Run Claude Code behind a corporate launcher changedcorporate-launcher
Nearest release: v2.1.304, published 2 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 19 Oct 2026 17:33 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+14added
Lines−14removed
From line
4
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits11to this page, all time
The whole hunk
from line 4, old and new numbered
/
from line 4
44
55Some organizations require every process on a workstation to start through a mandatory launcher. The launcher applies the sandbox, network controls, or credential injection that the company's security posture depends on, and a binary that starts without it is a policy violation.
66
7`CLAUDE_CODE_PROCESS_WRAPPER` starts every process Claude Code launches from its own binary through your launcher: the [background service](/docs/en/agent-view#the-supervisor-process), every session it hosts in [agent view](/docs/en/agent-view), and Claude Code's relaunches after an update. Set it to your launcher's absolute path, and Claude Code runs the launcher with the Claude Code command as its arguments.
7`CLAUDE_CODE_PROCESS_WRAPPER` starts every process Claude Code launches from its own binary through your launcher: the [background service](/docs/en/agent-view.md#the-supervisor-process), every session it hosts in [agent view](/docs/en/agent-view.md), and Claude Code's relaunches after an update. Set it to your launcher's absolute path, and Claude Code runs the launcher with the Claude Code command as its arguments.
88
99A launcher that wraps the `claude` command on your `PATH` can't reach the background service or the sessions it hosts, because they start from the binary's direct path without looking up `claude`.
1010
from line 22
2222* The terminal host and the Claude Code session inside every agent view row, including the warm standby sessions the service keeps ready.
2323* Sessions the service respawns after an update or a crash.
2424* The relaunch Claude Code performs of itself to finish installing an update, including agent view's restart-for-update action.
25* The session processes that [Remote Control](/docs/en/remote-control) starts. Requires Claude Code v2.1.210 or later.
26* The split-pane teammate sessions that [agent teams](/docs/en/agent-teams) start in tmux or iTerm2. Teammate panes are interactive rather than background processes, but Claude Code starts them from its own binary, so the launcher covers them. Requires Claude Code v2.1.210 or later.
25* The session processes that [Remote Control](/docs/en/remote-control.md) starts. Requires Claude Code v2.1.210 or later.
26* The split-pane teammate sessions that [agent teams](/docs/en/agent-teams.md) start in tmux or iTerm2. Teammate panes are interactive rather than background processes, but Claude Code starts them from its own binary, so the launcher covers them. Requires Claude Code v2.1.210 or later.
2727
28On Windows, the variable is ignored: the launcher contract depends on `exec`, which Windows doesn't support. A Windows machine with the variable set runs every process unwrapped and keeps working, and the only signal is a warning in the [debug log](/docs/en/troubleshooting). If your launcher policy covers Windows, the variable doesn't satisfy it there: count Windows machines as unwrapped when you plan the rollout.
28On Windows, the variable is ignored: the launcher contract depends on `exec`, which Windows doesn't support. A Windows machine with the variable set runs every process unwrapped and keeps working, and the only signal is a warning in the [debug log](/docs/en/troubleshooting.md). If your launcher policy covers Windows, the variable doesn't satisfy it there: count Windows machines as unwrapped when you plan the rollout.
2929
3030### Processes that start outside the launcher
3131
from line 32
3232The following processes don't start through the launcher:
3333
3434* A session you start yourself in a terminal, which runs however you invoked it. To cover these sessions, put a script named `claude` in a directory earlier on `PATH` that runs your launcher with the real binary; don't replace the managed symlink. The background service and its sessions start without a `PATH` lookup, so the two launchers don't stack there.
35* The first process of a `claude-cli://` deep link, which the operating system's protocol handler starts directly. Everything that session starts in the background afterward runs through the launcher. To close this path entirely, [prevent handler registration](/docs/en/deep-links#registration-and-supported-platforms) with the `disableDeepLinkRegistration` setting.
35* The first process of a `claude-cli://` deep link, which the operating system's protocol handler starts directly. Everything that session starts in the background afterward runs through the launcher. To close this path entirely, [prevent handler registration](/docs/en/deep-links.md#registration-and-supported-platforms) with the `disableDeepLinkRegistration` setting.
3636* The relaunch that `--worktree` combined with `--tmux` performs: the terminal multiplexer starts that pane, not Claude Code's binary.
37* The native-messaging host that [Claude in Chrome](/docs/en/chrome) registers: the browser starts it, not Claude Code's binary.
37* The native-messaging host that [Claude in Chrome](/docs/en/chrome.md) registers: the browser starts it, not Claude Code's binary.
3838
3939### Helper process names in process monitors
4040
from line 63
6363
6464Set the variable in the `env` block of a settings file so the detached background service inherits it. A shell `export` isn't enough: the background service starts on demand, outlives your shell, and never re-reads shell profiles.
6565
66For one machine, add it to `~/.claude/settings.json`. To deploy it to every machine in your organization, put the same block in [managed settings](/docs/en/managed-settings):
66For one machine, add it to `~/.claude/settings.json`. To deploy it to every machine in your organization, put the same block in [managed settings](/docs/en/managed-settings.md):
6767
6868```json theme={null}
6969{
from line 85
8585
8686`CLAUDE_CODE_PROCESS_WRAPPER` takes precedence when both are set.
8787
88Because `processWrapper` is a named setting, an organization that delivers it through [remote managed settings](/docs/en/managed-settings#delivery-mechanisms) sees it listed on the [security approval dialog](/docs/en/server-managed-settings#security-approval-dialogs) alongside the other settings that run administrator-supplied executables.
88Because `processWrapper` is a named setting, an organization that delivers it through [remote managed settings](/docs/en/managed-settings.md#delivery-mechanisms) sees it listed on the [security approval dialog](/docs/en/server-managed-settings.md#security-approval-dialogs) alongside the other settings that run administrator-supplied executables.
8989
90Project and local settings can't configure the launcher. A file committed to a repository must not be able to put a binary in front of every Claude Code process on the machine, so Claude Code ignores `CLAUDE_CODE_PROCESS_WRAPPER` in `.claude/settings.json` or `.claude/settings.local.json` with a warning in the [debug log](/docs/en/troubleshooting), and never reads the `processWrapper` key from those files.
90Project and local settings can't configure the launcher. A file committed to a repository must not be able to put a binary in front of every Claude Code process on the machine, so Claude Code ignores `CLAUDE_CODE_PROCESS_WRAPPER` in `.claude/settings.json` or `.claude/settings.local.json` with a warning in the [debug log](/docs/en/troubleshooting.md), and never reads the `processWrapper` key from those files.
9191
9292**3. Restart the background service and your sessions**
9393
from line 126
126126* A value that starts with `[` is read as a JSON string array, such as `["/opt/corp/launcher", "--profile", "cc"]`.
127127* Shell syntax doesn't work: there is no variable expansion or globbing, and an unquoted operator such as `;`, `|`, `&`, or `$(` is rejected as a configuration error rather than reinterpreted.
128128
129When the value can't be used, Claude Code refuses to start the affected process and [reports the reason](/docs/en/errors#claude_code_process_wrapper-launcher-errors).
129When the value can't be used, Claude Code refuses to start the affected process and [reports the reason](/docs/en/errors.md#claude_code_process_wrapper-launcher-errors).
130130
131131In a settings file, write the array form inside a JSON string and escape its quotes: `"[\"/opt/corp/launcher\", \"--profile\", \"cc\"]"`.
132132
from line 152
152152
153153## Related resources
154154
155* [Agent view](/docs/en/agent-view): the background sessions and supervisor process the launcher covers
156* [Environment variables](/docs/en/env-vars): the `CLAUDE_CODE_PROCESS_WRAPPER` reference entry
157* [Managed settings](/docs/en/permissions#managed-settings): deliver the `env` block across a fleet
158* [Launcher error reference](/docs/en/errors#claude_code_process_wrapper-launcher-errors): the refusal messages and how to recover
155* [Agent view](/docs/en/agent-view.md): the background sessions and supervisor process the launcher covers
156* [Environment variables](/docs/en/env-vars.md): the `CLAUDE_CODE_PROCESS_WRAPPER` reference entry
157* [Managed settings](/docs/en/permissions.md#managed-settings): deliver the `env` block across a fleet
158* [Launcher error reference](/docs/en/errors.md#claude_code_process_wrapper-launcher-errors): the refusal messages and how to recover
159159
No line in this hunk matches that.