Claude Code 2.1.248 adds a restricted mode and stops leaking credential leftovers

Anthropic published Claude Code 2.1.248 late on August 27, one of the longer changelogs of the month, and 2.1.250 a few hours after it carrying only bug fixes. Two entries in the long one matter more than the rest.

A mode that removes tools instead of asking about them

The new --restricted flag, also available as CLAUDE_CODE_RESTRICTED=1, removes the built-in tools that run commands or code, and WebFetch with them unless it is named explicitly in --tools. File tools stay, confined to the working directory. The mode refuses bypassPermissions outright and ignores user, project and local settings files.

The distinction is between asking and removing. Permission prompts leave a tool present and put a question in front of it, and the whole class of attacks against agents consists of getting that question answered the wrong way. A tool that is not loaded cannot be talked into running.

Uncommitted credential files were being uploaded

The fix is stated plainly in the changelog: /ultrareview and locally seeded cloud sessions were uploading uncommitted edits to prod.env-style files and *.tfvars, along with editor swap, temporary and backup copies of credential files, naming key.pem.tmp and id_rsa.swo as examples. They now stay on the machine.

The shape of that bug is worth noting for anyone who ships something similar. A filter that excludes .env and id_rsa does not exclude id_rsa.swo, because the editor made that name, not the developer, and nobody adds it to a list they wrote by hand.

The rest of the release

Selected from a changelog with more than forty entries.

• Cross-session messaging with SendMessage and ListAgents now works between sessions on one machine on Bedrock, Vertex and Foundry, and with telemetry disabled.
• A prompt-cache miss that struck roughly once an hour in long sessions is fixed; tool definitions were being re-rendered after an OAuth token refresh, which also cost the extended-thinking context.
• Desktop and Cowork sessions no longer vanish after thirty days; transcript cleanup keeps sessions written by the desktop app while they are in it, and desktopSessionCleanupPeriodDays caps the exemption.
• The Workflow tool's description dropped from about 5.700 tokens to about 1.000, with the script-writing reference moved into a bundled skill.
• Agent frontmatter accepts experimental.cacheTtl, either five minutes or one hour, as a per-agent prompt cache lifetime when no subagent setting exists.
• A backgrounded worktree session now holds its worktree lock while it runs, so cleanup and git worktree remove leave the checkout alone.