You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
PermissionsArea: what it touches
New FeaturesKind: in v2.1.248,
New FeaturesSection of the release
What
Starting a new background session from a session that was itself launched with --restricted now passes --restricted to the child. Previously the child started unrestricted.
Details
Decided by the parent's own launch options; if the parent was not restricted, nothing changes.
Evidence
restrictedSession()
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed sinceAnthropic's documentation has since written up --restricted, on Tools reference.* A permissions [deny rule](/docs/en/permissions#match-all-uses-of-a-tool), the `--disallowedTools` flag, or [`--restricted`](/docs/en/cli-reference#cli-flags) removes `Bash` from the session.tools-referencesee the edit
How sure we are
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agreesAnthropic's documentation has since written up --restricted, on Tools reference.
Anthropic's release notes agreeAdded --restricted (or CLAUDE_CODE_RESTRICTED=1): removes the built-in tools that run commands or code and WebFetch (unless named in…
The name it cites is new in this buildNew in this build: --restricted
