The headline is `--restricted`. Launch with it and the CLI drops every built-in tool that can run commands or code, drops WebFetch, confines file tools to the working directory, and flat-out refuses `bypassPermissions`. It's the sandbox you'd want before handing a session to something you don't fully trust. Two other additions matter if you run at scale: `experimental.cacheTtl` in agent frontmatter lets each subagent set its own prompt-cache TTL, and `SendMessage`/`ListAgents` now pass messages between sessions on the same machine. The rest is plumbing — a `--client-label` override for self-hosted runner registration, `/usage-credits` for Enterprise orgs on AWS Marketplace, server-managed settings diagnostics that surface in `/doctor`, and a batch of prompt-cache-miss and long-session transcript fixes. Nothing here breaks an existing setup, so upgrade when it's convenient.