You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
Restricted ModeArea: what it touches
New FeaturesKind: in v2.1.248,
New FeaturesSection of the release
What
File attachments that live outside the working tree are now rejected up front in restricted mode, with the message "--restricted only sends files from inside it." instead of being read and sent.
Details
The check runs before the file is stat'd, so a path outside the tree fails immediately rather than after a filesystem probe.
Only applies when Claude Code is launched with --restricted.
Evidence
--restricted only sends files from inside it.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed sinceAnthropic's documentation has since written up --restricted, on Tools reference.* A permissions [deny rule](/docs/en/permissions#match-all-uses-of-a-tool), the `--disallowedTools` flag, or [`--restricted`](/docs/en/cli-reference#cli-flags) removes `Bash` from the session.tools-referencesee the edit
How sure we are
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agreesAnthropic's documentation has since written up --restricted, on Tools reference.
Anthropic's release notes agreeAdded --restricted (or CLAUDE_CODE_RESTRICTED=1): removes the built-in tools that run commands or code and WebFetch (unless named in…
The name it cites is new in this buildNew in this build: --restricted
