Claude Code v2.1.248 ships --restricted mode, per-agent cacheTtl, /usage-credits, cross-session messaging and a long bug-fix/security pass
Anthropic
Released Aug 27, 2026 (v2.1.248). Adds a --restricted flag (CLAUDE_CODE_RESTRICTED=1) that disables built-in command/code tools and WebFetch, confines file tools to the working directory, refuses bypassPermissions and ignores all settings files; per-agent experimental.cacheTtl (5m or 1h); claude self-hosted-runner --client-label override; server-managed-settings diagnostics; /usage-credits for AWS-Marketplace / self-serve / Enterprise-trial orgs; cross-session SendMessage/ListAgents on Bedrock, Vertex and Foundry and when telemetry is off. Fixes include an OAuth-token-refresh bug that was destroying the prompt cache (~once per hour in long sessions), /ultrareview uploading uncommitted edits to prod.env / *.tfvars / editor swap files, several claude agents crashes, Windows terminal input and Korean IME @-mention matching; the Workflow tool prompt footprint drops ~5.7k to ~1k tokens.
Why it matters
The --restricted mode closes the long-standing gap where administrators had no built-in way to ship Claude Code to untrusted users without a separate sandbox; the cache-freshness fix and the cross-session messaging surface are the two highest-leverage agent-loop wins of the August Claude Code series.
Importance: 3/5
notable release; official confirmation