--restricted strips code execution from Claude Code 2.1.248

Claude Code 2.1.248 introduces --restricted, a mode that removes the built-in tools able to run commands or code, along with WebFetch unless it is named in --tools. The flag, also available as CLAUDE_CODE_RESTRICTED=1, heads the release notes published on Github.

At a glance

• In restricted mode the file tools stay inside the working directory, bypassPermissions is refused, and user, project and local settings files are ignored; agent frontmatter separately gains experimental.cacheTtl, set to 5m or 1h.
• A prompt-cache miss that hit roughly once an hour in long sessions is fixed: tool definitions were being re-rendered after an OAuth token refresh, which also dropped extended-thinking context.
• The Workflow tool's description now costs about 1k tokens instead of 5.7k, with its script-writing reference moved into a bundled workflow-authoring skill; server-managed settings failures now raise a startup warning explained in /doctor and /status.

Restricted mode reads as an answer to the standard hazard of pointing an agent at unfamiliar code: the settings files carried inside a repository are the obvious lever for widening what a session can touch, and ignoring them alongside the execution tools leaves reading and writing files under a single directory. The caching fixes address a quieter cost, since each miss in a long session means the whole prompt, tool definitions included, is processed again uncached.

Restricted mode ignores user, project and local settings files

The flag removes the built-in tools that run commands or code, and WebFetch unless it is named in --tools. File tools remain available but are confined to the working directory, bypassPermissions is refused, and the user, project and local settings files are ignored. CLAUDE_CODE_RESTRICTED=1 has the same effect.

Server-managed settings gain diagnostics: a startup warning when they fail to load, and a line in /doctor and /status explaining the failure or why they were never fetched, as happens on Bedrock, Vertex, a third-party provider or with a custom ANTHROPIC_BASE_URL. Client-side timeout, MCP startup-mode and stream-watchdog environment variables no longer trigger the managed settings approval prompt.

/web-setup now warns when the GitHub CLI token lacks the workflow scope, since pushes to very large repositories can be rejected without it. The self-hosted runner accepts --client-label or SELF_HOSTED_RUNNER_CLIENT_LABEL to override the label it registers with, which defaults to the hostname.

Tool definitions re-rendered after a token refresh cost a cache miss every hour

A prompt cache miss occurred roughly once an hour in long sessions because tool definitions were re-rendered after an OAuth token refresh, which also lost extended-thinking context. A second miss hit the first turn of a resumed session when the ScheduleWakeup tool definition changed between the original session and its --resume after the account entered usage overage.

The Workflow tool's description drops to about 1k tokens from 5.7k, with the script-writing reference moved into a bundled workflow-authoring skill. Agent frontmatter accepts experimental.cacheTtl of 5m or 1h, a per-agent prompt cache TTL used when no subagent TTL setting is configured.

The prompt-footer PR badge now polls GitHub less often while the pull request is unchanged, and a push or a gh pr command still refreshes it immediately. /usage-credits becomes available to Enterprise organizations billed through AWS Marketplace, self-serve Enterprise and Enterprise trials, and rate-limit, usage and fast-mode messages stop pointing at it where DISABLE_EXTRA_USAGE_COMMAND hides it.

/ultrareview no longer uploads uncommitted .tfvars files or swap copies of credentials

/ultrareview and locally seeded cloud sessions were uploading uncommitted edits to prod.env-style and *.tfvars files, and to editor swap, temp and backup copies of credential files such as key.pem.tmp and id_rsa.swo; those files now stay on the machine. Separately, /ultrareview with a PR number checks before launch that the GitHub account connected to the Claude account can access the repository.

Claude Desktop and Cowork sessions were disappearing after 30 days; transcript cleanup now keeps desktop-written sessions while they are in the app unless org policy manages retention, and the new desktopSessionCleanupPeriodDays setting caps that exemption. Opening a stopped session already resumed in another terminal no longer starts a second process; the row reports it is open in a terminal.

Cross-session messaging (SendMessage, ListAgents) now works between sessions on the same machine on Bedrock, Vertex and Foundry, and with telemetry disabled. It falls back to a private per-user /tmp directory when the default one cannot be used, and /status names the directory to fix.

What changes for /loop and agent view

In the agent view dispatch input, shift+enter now inserts a newline and ctrl+enter dispatches and attaches, matching the prompt. /loop offers self-paced dynamic mode and the no-prompt autonomous default everywhere, including on Bedrock, Vertex and Foundry. The per-agent cache TTL stays under an experimental namespace, and the notes set no timetable for it becoming a supported setting.