab title="Gradle">
         ```kotlin
-        implementation("com.anthropic:anthropic-java:3.3.0")
-        implementation("com.anthropic:anthropic-java-bedrock:3.3.0")
+        implementation("com.anthropic:anthropic-java:3.4.0")
+        implementation("com.anthropic:anthropic-java-bedrock:3.4.0")
         ```
       </Tab>
 
@@ -112,12 +112,12 @@ Anthropic’s [client SDKs](https://platform.claude.com/docs/en/cli-sdks-librari
         <dependency>
             <groupId>com.anthropic</groupId>
             <artifactId>anthropic-java</artifactId>
-            <version>3.3.0</version>
+            <version>3.4.0</version>
         </dependency>
         <dependency>
             <groupId>com.anthropic</groupId>
             <artifactId>anthropic-java-bedrock</artifactId>
-            <version>3.3.0</version>
+            <version>3.4.0</version>
         </dependency>
         ```
       </Tab>

content/en/build-with-claude/claude-in-microsoft-foundry.md

@@ -80,8 +80,8 @@ Anthropic’s [client SDKs](https://platform.claude.com/docs/en/cli-sdks-librari
     <Tabs>
       <Tab title="Gradle">
         ```kotlin
-        implementation("com.anthropic:anthropic-java:3.3.0")
-        implementation("com.anthropic:anthropic-java-foundry:3.3.0")
+        implementation("com.anthropic:anthropic-java:3.4.0")
+        implementation("com.anthropic:anthropic-java-foundry:3.4.0")
 
         // For Entra ID authentication, also add the Azure Identity library
         implementation("com.azure:azure-identity:1.18.3")
@@ -93,12 +93,12 @@ Anthropic’s [client SDKs](https://platform.claude.com/docs/en/cli-sdks-librari
         <dependency>
             <groupId>com.anthropic</groupId>
             <artifactId>anthropic-java</artifactId>
-            <version>3.3.0</version>
+            <version>3.4.0</version>
         </dependency>
         <dependency>
             <groupId>com.anthropic</groupId>
             <artifactId>anthropic-java-foundry</artifactId>
-            <version>3.3.0</version>
+            <version>3.4.0</version>
         </dependency>
         <!-- For Entra ID authentication, also add the Azure Identity library -->
         <dependency>

content/en/build-with-claude/claude-models-on-google-cloud/anthropic-managed.md

@@ -175,20 +175,20 @@ Install the package that provides the client:
 
   <Tab title="Java">
     ```kotlin Gradle
-    implementation("com.anthropic:anthropic-java:3.3.0")
-    implementation("com.anthropic:anthropic-java-google-cloud:3.3.0")
+    implementation("com.anthropic:anthropic-java:3.4.0")
+    implementation("com.anthropic:anthropic-java-google-cloud:3.4.0")
     ```
 
     ```xml Maven
     <dependency>
       <groupId>com.anthropic</groupId>
       <artifactId>anthropic-java</artifactId>
-      <version>3.3.0</version>
+      <version>3.4.0</version>
     </dependency>
     <dependency>
       <groupId>com.anthropic</groupId>
       <artifactId>anthropic-java-google-cloud</artifactId>
-      <version>3.3.0</version>
+      <version>3.4.0</version>
     </dependency>
     ```
   </Tab>
@@ -521,6 +521,8 @@ The following features work on Claude Models on Google Cloud (Anthropic managed)
 
   * [Prompt caching](https://platform.claude.com/docs/en/build-with-claude/prompt-caching)
   * [Extended thinking](https://platform.claude.com/docs/en/build-with-claude/thinking)
+  * [Adaptive thinking](https://platform.claude.com/docs/en/build-with-claude/thinking#configuring-thinking)
+  * [Effort](https://platform.claude.com/docs/en/build-with-claude/effort)
   * [Server-side fallback](https://platform.claude.com/docs/en/build-with-claude/refusals-and-fallback#server-side-fallback)
   * [Streaming](https://platform.claude.com/docs/en/build-with-claude/streaming)
   * [Structured outputs](https://platform.claude.com/docs/en/build-with-claude/structured-outputs)

content/en/build-with-claude/claude-models-on-google-cloud/google-managed.md

@@ -47,20 +47,20 @@ Anthropic’s [client SDKs](https://platform.claude.com/docs/en/cli-sdks-librari
   <Tab title="Java">
     <CodeGroup exclude="shell, python, typescript, csharp, go, php, ruby">
       ```groovy Gradle
-      implementation("com.anthropic:anthropic-java:3.3.0")
-      implementation("com.anthropic:anthropic-java-vertex:3.3.0")
+      implementation("com.anthropic:anthropic-java:3.4.0")
+      implementation("com.anthropic:anthropic-java-vertex:3.4.0")
       ```
 
       ```xml Maven
       <dependency>
           <groupId>com.anthropic</groupId>
           <artifactId>anthropic-java</artifactId>
-          <version>3.3.0</version>
+          <version>3.4.0</version>
       </dependency>
       <dependency>
           <groupId>com.anthropic</groupId>
           <artifactId>anthropic-java-vertex</artifactId>
-          <version>3.3.0</version>
+          <version>3.4.0</version>
       </dependency>
       ```
     </CodeGroup>

content/en/build-with-claude/claude-on-amazon-bedrock-legacy.md

@@ -58,20 +58,20 @@ Anthropic’s [client SDKs](https://platform.claude.com/docs/en/cli-sdks-librari
   <Tab title="Java">
     <CodeGroup exclude="shell, python, typescript, csharp, go, php, ruby">
       ```groovy Gradle
-      implementation("com.anthropic:anthropic-java:3.3.0")
-      implementation("com.anthropic:anthropic-java-bedrock:3.3.0")
+      implementation("com.anthropic:anthropic-java:3.4.0")
+      implementation("com.anthropic:anthropic-java-bedrock:3.4.0")
       ```
 
       ```xml Maven
       <dependency>
           <groupId>com.anthropic</groupId>
           <artifactId>anthropic-java</artifactId>
-          <version>3.3.0</version>
+          <version>3.4.0</version>
       </dependency>
       <dependency>
           <groupId>com.anthropic</groupId>
           <artifactId>anthropic-java-bedrock</artifactId>
-          <version>3.3.0</version>
+          <version>3.4.0</version>
       </dependency>
       ```