Devtools on Kuldeep Pisdahttps://kdpisda.in/tag/devtools/Recent content in Devtools on Kuldeep PisdaHugoen-usSat, 29 Aug 2026 09:00:00 +0530Claude Code's Restricted Mode Closes the Config Escape Hatch on Sandboxed Agentshttps://kdpisda.in/claude-code-restricted-mode/Sat, 29 Aug 2026 09:00:00 +0530https://kdpisda.in/claude-code-restricted-mode/<p>Anthropic shipped <code>--restricted</code> in Claude Code version 2.1.248 this week, and it is a smaller-looking change than it actually is. Most permission work in coding agents has been about which mode a session starts in: plan mode, accept-edits mode, full auto with <code>bypassPermissions</code>. What those modes have in common is that they are settings, and settings live in files, and files can be edited, inherited from a parent directory, or shipped by someone else entirely. <code>--restricted</code> is the first Claude Code flag that assumes the settings themselves might be the attacker, not just the agent reading them.</p>