Claude Code Shipped a Flag That Removes Tools Instead of Denying Them
The --restricted bullet has four clauses and not one of them is a pattern match. After a year of deny rules that resolved a name at read time, that's the whole point.
NeuroX AI · August 29, 2026
The Claude Code changelog added --restricted (or CLAUDE_CODE_RESTRICTED=1), and the bullet has four clauses, not one of which is a pattern match: it removes the built-in tools that run commands or code and WebFetch, keeps file tools inside the working directory, refuses bypassPermissions, and ignores user, project and local settings files.
Read that last clause twice. All three settings layers, gone. A repo you cloned to review can't smuggle in a hook, a permission rule or a tool grant, because the session never opens the file that would carry it.
The contrast shipped in the same window: "Fixed file tools (Read, Write, Edit) following a symlink swapped inside the working directory after the permission check, which could read or write outside the approved location." The check ran. The check passed. Then the ground moved underneath it. Every permission check has that window. A tool that was never loaded doesn't.
That's the design difference. Deny rules resolve a name at read time, and six environment variables can void a policy you shipped from a server. Removal has no evaluation step left to lose.
Most in-house agents are still on the wrong side of that line. The safety story is a regex over a shell command, a filename filter, an allowlist evaluated at call time. The fix is almost never a better regex. It's a smaller tool surface, decided before the process starts.