{"name":"--restricted","slug":"restricted","family":"cli","title":"CLI flags","noun":"CLI flag","description":"Start in restricted mode. Use it when an evaluation harness drives `claude` on a shared machine and Claude Code must not run commands or read that machine's user and project settings. Claude Code removes the built-in tools that run commands or code, and WebFetch, unless you name them individually in `--tools`, not through the `default` preset. It also confines the built-in file tools to the [working directories](\/docs\/en\/permissions#working-directories), loads only [managed settings](\/docs\/en\/managed-settings) and `--settings`, refuses [`bypassPermissions`](\/docs\/en\/permission-modes#skip-all-checks-with-bypasspermissions-mode), and [refuses to create cloud sessions](\/docs\/en\/errors#cloud-sessions-cannot-be-created-from-a-restricted-session). Requires Claude Code v2.1.248 or later","description_source":"docs","described_by":{"doc":"claude-code\/cli-reference","title":"CLI reference"},"presence":{"first_seen":"2.1.248","removed_in":null,"in_current_build":true,"newest_mined":"2.1.308","builds":51,"mined_builds":149,"first_cited":{"version":"2.1.248","released_at":"2026-08-27 20:35:36","spans":9}},"aliases":[],"entries":[{"version":"2.1.300","anchor":"restricted-help-text-no-longer-names-repl","heading":"Help for --restricted no longer lists REPL among the removed tools","line":"The help text for `--restricted` drops REPL from its list of code-running tools that restricted mode removes","released_at":"2026-10-14 14:27:26","reason":"found in this entry's text, named in this entry"},{"version":"2.1.295","anchor":"new-claude-code-restrict-personal-config-env-var-recognized","heading":"New CLAUDE_CODE_RESTRICT_PERSONAL_CONFIG mode restricts your own Claude Code files","line":"Setting `CLAUDE_CODE_RESTRICT_PERSONAL_CONFIG` starts a session that restricts your own Claude Code files, alongside the other restricted modes","released_at":"2026-10-08 18:22:58","reason":"found in this entry's text"},{"version":"2.1.292","anchor":"attachment-path-checks-now-stat-and-open-using-the-validated","heading":"Attached files are checked again to be the exact path that was approved","line":"Under `--restricted` or the read block, an attached file must open at the same path that was approved, closing a gap through links swapped mid-read","released_at":"2026-10-06 17:10:31","reason":"found in this entry's text, named in this entry"},{"version":"2.1.290","anchor":"attachment-paths-are-displayed-in-a-normalized-form-in-error","heading":"Attachment error messages show the file path in a tidied form","line":"Errors about attachment paths now show a tidied version of the path instead of exactly what was typed","released_at":"2026-10-05 18:12:44","reason":"found in this entry's text, named in this entry"},{"version":"2.1.290","anchor":"safe-mode-is-now-evaluated-lazily-and-uses-the-same-check","heading":"--safe-mode is now checked the same way as --restricted","line":"The `--safe-mode` flag now goes through the same check as `--restricted` and `--strict-mcp-config`, run when it is needed","released_at":"2026-10-05 18:12:44","reason":"found in this entry's text, named in this entry"},{"version":"2.1.287","anchor":"plugin-install-replace-now-has-an-error-message-requiring","heading":"plugin install --replace explains that it needs a full plugin id","line":"Running `plugin install --replace` without a name@marketplace id now says that id is needed and that nothing was installed","released_at":"2026-10-01 16:59:25","reason":"found in this entry's text"},{"version":"2.1.281","anchor":"background-handoff-carries-added-directories-and-extra-dispa","heading":"Background handoff carries added directories and extra dispatch args","line":"Sending a session to the background with the left arrow now carries your added directories and more launch arguments","released_at":"2026-09-23 17:01:17","reason":"found in this entry's text"},{"version":"2.1.257","anchor":"new-settings-key-to-confine-file-reads-to-trusted-working-di","heading":"New settings key to confine file reads to trusted working directories","line":"Reads outside your working directories can be made to fail closed, with a prompt option that persists the setting.","released_at":"2026-09-01 17:15:33","reason":"found in this entry's text, named in this entry"},{"version":"2.1.248","anchor":"new-restricted-session-mode","heading":"New --restricted session mode","line":"New --restricted flag starts a locked-down session with no shell tools and no settings files.","released_at":"2026-08-27 20:35:36","reason":"named in this entry, found in this entry's text"},{"version":"2.1.248","anchor":"restricted-sessions-drop-implicit-file-allowances-and-cannot","heading":"Restricted sessions drop implicit file allowances and cannot be talked out of a denial","line":"Restricted sessions drop implicit file allowances, and a denial can't be argued away.","released_at":"2026-08-27 20:35:36","reason":"named in this entry, found in this entry's text"}],"entries_total":18,"docs":[{"source":"claude-code","path":"cli-reference","title":"CLI reference","documented":true},{"source":"claude-code","path":"agent-view","title":"Manage multiple agents with agent view","documented":false},{"source":"claude-code","path":"changelog","title":"Claude Code changelog","documented":false},{"source":"claude-code","path":"errors","title":"Error reference","documented":false},{"source":"claude-code","path":"permission-modes","title":"Choose a permission mode","documented":false},{"source":"claude-code","path":"permissions","title":"Configure permissions","documented":false},{"source":"claude-code","path":"tools-reference","title":"Tools reference","documented":false},{"source":"claude-code","path":"whats-new\/2026-w35","title":"Week 35 \u00b7 August 24\u201328, 2026","documented":false},{"source":"claude-code","path":"whats-new\/index","title":"What's new","documented":false}],"docs_total":9,"gates":[],"related":[],"url":"https:\/\/changelogs.core-directive.com\/reference\/cli\/restricted","family_url":"https:\/\/changelogs.core-directive.com\/reference\/cli.json"}