What
In a restricted session, file tools now refuse paths outside the working directory with a dedicated message, and an unsafe path is marked as not approvable rather than offering the usual classifier-based approval prompt. Restricted sessions also lose the leniency that remote mode previously granted to the path safety check.
Details
- The safety check is now asked whether the session is remote and not restricted, rather than just remote; the artifact database read path picks this up when saving fetched documents into an output directory.
- Same
--restrictedflag as elsewhere; no server-side gate.
Evidence
--restricted confines the file tools to the working directory.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundle--restricted
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up --restricted, on Tools reference.
* A permissions [deny rule](/docs/en/permissions#match-all-uses-of-a-tool), the `--disallowedTools` flag, or [`--restricted`](/docs/en/cli-reference#cli-flags) removes `Bash` from the session.tools-reference see the edit
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up --restricted, on Tools reference.
Anthropic's release notes agree
Added --restricted (or CLAUDE_CODE_RESTRICTED=1): removes the built-in tools that run commands or code and WebFetch (unless named in…
The name it cites is new in this build
New in this build: --restricted