Claude Code Restricted Mode for Safer Untrusted Repos
We break down how Claude Code 2.1.248 helps protect agents inside untrusted repositories with a new restricted mode that disables risky tools, locks file access to the working directory, and ignores potentially malicious config files. The episode also covers a prompt caching bug fix and a major reduction in Workflow tool token usage for more efficient long coding sessions.
Chapter 1
Lock Down Untrusted Repos with Claude Code 2.1.248 Restricted Mode
James Turner
Running an autonomous AI agent inside a random, unvetted repository you just cloned off GitHub, I mean, it is kind of terrifying when you really think about what it could do.
Lachlan Reed
Crikey, mate, it really is. You hand an agent free rein in your terminal, and one rogue script or hidden instruction in a repo file could have it running wild. But Anthropic just rolled out Claude Code version 2.1.248, brought to you by Jellypod AI, and it introduces a built in restricted flag specifically for this.
James Turner
Right! You can pass the restricted flag on the command line or set the environment variable CLAUDE CODE RESTRICTED equals one. And what that does right out of the box is strip away tools that execute arbitrary code or commands. So Bash and WebFetch are completely disabled by default.
Lachlan Reed
Exactly. It puts the agent in a proper sandbox. Any file operations are locked strictly inside your current working directory, so it cannot go snooping around your home folder or system directories. And if an agent tries to request bypassPermissions, the system refuses it outright.
James Turner
That is huge. And it also ignores all local, project level, and user level dot claude settings files. So a malicious repo cannot hijack your setup with a sneaky config file you did not know was there.
Lachlan Reed
Yeah, spot on. So if you are reviewing an unvetted pull request or checking out some fresh open source code, you just launch with the restricted flag. If you still want the agent to edit code safely without shell access, you can selectively allow specific tools by adding the tools flag set to Write and Edit.
James Turner
Just keep in mind that if your normal workflow relies on running tests, build commands, or custom workspace hooks, those will get blocked. It is a strict lockdown by design, so you trade shell automation for total safety.
Lachlan Reed
Beyond security, version 2.1.248 also fixed a brutal bug with prompt caching. Before this patch, whenever your OAuth token refreshed roughly once an hour, Claude Code re rendered tool definitions behind the scenes.
James Turner
Which caused a total prompt cache miss every single hour! You would lose all your cached context and extended thinking state mid session. Having that fixed is a massive relief for long coding sessions.
Lachlan Reed
And they trimmed down the Workflow tool as well. By moving its detailed script authoring reference into a separate skill, the prompt footprint dropped from 5.7k tokens down to just 1k tokens.
James Turner
That is a ton of context window reclaimed on every single turn. Safer repos, persistent caching, and leaner prompts, all in one update.