Summary
The release adds —restricted mode, which removes command-running tools and WebFetch unless explicitly allowed, confines file tools to the working directory, refuses bypassPermissions, and ignores local settings files. It also adds cross-session SendMessage and ListAgents support on Bedrock, Vertex, and Foundry, alongside self-hosted runner labels and prompt-cache fixes.
Why it matters
Engineering teams gain a stronger least-privilege baseline for coding agents while multi-session workflows become more viable on enterprise providers.
Related coverage
- Claude Code adds model-switch hooks and remote subagent visibility
- Cline Desktop expands to Windows and improves long-running agent workflows
- OpenCode adds Azure Entra sign-in and fixes replayable Bedrock reasoning