policyHelper
A Claude Code settings key, read out of the shipped bundle. It was in the build from v2.1.138 and was gone by v2.1.284.
Run an executable that computes managed settings at startup
Anthropic's own wording. Read off All settings, captured 2026-10-22.
In the changelogs
26Releases whose published page names policyHelper.
-
v2.1.296
Setting forceLoginMethod to gateway now leads to the gateway login
With forceLoginMethod set to "gateway" and no forceLoginGatewayUrl, Claude Code now treats gateway login as required
found in this entry's text
-
v2.1.295
New check on plugin settings loaded from machine-level files
Claude Code now checks plugin-related settings that come from settings files users cannot write to
found in this entry's text
-
v2.1.281
New policy-helper predicate requires a verified gateway host (hostVerdict)
A new check passes only when the gateway host has been verified and a policy helper is configured
found in this entry's text
-
v2.1.265
policyHelper refresh now reports retry attempt counts on failure
Telemetry for a failed background policyHelper refresh now includes how many attempts were made
found in this entry's text
-
v2.1.265
New retryable policy-helper execution engine with backoff, added under 'settings_policy_helpers_per_os'
Claude Code adds a retryable engine for organization-managed 'policyHelper' settings scripts, with backoff on transient failures
found in this entry's text, named in this entry
-
v2.1.265
policyHelpers per-source shadowing warning gated behind
managedSourcesBehavior: "merge"Claude Code now warns when multiple managed settings sources define conflicting policy helper config under merge mode
found in this entry's text
-
v2.1.265
policyHelpers per-entry onFailure and retries settings now validated for effect
Claude Code now flags policy helpers that require success but have no fallback settings
found in this entry's text
-
v2.1.265
policyHelper singular field now also warns for ignored onFailure/retries
Claude Code now warns if onFailure or retries is set on the singular policyHelper entry, since those are ignored there
found in this entry's text, named in this entry
-
v2.1.265
policyHelpers
onFailure/retriesper-OS validation messages addedClaude Code now warns when
onFailureorretriesare set on the wrongpolicyHelperkey, and can refuse to start if an OS-admin helper failsfound in this entry's text
-
v2.1.265
policyHelpers now honored from remote managed settings too
policyHelpers can now be delivered via remote managed settings, not just admin-controlled policy sources
found in this entry's text
-
v2.1.265
policyHelper per-OS fallback no longer logs an info message or telemetry event on default-payload fallback
policyHelper default-payload fallback no longer logs an info message or telemetry event
found in this entry's text
-
v2.1.257
Remote-armed policy helper failures now retry instead of giving up
A failed remote-armed policy helper is now retried on a timer instead of failing for good.
found in this entry's text
-
v2.1.257
Policy helper execution now has a hard-capped timeout and reports timeouts explicitly
The policy helper subprocess now has a hard timeout cap and reports a distinct timed_out error.
found in this entry's text, named in this entry
-
v2.1.242
Administrator policy helper stands down when a remote settings payload supersedes it
A local admin policy helper shuts itself down when remote settings supersede the policy it came from.
found in this entry's text
-
v2.1.242
Policy helpers can declare whether their settings merge or replace
Admins can say whether a per-OS policy helper's settings replace or merge over the source.
found in this entry's text
-
v2.1.235
Remote-armed policyHelpers are dropped if arming is revoked while the helper runs
Remote-armed policyHelper output is dropped if remote arming is revoked while the helper is still running
found in this entry's text
-
v2.1.234
Managed policy helpers can be an inline script instead of an executable
Admins can now supply managed policy helpers as an inline script instead of a file on disk.
found in this entry's text
-
v2.1.232
Warnings when policy helper settings are nested in the wrong place
Settings validation now warns when policy helper keys are nested where nothing reads them.
found in this entry's text
-
v2.1.232
Fixed policy payloads are validated like managed settings
Malformed admin fallback settings payloads are caught at startup instead of silently doing nothing.
found in this entry's text
-
v2.1.232
Managed settings: policy helpers can carry a static fallback payload
Admins can attach a static
defaultSettingspayload used when a policy helper is missing or fails.found in this entry's text
-
v2.1.228
A policy helper is only honoured from an admin settings source
A policyHelper only runs if it comes from admin settings; anywhere else it is ignored.
named in this entry, found in this entry's text
-
v2.1.228
A policy helper can no longer configure another policy helper
An admin policy helper can no longer chain to another policy helper.
named in this entry, found in this entry's text
-
v2.1.228
Managed policy helper failures throw instead of returning text
Managed policy lookup failures now raise typed errors with codes instead of returning a message.
found in this entry's text
-
v2.1.228
Managed settings accept per-OS
policyHelpersAdmins can set a different policy helper program per operating system with a new policyHelpers setting.
named in this entry, found in this entry's text
-
v2.1.228
New
policyHelpersmanaged-settings key for per-OS policy helper executablesSet policyHelpers per platform; WSL falls back to the linux entry, then to the single policyHelper.
named in this entry, found in this entry's text
-
v2.1.136
Enterprise Managed Settings Helper
found in this entry's text
First cited
16The earliest release whose published evidence quoted policyHelper was v2.1.228, 11 Aug 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
10 further spans in the ledger name it. The list above is the earliest first and stops at 6.
Presence across releases
2Build by build
150One row per release since the first build this name was read out of. Absent means the build was read and the name was not in it, never mined means no bundle for that release was ever archived, and a declared type or a default is only ever what that release's own bundle stated.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the settings key does. All settings keys.