Claude Code v2.1.98: PID Namespace Subprocess Sandboxing on Linux and Per-Session Script Invocation Caps

Claude Code Docs·medium signal

Claude Code v2.1.98 adds subprocess sandboxing with PID namespace isolation on Linux when CLAUDE_CODE_SUBPROCESS_ENV_SCRUB is set, preventing spawned processes from seeing or signaling the parent agent's process tree. Additionally, CLAUDE_CODE_SCRIPT_CAPS limits per-session script invocations, preventing runaway automation. For teams running Claude Code in CI or shared servers, these two env vars provide meaningful defense-in-depth against process escape and resource exhaustion.