Claude Code 2.1.248 adds --restricted mode for untrusted repos
It also lets sessions on one machine message each other, sets prompt-cache TTL per agent, and stops OAuth token refreshes from busting your cache.
Copy markdown
--restricted mode locks the agent to files only
`claude --restricted` (or `CLAUDE_CODE_RESTRICTED=1`) strips the built-in tools that run commands or code, drops WebFetch unless you name it in `--tools`, keeps file tools inside the working directory, refuses `bypassPermissions`, and ignores your user, project and local settings. It is the flag to point at an untrusted repo or a CI job without handing it a shell.
Sessions on one machine can now talk to each other
`SendMessage` and `ListAgents` bridge separate Claude Code sessions on the same box, now working on Bedrock, Vertex, and Foundry and even with telemetry disabled. One session can hand work to another instead of everything sharing a single context window.
Per-agent prompt-cache TTL
Set `experimental.cacheTtl` ("5m" or "1h") in an agent’s frontmatter and that subagent gets its own cache TTL when no global subagent TTL is configured — a direct lever on how long you pay to keep its context warm.
Token refresh no longer busts your cache
2.1.248 fixes prompt-cache misses that fired right after an OAuth token refresh (and after `ScheduleWakeup` tool-definition changes). Long sessions that were silently re-paying full input cost on refresh stop bleeding tokens. It also fixes Claude Desktop sessions vanishing after 30 days.
/usage-credits and self-hosted runner labels for teams
Enterprise orgs billed through AWS Marketplace — plus self-serve Enterprise and trials — get `/usage-credits` to request a higher limit from an admin, and `claude self-hosted-runner --client-label` overrides the label a runner registers with (default: hostname).