{"version":"2.1.234","anchor":"managed-policy-helpers-can-be-an-inline-script-instead-of-an","canonical_anchor":"managed-policy-helpers-can-be-an-inline-script-instead-of-an","heading":"Managed policy helpers can be an inline script instead of an executable","tier":"use","area":"Managed Settings","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234\/e\/managed-policy-helpers-can-be-an-inline-script-instead-of-an","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234","markdown":"### Managed policy helpers can be an inline script instead of an executable\n\nAdmins can now supply managed policy helpers as an inline script instead of a file on disk.\n\n**What**\n\nThe admin-controlled `policyHelpers` config, which computes managed settings at startup, now accepts a `script` plus `interpreter` pair as an alternative to `path`. The script is handed to the interpreter over stdin and never written to disk. It is capped at 65536 characters, must be NUL-free valid UTF-8, and must be ASCII-only on Windows. The interpreter is fixed per operating system: `sh` on macOS, Linux and WSL, `pwsh` on Windows.\n\n**Details**\n\n- Validation now requires each entry to carry `path`, or `script` + `interpreter`, and\/or `defaultSettings` (a static settings payload); mixing `path` with `script` is rejected.\n- Inline scripts only work on the per-OS `policyHelpers` map. On the older singular `policyHelper` key they are refused with \"inline scripts are not supported on the singular policyHelper key\".\n- Execution is `\/bin\/sh -s` over stdin, or pwsh with `-Command` wrapping the script in a fixed fragment ending `catch { Write-Error $_; exit 1 }; exit $LASTEXITCODE`.\n- No feature flag guards the parser; it is reachable for anyone whose admin-controlled policy settings carry such an entry. None of this vocabulary existed in v2.1.233.\n\n**Evidence**\n\n`Inline helper script, delivered to the fixed interpreter over stdin (never written to disk)`, `inline scripts are not supported on the singular policyHelper key`\n\n- Area: Managed Settings\n- Names: `policyHelpers`, `script`, `interpreter`\n- Tier: Use it now\n- Useful: 2\/5\n- Signal: 3\/5"}