Security

Primitives touching a security surface

1. --restricted

   Restricted mode: removes the built-in tools that run commands or code (Bash, PowerShell, REPL and the other code-running tools) and WebFetch unless --tools names them, and ignores user, project and local settings files (managed settings and --settings still apply; add --strict-mcp-config to skip MCP servers too). Also confines the file tools to the working directories (--add-dir included), refuses bypassPermissions, and lets only a person or the configured permission handler approve writes to settings, git and tool-configuration files.

   security impact is a human judgement (plan §5) — this record carries the vendor's words and no verdict

Surfaces named

settings

14

managed settings

8

permission

7

token

4

hook

4

env

4

OAuth

3

trust

3

credential

3

sandbox

2

bypassPermissions

1

restricted

1

auth

1

Changes touching a security surface

1. 2.1.248addednames: bypassPermissions, settings, restricted

   Added `--restricted` (or `CLAUDE_CODE_RESTRICTED=1`): removes the built-in tools that run commands or code and `WebFetch` (unless named in `--tools`), keeps file tools inside the working directory, refuses `bypassPermissions`, and ignores user, project and local settings files

2. 2.1.248addednames: settings, managed settings

   Added server-managed settings diagnostics: a startup warning when the settings fail to load, and a `/doctor` and `/status` line explaining a load failure or why they weren't fetched (Bedrock/Vertex/third-party provider, custom `ANTHROPIC_BASE_URL`)

3. 2.1.248addednames: token

   Added a warning in `/web-setup` when the GitHub CLI token lacks the `workflow` scope, since pushes to very large repositories can be rejected without it

4. 2.1.248fixednames: token, OAuth

   Fixed a prompt-cache miss (and lost extended-thinking context) roughly once an hour in long sessions, caused by tool definitions being re-rendered after an OAuth token refresh

5. 2.1.248fixednames: token

   Fixed being sent to the login screen when another Claude Code process held the token refresh lock while the session token had expired; the request now fails with a retryable error instead

6. 2.1.248fixednames: OAuth

   Fixed the recommended Console sign-in in `/login` failing with an OAuth error before showing a sign-in URL on machines where it can't be used (for example when `ANTHROPIC_API_KEY` or an API key helper is set); it now falls back to the API-key sign-in

7. 2.1.248fixednames: trust

   Fixed `claude agents` skipping the workspace trust prompt when the `CI` environment variable is set

8. 2.1.248fixednames: hook

   Fixed background sessions waiting silently when a `PermissionRequest` or `PreToolUse` hook prints an invalid answer: the `claude agents` row now names the hook and the schema error

9. 2.1.248fixednames: hook

   Fixed hooks silently treating a stdout `{…}` object that isn't valid JSON as plain text; it's now reported as a hook error with the parse message

10. 2.1.248fixednames: OAuth

    Fixed MCP servers whose `headersHelper` supplies the `Authorization` header falling into OAuth discovery on a 401 instead of re-running the helper and retrying the call as documented

11. 2.1.248fixednames: settings

    Fixed `/login` to a Claude apps gateway hanging when the managed-settings security approval dialog was required

12. 2.1.248fixednames: credential

    Fixed gateway model discovery (`CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY`) never running when `apiKeyHelper` is the only credential

13. 2.1.248fixednames: permission, trust

    Fixed the trust dialog's list of repo permission rules showing a garbled character when a long rule was cut off in the middle of an emoji

14. 2.1.248fixednames: permission

    Fixed the permission mode indicator staying hidden behind the "Press Ctrl-C again to exit" hint when you press shift+tab right after ctrl+c

15. 2.1.248fixednames: credential, env

    Fixed `/ultrareview` and locally seeded cloud sessions uploading uncommitted edits to `prod.env`-style and `*.tfvars` files, or to editor swap, temp, and backup copies of credential files (e.g. `key.pem.tmp`, `id_rsa.swo`); they now stay on your machine

16. 2.1.248fixednames: permission

    Fixed Remote Control sessions occasionally never showing a permission prompt or the latest messages on the connected device after the CLI silently reconnected

17. 2.1.248fixednames: settings, managed settings

    Fixed an invalid `crossSessionInbound` value being silently ignored: it now warns and holds cross-session messages (user settings) or refuses them (managed settings) until fixed

18. 2.1.248improvednames: settings, env, managed settings

    Improved managed settings: client-side timeout, MCP startup-mode, and stream-watchdog env vars no longer trigger the settings-approval prompt

19. 2.1.248changednames: trust

    Changed cross-session messaging in Linux user namespaces: root-equivalent trust for unmapped owners is limited to canonical system directories

20. 2.1.251addednames: hook

    Added `PreModelSwitch` and `PostModelSwitch` hook events (block, confirm, or annotate a model switch); `SessionStart` resume hooks now receive session staleness and the estimated re-cache cost

21. 2.1.251fixednames: permission

    Fixed file tools (Read, Write, Edit) following a symlink swapped inside the working directory after the permission check, which could read or write outside the approved location

22. 2.1.251fixednames: settings, managed settings

    Fixed project settings being able to enable detailed beta tracing or raw API body logging, and a lower-scope beta tracing endpoint bypassing an OTLP collector pinned by managed settings or a host app

23. 2.1.251fixednames: permission

    Fixed the Workflow tool reading (and quoting in errors) a `scriptPath` outside what the session may read before the permission check ran

24. 2.1.251fixednames: settings

    Fixed managed-settings `disableAutoMode` arriving mid-session not moving an already-running auto-mode session back to default mode

25. 2.1.251fixednames: settings, hook

    Fixed an `additionalDirectories` entry containing a null byte crashing startup, or breaking `/add-dir` and later settings updates when it came from an SDK host, IDE, or hook; it is now skipped

26. 2.1.251fixednames: permission

    Fixed Bash permission checks auto-approving commands that assign an arithmetic expression to an integer shell variable (e.g. `OPTIND=1/0`, `RANDOM=2+2`); these now prompt for approval

27. 2.1.251fixednames: settings

    Fixed the managed-settings approval prompt re-appearing after signing in again to the same Claude apps gateway when the settings are unchanged

28. 2.1.251fixednames: env

    Fixed disabled `/bug` and `/share` reporting that `/feedback` was disabled; tips, `/help`, and refusal messages no longer suggest `/feedback` when an org policy or env var turns it off

29. 2.1.251improvednames: settings, managed settings

    Improved the managed settings approval dialog to list only the settings that changed since you last approved them

30. 2.1.251changednames: permission

    Changed Claude in Chrome so browser actions always go through Claude Code's permission checks, including in sessions with telemetry disabled, which previously used the Chrome extension's own prompts

31. 2.1.251changednames: settings, managed settings

    Changed analytics to no longer turn off before sign-in solely because managed settings force gateway login (or cannot be read); they stay off once signed in to the gateway or via `DISABLE_TELEMETRY`

32. 2.1.251changednames: token, auth

    Changed the footer PR badge on Bedrock, Vertex, and Foundry, and when telemetry is off, to call the GitHub API directly (via `gh auth token`, `GH_TOKEN`, or `GITHUB_TOKEN`) instead of `gh pr view`

33. 2.1.251changednames: sandbox

    Changed how Bash command output files are created and read back when commands run in the sandbox, so a sandboxed command cannot redirect or replace them

34. 2.1.251changednames: settings, sandbox, managed settings

    Changed server-managed settings that terminate sandbox TLS, route sandbox traffic through your own proxy, inject credentials, or weaken sandbox isolation to require approval before they apply

35. 2.1.251changednames: settings, credential

    Changed `ANTHROPIC_CUSTOM_HEADERS` from managed or project settings to require approval when it sets a credential, org/tenant, routing, or API-behavior header (e.g. `Authorization`, `Host`)

36. 2.1.251changednames: settings, env, managed settings

    Changed project-level `.claude/settings.json` `env` to no longer set `CLAUDE_CONFIG_DIR`, `CLAUDE_CODE_TMPDIR`, or `TMPDIR`/`TMP`/`TEMP`; set them in your shell, user, or managed settings instead