Hook System: policySettings Source / Claude Code v2.1.213

What

A new hook source type policySettings is recognized in the hook source registry. It joins userSettings, projectSettings, localSettings, pluginHook, sessionHook, and builtinHook.

Details

Represents enterprise managed settings delivered out-of-band by an administrator; displayed to users as "managed" (short), "Managed" (header), and "enterprise managed settings" (long form) in the settings/hooks UI
Unlike userSettings, projectSettings, and localSettings, policySettings is always included in the allowed sources list regardless of the --allow-setting-source CLI flag (it is force-added alongside flagSettings in the source filter)
policySettings.disableAllHooks = true disables all hooks entirely — even plugin hooks — across all sources
policySettings.allowManagedHooksOnly = true restricts hook execution to only policySettings.hooks; user, project, and local hooks are silently ignored for the session
If qi().disableAllHooks is true but policySettings.disableAllHooks is not true, hooks from managed settings still run (the setting overrides only non-managed hooks)
Hooks declared under policySettings.hooks are therefore the only hooks an administrator can guarantee will always run; user-side hooks can be suppressed without touching the user's own settings files
In hook priority sorting, hooks sourced from policySettings share bucket 999 with pluginHook and builtinHook, making them sort after user/project/local hooks in the display

Evidence

Hook source labels (search for "policySettings" in hook source map at new TJt variable); hook resolution logic (search for Lzi, iOe, QX, allowManagedHooksOnly, disableAllHooks)

Strings lifted out of the shipped bundle, so the claim above can be checked against them.