You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
PermissionsArea: what it touches
New FeaturesKind: in v2.1.248,
New FeaturesSection of the release
What
Background sessions that Claude Code starts ahead of time, and sessions started by dispatch, now always get --restricted when the parent session is restricted, so restriction is not lost at spawn.
Details
The spare-session pool keeps both the caller's arguments and a copy with --restricted prepended, and hands back the restricted copy while the session is restricted.
Dispatch sites do the same, prepending the flag rather than replacing the argument list.
Evidence
this.#t = e.includes("--restricted") ? e : ["--restricted", ...e]
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed sinceAnthropic's documentation has since written up --restricted, on Tools reference.* A permissions [deny rule](/docs/en/permissions#match-all-uses-of-a-tool), the `--disallowedTools` flag, or [`--restricted`](/docs/en/cli-reference#cli-flags) removes `Bash` from the session.tools-referencesee the edit
How sure we are
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agreesAnthropic's documentation has since written up --restricted, on Tools reference.
Anthropic's release notes agreeAdded --restricted (or CLAUDE_CODE_RESTRICTED=1): removes the built-in tools that run commands or code and WebFetch (unless named in…
The name it cites is new in this buildNew in this build: --restricted
