DevAgentRadar → Claude Code

You are helping me adopt a real coding-assistant change. Work only from the facts below. Do not invent features.

Context

Assistant: Claude Code Proposal: Enable --restricted for untrusted repos, CI, and shared agents Summary: Claude Code v2.1.248 adds --restricted/CLAUDE_CODE_RESTRICTED=1, stripping command/code tools and WebFetch unless named in --tools, keeping file tools in-cwd, refusing bypassPermissions, and ignoring user/project/local settings. Pair it with agent experimental.cacheTtl and labeled self-hosted runners. Primary source: https://github.com/anthropics/claude-code/releases/tag/v2.1.248

Why it matters

v2.1.248’s --restricted flag is the concrete control for sessions that must not run commands/code or WebFetch, cannot bypassPermissions, and must ignore user/project/local settings while still using in-cwd file tools. Use it as the default for untrusted checkouts, PR bots, and shared machines so a repo cannot weaken policy via local settings. Long-running custom agents should set frontmatter experimental.cacheTtl to "5m" or "1h" when no subagent TTL is configured; this release also fixed hourly prompt-cache misses after OAuth refresh and --resume cache misses when ScheduleWakeup changed in overage. Self-hosted fleets should stop registering as hostname and pass --client-label / SELF_HOSTED_RUNNER_CLIENT_LABEL. After upgrade, /doctor and /status now explain managed-settings load failures (Bedrock/Vertex/third-party or custom ANTHROPIC_BASE_URL). /web-setup now warns when the GitHub CLI token lacks workflow scope. Do not infer the two omitted changelog items.

Suggested actions

1. For untrusted checkouts and CI, start Claude Code with claude --restricted (or CLAUDE_CODE_RESTRICTED=1). Do not use bypassPermissions. Only restore command/code tools or WebFetch by naming them in --tools.
2. In each custom agent’s frontmatter, set experimental.cacheTtl: "1h" for long-lived agents or experimental.cacheTtl: "5m" for short ones so per-agent prompt-cache TTL applies when no subagent TTL is configured.
3. Register self-hosted runners with a stable label instead of hostname: claude self-hosted-runner --client-label team-ci-linux (or SELF_HOSTED_RUNNER_CLIENT_LABEL=team-ci-linux).
4. After installing v2.1.248, run /doctor then /status and fix the new server-managed settings load-failure line if present (Bedrock/Vertex/third-party provider or custom ANTHROPIC_BASE_URL).
5. Re-run /web-setup and, if warned, grant the GitHub CLI token the workflow scope so pushes to very large repositories are not rejected.

Config surfaces this release may change

• subagent definitions (high confidence) — check your repo before applying
• hooks (high confidence) — check your repo before applying
• background and headless runs — check your repo before applying
• settings files — check your repo before applying
• MCP servers — check your repo before applying
• skills — check your repo before applying

After you finish

Do not report this as applied to DevAgentRadar. You cannot write the visitor's loop.

Tell the human: open https://devagentradar.com/proposals/claude-code-v2-1-248-enable-restricted-for-untrusted-repos-ci-and-shared and mark Applied, Skipped, or Failed. Proposal id: d62c89ae-911b-4c73-a279-0b9b441deb46

Your job

1. Restate the change in one sentence.
2. Propose a minimal plan for my repo (or a throwaway pilot).
3. Implement only what I approve; prefer small diffs and tests.
4. Call out risks (permissions, breaking APIs, cost).

Start by confirming you understood the proposal.