1
00:00:00,179 --> 00:00:00,859
So, picture this.

2
00:00:01,480 --> 00:00:07,079
You are running security for an enterprise
dev team, and suddenly your AI CLI tool

3
00:00:07,139 --> 00:00:11,699
starts auto spawning background daemons
outside your entire telemetry stack.

4
00:00:12,319 --> 00:00:13,219
Total nightmare, right?

5
00:00:13,731 --> 00:00:16,431
Oh, absolute crikey moment for SecOps!

6
00:00:17,091 --> 00:00:21,991
You set up all these strict corporate
wrappers, and then Claude Code just sneaks off

7
00:00:22,012 --> 00:00:27,311
into the background, self spawning agent
views and subagents completely untracked.

8
00:00:27,375 --> 00:00:28,335
Exactly.

9
00:00:28,395 --> 00:00:33,055
But version 2.1.208 actually solves this
head on.

10
00:00:33,183 --> 00:00:37,615
They introduced an environment variable
called CLAUDE CODE PROCESS WRAPPER,

11
00:00:37,722 --> 00:00:42,815
along with a matching processWrapper
setting key in dot claude settings dot json.

12
00:00:42,833 --> 00:00:47,153
Right, so now the agent view and the
background service now honor a corporate

13
00:00:47,206 --> 00:00:51,073
launcher by running every Claude Code self
spawn through it.

14
00:00:51,137 --> 00:00:55,873
That means no more rogue background
processes sneaking around your firewall or audit

15
00:00:55,953 --> 00:00:56,593
tools.

16
00:00:56,682 --> 00:00:57,222
Exactly.

17
00:00:57,943 --> 00:00:59,862
How it works in practice is pretty slick.

18
00:01:00,442 --> 00:01:05,423
You export CLAUDE CODE PROCESS WRAPPER
pointing to something like slash usr slash

19
00:01:05,583 --> 00:01:10,202
local slash bin slash corporate launcher
dot sh.

20
00:01:10,782 --> 00:01:13,422
Or you add processWrapper to your project
configuration.

21
00:01:13,458 --> 00:01:17,458
And whenever Claude needs to spin up a
subagent or a background daemon,

22
00:01:17,485 --> 00:01:19,698
it execs that launcher script first.

23
00:01:19,938 --> 00:01:25,778
So your script can inject fresh OAuth
tokens, isolate the process inside a container

24
00:01:25,842 --> 00:01:30,018
namespace, or pipe telemetry straight to
your SIEM audit logs.

25
00:01:30,000 --> 00:01:33,440
Which brings us to how you actually write
one of these things.

26
00:01:33,720 --> 00:01:36,880
Lachlan, you were testing a basic bash
wrapper earlier, right?

27
00:01:36,875 --> 00:01:37,355
Yeah!

28
00:01:37,555 --> 00:01:43,595
A dead simple script starts with shebang
bin bash, and then exec slash usr slash

29
00:01:43,688 --> 00:01:49,115
local slash bin slash audit logger,
passing along all positional arguments with

30
00:01:49,172 --> 00:01:50,795
dollar sign at symbol.

31
00:01:50,891 --> 00:01:55,355
That exec is crucial because it replaces
the shell process without leaving a stray

32
00:01:55,412 --> 00:01:57,115
parent process hanging around.

33
00:01:57,244 --> 00:02:00,204
But there are a few sharp corners to watch
out for, aren't there?

34
00:02:00,369 --> 00:02:01,389
Oh, mate, big time.

35
00:02:02,069 --> 00:02:06,210
First off, if your launcher script
accidentally calls claude again without scrubbing

36
00:02:06,230 --> 00:02:11,149
environment flags, boom, infinite
recursive loop until your server runs out of file

37
00:02:11,189 --> 00:02:12,130
descriptors.

38
00:02:12,929 --> 00:02:13,809
Ask me how I know.

39
00:02:15,379 --> 00:02:16,599
Classic recursion trap!

40
00:02:17,179 --> 00:02:19,059
And don't forget basic file permissions.

41
00:02:19,420 --> 00:02:23,159
If that wrapper script isn't marked
executable with chmod plus x,

42
00:02:23,579 --> 00:02:25,100
the self spawn fails immediately.

43
00:02:25,125 --> 00:02:25,765
Spot on.

44
00:02:25,877 --> 00:02:30,485
Plus, if your team uses the VS Code
extension, keep in mind that toggle settings

45
00:02:30,533 --> 00:02:34,645
like Use Terminal can alter how background
processes get spawned,

46
00:02:34,685 --> 00:02:38,405
potentially bypassing local shell hooks if
you haven't set the processWrapper key

47
00:02:38,458 --> 00:02:40,485
globally in settings dot json.

48
00:02:40,500 --> 00:02:43,220
That is a huge tip for enterprise
deployments.

49
00:02:43,340 --> 00:02:47,540
Now, before we wrap up, there are two
really neat quality of life features from

50
00:02:47,586 --> 00:02:49,300
recent builds worth a quick shoutout.

51
00:02:49,292 --> 00:02:50,172
Oh, the Vim one!

52
00:02:50,465 --> 00:02:56,652
In version 2.1.208, they added
vimInsertModeRemaps.

53
00:02:56,919 --> 00:03:01,212
So if you are a Vim power user who hates
reaching for the Escape key,

54
00:03:01,272 --> 00:03:04,412
you can map double j to Escape directly in
your config.

55
00:03:04,616 --> 00:03:05,116
Love that.

56
00:03:05,537 --> 00:03:11,096
And in version 2.1.219, they added mcp
server errors.

57
00:03:11,576 --> 00:03:15,136
If an Model Context Protocol server fails
during headless stream json

58
00:03:15,217 --> 00:03:19,897
initialization, it actually surfaces the
error details instead of failing silently

59
00:03:19,917 --> 00:03:20,456
in the dark.

60
00:03:20,640 --> 00:03:23,339
No more guessing why your tool call hung
forever!

61
00:03:24,459 --> 00:03:25,380
Good stuff all round.

62
00:03:26,039 --> 00:03:27,960
That is it for today, catch you all next
time!

63
00:03:28,167 --> 00:03:28,647
See ya!