What exactly does --restricted block in Claude Code?

Restricted mode removes Claude Code's built-in tools that run commands or code, and removes WebFetch unless you list it in --tools. It also confines the file tools to the working directory, refuses bypassPermissions, and ignores user, project and local settings files so no config can widen the session's reach.

Can Claude Code still read my files in restricted mode?

Yes. Claude Code keeps its file tools in restricted mode, but scopes them to the working directory, so it can read and edit inside the project and nowhere else. What it loses is the ability to execute commands or code, and to fetch the web unless WebFetch is explicitly named in --tools.

What changed for Claude Desktop and Cowork sessions in 2.1.248?

Claude Code 2.1.248 fixes Claude Desktop and Cowork sessions disappearing after 30 days. Transcript cleanup now keeps desktop-written sessions while they are still in the app, unless org policy manages retention. A new desktopSessionCleanupPeriodDays setting caps how long that exemption lasts.

How do enterprise teams ask for a higher usage limit?

Claude Code 2.1.248 adds /usage-credits for Enterprise organizations billed through AWS Marketplace, self-serve Enterprise, and Enterprise trials. Members run the command inside the CLI to request a higher usage limit from their admin, instead of going through a separate console or support ticket.

Is 2.1.248 the newest Claude Code release?

No. Anthropic shipped Claude Code 2.1.250 shortly after 2.1.248, but its changelog entry lists only bug fixes and reliability improvements. The feature work described here — restricted mode, per-agent cache TTL, cross-session messaging and the session-retention fixes — all landed in 2.1.248.

Anthropic · 2026-08-27 · major

Claude Code 2.1.248 — a restricted mode that strips the tools that run code

Claude Code 2.1.248 adds --restricted, a flag that removes the built-in tools that run commands or code, keeps file access inside the working directory, and refuses bypassPermissions. Sessions on one machine can now message each other.

Claude Code v2.1.248 release page on GitHub

Claude Code 2.1.248 adds a restricted mode that takes away the tools which run commands or code.

Quick facts

Maker	Anthropic
Version	2.1.248
Released	27 August 2026
New flag	--restricted or CLAUDE_CODE_RESTRICTED=1
Also new	Cross-session messaging on Bedrock, Vertex and Foundry
Install	npm i -g @anthropic-ai/claude-code

What is it?

The --restricted flag is the headline change in Claude Code 2.1.248. Setting it, or the CLAUDE_CODE_RESTRICTED=1 environment variable, removes the built-in tools that run commands or code, drops WebFetch unless you name it in --tools, keeps the file tools inside the working directory, refuses bypassPermissions, and ignores user, project and local settings files.

How does it work?

The restriction happens at startup rather than through permission prompts: the risky tools never enter the session's tool list, so there is nothing left to approve later. Ignoring the settings files matters just as much, because a project's own config cannot quietly widen what the session may do. The same release adds experimental.cacheTtl to agent frontmatter, letting one subagent pick a 5-minute or 1-hour prompt cache.

Why does it matter?

Teams that point a coding agent at untrusted input, or run it in CI, now get a one-flag way to shrink the blast radius without writing a permission policy first. Version 2.1.248 also opens cross-session messaging — SendMessage and ListAgents between sessions on the same machine — on Bedrock, Vertex and Foundry, and when telemetry is turned off. Several cache and session-retention bugs are fixed alongside it.

Who is it for?

teams running coding agents in CI or on untrusted input

Frequently asked questions

What exactly does --restricted block in Claude Code?: Restricted mode removes Claude Code's built-in tools that run commands or code, and removes WebFetch unless you list it in --tools. It also confines the file tools to the working directory, refuses bypassPermissions, and ignores user, project and local settings files so no config can widen the session's reach.
Can Claude Code still read my files in restricted mode?: Yes. Claude Code keeps its file tools in restricted mode, but scopes them to the working directory, so it can read and edit inside the project and nowhere else. What it loses is the ability to execute commands or code, and to fetch the web unless WebFetch is explicitly named in --tools.
What changed for Claude Desktop and Cowork sessions in 2.1.248?: Claude Code 2.1.248 fixes Claude Desktop and Cowork sessions disappearing after 30 days. Transcript cleanup now keeps desktop-written sessions while they are still in the app, unless org policy manages retention. A new desktopSessionCleanupPeriodDays setting caps how long that exemption lasts.
How do enterprise teams ask for a higher usage limit?: Claude Code 2.1.248 adds /usage-credits for Enterprise organizations billed through AWS Marketplace, self-serve Enterprise, and Enterprise trials. Members run the command inside the CLI to request a higher usage limit from their admin, instead of going through a separate console or support ticket.
Is 2.1.248 the newest Claude Code release?: No. Anthropic shipped Claude Code 2.1.250 shortly after 2.1.248, but its changelog entry lists only bug fixes and reliability improvements. The feature work described here — restricted mode, per-agent cache TTL, cross-session messaging and the session-retention fixes — all landed in 2.1.248.

Try it

claude --restricted