New --restricted mode locks down command/code execution for safer automation, plus a major stability pass fixing hourly prompt-cache misses and dozens of claude agents bugs.
--restricted (or CLAUDE_CODE_RESTRICTED=1): removes the built-in tools that run commands or code and WebFetch (unless named in --tools), keeps file tools inside the working directory, refuses bypassPermissions, and ignores user, project and local settings filesexperimental.cacheTtl ("5m" or "1h") to agent frontmatter: a per-agent prompt cache TTL used when no subagent TTL setting is configuredclaude self-hosted-runner --client-label <label> (or SELF_HOSTED_RUNNER_CLIENT_LABEL) to override the label the runner registers with (default: hostname)/doctor and /status line explaining a load failure or why they weren't fetched (Bedrock/Vertex/third-party provider, custom ANTHROPIC_BASE_URL)/web-setup when the GitHub CLI token lacks the workflow scope, since pushes to very large repositories can be rejected without it/usage-credits for Enterprise organizations billed through AWS Marketplace, self-serve Enterprise, and Enterprise trials, so members can request a higher usage limit from their adminSendMessage / ListAgents) between sessions on the same machine on Bedrock, Vertex, and Foundry, and when telemetry is disabledworkflow-authoring skillgh pr command still refreshes it right away/ultrareview <PR#> to check before launch that the GitHub account connected to your Claude account can access the repository, and to explain how to fix it, instead of failing after the cloud session starts/tmp directory when the default one can't be used, and the notice and /status name the directory to fixScheduleWakeup tool definition changing between a session and its --resume when the account had entered usage overage, causing a full prompt-cache miss on the resumed session's first turndesktopSessionCleanupPeriodDays setting caps the exemptionclaude agents list not responding to the keyboard after detaching from a session, or when launched in a terminal tab left in win32-input-mode/login failing with an OAuth error before showing a sign-in URL on machines where it can't be used (for example when ANTHROPIC_API_KEY or an API key helper is set); it now falls back to the API-key sign-in/model and fast-mode switch notices to render as code, so suffixes like [1m] display literally instead of as a linkclaude agents skipping the workspace trust prompt when the CI environment variable is setclaude agents crashing on launch when the PR-status cache held a malformed entryclaude agents: opening a stopped session that you already resumed in another terminal no longer starts a second process on that conversation; the row now says it is open in a terminalclaude agents and claude rm refusing to delete a session ("has commits that are not pushed anywhere") when its worktree branch was already merged into your checked-out default branch (e.g. local main) but not yet pushedPermissionRequest or PreToolUse hook prints an invalid answer: the claude agents row now names the hook and the schema error{…} object that isn't valid JSON as plain text; it's now reported as a hook error with the parse message/mcp listing a project .mcp.json entry that declares the claude.ai connector type under the trusted "claude.ai" heading; it now appears under its real scopeheadersHelper supplies the Authorization header falling into OAuth discovery on a 401 instead of re-running the helper and retrying the call as documented/login to a Claude apps gateway hanging when the managed-settings security approval dialog was requiredCLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY) never running when apiKeyHelper is the only credentialclaude logs leaving mouse tracking, bracketed paste and the alternate screen switched on in the terminal it was run from/ultrareview and locally seeded cloud sessions uploading uncommitted edits to prod.env-style and *.tfvars files, or to editor swap, temp, and backup copies of credential files (e.g. key.pem.tmp, id_rsa.swo); they now stay on your machineclaude remote-control rejecting its own flags (e.g. --spawn, --name) when a global flag or a wrapper-injected option precedes the subcommandgit worktree remove leave it alonecrossSessionInbound value being silently ignored: it now warns and holds cross-session messages (user settings) or refuses them (managed settings) until fixed/usage-credits when that command isn't available for your organization (e.g. hidden with DISABLE_EXTRA_USAGE_COMMAND)/loop: self-paced dynamic mode and the no-prompt autonomous default are now always available, including on Bedrock/Vertex/Foundry[Anthropic telemetry] instead of [3P telemetry] OTEL diag error, so they are not mistaken for your OTel collector failingSendMessage from a subagent to another session: the result now notes that any reply is delivered to the parent session's conversation, not to the subagent