2.1.247 is barely out the door and 2.1.248 is already here. This time there’s a feature I actually care about: a locked-down mode.
With --restricted (or the environment variable CLAUDE_CODE_RESTRICTED=1), Claude Code drops every built-in tool that runs commands or code – and WebFetch too, unless you explicitly pull it back in via --tools. The file tools stay, but only inside the working directory. bypassPermissions is refused, and the settings files from user, project and local scope are ignored. It sounds heavy-handed, but it’s exactly what you want for a run you don’t want to trust blindly – say, when you point Claude at someone else’s code or drop it into a pipeline.
The second thing I like: experimental.cacheTtl in an agent’s frontmatter. It lets you set a cache lifetime per agent – “5m” or “1h” – when no higher-level setting applies. Small switch, but for anyone running lots of specialized agents, a real lever on cost.
The rest is targeted cleanup. Self-hosted runners can now register under their own name via --client-label instead of just taking the hostname. Server-managed settings finally get proper diagnostics: a startup warning when they fail to load, plus a line in /doctor and /status explaining why. And /web-setup now warns when the GitHub CLI token is missing the workflow scope – a detail that otherwise makes pushes to very large repositories fail without a sound.
There’s some enterprise plumbing too: /usage-credits for organizations billed through the AWS Marketplace or on an Enterprise trial, so members can request a higher limit straight from their admin. And session-to-session messaging via SendMessage and ListAgents now works on Bedrock, Vertex and Foundry, and with telemetry turned off.
The bug fixes are the quiet majority, as always. A prompt-cache miss that hit roughly once an hour in long sessions – gone. The cause: after an OAuth token refresh, the tool definitions were being re-rendered. You only notice things like that once they stop happening.
Not a big leap, but --restricted is a feature I’ll probably reach for more than I’d have guessed. Precisely because I keep letting Claude Code touch things where a little less trust is exactly right.
Sources: Claude Code Changelog · @anthropic-ai/claude-code on npm