Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.248 Home All releases ←olderv2.1.247 v2.1.250newer→
Claude Code v2.1.248

New --restricted session mode

Use it now
Useful5 Signal5
Permissions Notable

New --restricted flag starts a locked-down session with no shell tools and no settings files.

--restrictedCLAUDE_CODE_RESTRICTED--tools
What

A new command-line flag, also settable as the environment variable CLAUDE_CODE_RESTRICTED=1, starts a locked-down session that drops the built-in tools which run commands or code (Bash, PowerShell, REPL) plus WebFetch unless --tools names them, confines the file tools to the working directories, refuses bypassPermissions, and loads no user, project or local settings files. Neither the flag nor the variable existed in 2.1.247, and nothing gates it: pass it and it applies, leave it off and the session behaves as before.

Details
  • Registered as a normal CLI option and also read straight off the process arguments by the early argv scan during settings load, so it takes effect from the very start of launch on any invocation, not just commands that register it.
  • Managed settings and an explicit --settings file still apply; the rest of the setting-sources list is emptied.
  • Writes to settings, git and tool-configuration files require explicit approval.
  • Attachments outside the working directory are rejected, and cloud sessions are blocked outright.
  • The restriction latches onto the launch options and is re-emitted when Claude Code rebuilds its own argv, respawns itself or launches helper sessions, so relaunches and child sessions stay restricted.
  • Denials name the mode: --restricted: path outside the working directory from the file tools, and bypassPermissions not supported in restricted mode.
  • The dispatch command carries the one registered option description, "Start dispatched sessions in restricted mode".
  • Startup telemetry records a restricted field, the cloud-session capability table lists restricted as a tool restriction, and the SDK counts restricted among the options that mark a launch as non-default.
Usage
claude --restricted
CLAUDE_CODE_RESTRICTED=1 claude
Evidence

restricted: le,, --restricted: path outside the working directory, bypassPermissions not supported in restricted mode, CLAUDE_CODE_RESTRICTED, ...(n.restricted ? ["--restricted"] : []),, Start dispatched sessions in restricted mode, strictMcpConfig: !1,, Restricted mode: removes the built-in tools that run commands or code

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.248 →