Restricted sessions drop implicit file allowances, and a denial can't be argued away.
What's wrong with this entry?
In a restricted session the permission checker skips the usual implicit allowances (workflow script files, agent memory .md files, .claude/launch.json, and "project directory files are allowed for reading"), and a denial from a safety check can no longer be rescued by the automatic approval classifier.
- Safety-check denials are returned as not classifier-approvable, tagged with a dedicated circuit breaker that is registered as immune to bypass and never routed to the classifier.
- The relaxations that remote mode normally applies are suppressed when the session is restricted.
- Only reachable when the session was started with
--restrictedorCLAUDE_CODE_RESTRICTED.
{ classifierApprovable: !1, circuitBreaker: "restrictedMode" }, circuitBreaker: "restrictedMode", restrictedMode: { bypassImmune: !0, classifierRouted: !1 }
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.