What
In a --restricted session, a read or write aimed at a path outside the working directory is now denied explicitly instead of falling through to a permission prompt. The denial text is new in this build.
Details
- One helper produces the denial and is wired into both the read decision and the write decision; the write path calls the read decision with the restricted flag forced on.
- The denial reason is mapped to the restricted-mode circuit breaker so repeated attempts are handled as a group.
- Session-level only: it depends on how the session was launched, not on any server-side flag.
Evidence
is outside ${u}; --restricted confines the file tools to the working directory.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundle--restricted
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up --restricted, on Tools reference.
* A permissions [deny rule](/docs/en/permissions#match-all-uses-of-a-tool), the `--disallowedTools` flag, or [`--restricted`](/docs/en/cli-reference#cli-flags) removes `Bash` from the session.tools-reference see the edit
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up --restricted, on Tools reference.
Anthropic's release notes agree
Added --restricted (or CLAUDE_CODE_RESTRICTED=1): removes the built-in tools that run commands or code and WebFetch (unless named in…
The name it cites is new in this build
New in this build: --restricted