allowManagedHooksOnly
A Claude Code settings key, read out of the shipped bundle. It was in the build from v2.1.138 and was gone by v2.1.284.
Run only the hooks your organization deploys
Anthropic's own wording. Read off All settings, captured 2026-10-22.
In the changelogs
25Releases whose published page names allowManagedHooksOnly.
-
v2.1.300
Cowork cloud keeps strict managed policy settings once they are set
In Cowork cloud, once certain managed policy settings are tightened, a later settings update can no longer loosen them
found in this entry's text
-
v2.1.295
Your own hooks can keep running when
disableAllHooksis setWith
disableAllHooksset, Claude Code can now still run hooks from your own settings under certain conditionsfound in this entry's text
-
v2.1.283
Skill text can use a
${CLAUDE_DEV_MODS_DIR}placeholder for a live session folderClaude Code replaces
${CLAUDE_DEV_MODS_DIR}in skill text with a per-session folder and starts watching it for plugin changesfound in this entry's text
-
v2.1.282
Invalid managed settings now fall back to their strict value in one consistent way
Bad values in managed settings now fall back to the strict choice by one shared rule, and one bad
enabledPluginsentry no longer voids the restfound in this entry's text
-
v2.1.282
Skills and plugin commands can no longer grant themselves tools under managed-only permission rules
When policy restricts permission rules to managed settings, tool grants written into skills and plugin commands are ignored
found in this entry's text
-
v2.1.280
Hooks modules (plugin tests) early-access gate and messages
Plugin hook tests now give a specific reason when they can't run: rollout off, or disabled locally
found in this entry's text
-
v2.1.280
allowManagedHooksOnly now also scopes plugin hooks
allowManagedHooksOnly setting now also restricts which plugin hooks can run
found in this entry's text, named in this entry
-
v2.1.280
Hooks-module skip reasons now surface to the plugin author via a notification channel, not just debug logs
Plugins are now notified directly when their hooks module is skipped, not just via a debug log line
found in this entry's text
-
v2.1.280
New hooks-modules gate condition via BJ()
A new internal check can force 'managed hooks only' mode even without the matching policy setting
found in this entry's text, named in this entry
-
v2.1.271
New
claude plugin testCLI command for function-hooks pluginsNew
claude plugin testcommand runs a plugin's hook tests in a sandboxed environment that mimics the real runtimefound in this entry's text
-
v2.1.261
New diagnostics for org-managed hook restrictions on synced plugins
New diagnostics explain when org-managed hook restrictions or disabled settings are suppressing a synced plugin.
found in this entry's text
-
v2.1.261
Plugin loading gains 'sync-attributed' directories and managed-hooks-only enforcement
Plugin resolution now distinguishes sync-attributed plugins and enforces managed hooks-only rules.
found in this entry's text, named in this entry
-
v2.1.246
Clearer reason when an administrator has blocked plugin hooks
When managed settings block plugin hooks, the message now says that explicitly.
found in this entry's text
-
v2.1.242
Administrators and --bare can block plugin hooks from loading
Two managed settings can block plugin hooks entirely or allow only managed plugins.
named in this entry, found in this entry's text
-
v2.1.238
Managed settings can refuse plugin sources and marketplace updates
Admins can block plugins and marketplaces from unlisted sources, with refusals naming the policy.
named in this entry, found in this entry's text
-
v2.1.238
Plugin marketplaces and archives can mint HTTP headers from a command
Marketplaces and plugins can run a command to mint short-lived HTTP headers for fetching archives.
named in this entry, found in this entry's text
-
v2.1.229
Managed setting to block command-sourced plugins
A managed key blocks command-sourced plugins, falling back to your existing hook restriction.
named in this entry, found in this entry's text
-
v2.1.229
Marketplaces can ship a plugin built by running a local command
Marketplace plugins can be built by a local command, with a timeout and optional link mode.
named in this entry, found in this entry's text
-
v2.1.229
Plugins can be installed from a command that produces the plugin directory
Marketplaces can declare command plugin sources, and admins can block them with one setting.
named in this entry, found in this entry's text
-
v2.1.213
Hook System:
policySettingsSourcefound in this entry's text
-
v2.1.169
/goalError Message Updatedfound in this entry's text
-
v2.1.140
/goalNow Blocked byallowManagedHooksOnlyfound in this entry's text
- v2.1.10
-
v2.0.54
Enterprise Hook Control:
allowManagedHooksOnlyPolicy Settingfound in this entry's text
-
v2.0.54
Hook Loading Functions Renamed
found in this entry's text
First cited
7The earliest release whose published evidence quoted allowManagedHooksOnly was v2.1.140, 12 May 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
1 further span in the ledger name it. The list above is the earliest first and stops at 6.
Presence across releases
2Build by build
149One row per release since the first build this name was read out of. Absent means the build was read and the name was not in it, never mined means no bundle for that release was ever archived, and a declared type or a default is only ever what that release's own bundle stated.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the settings key does. All settings keys.