Policy helpers can now be delivered by remote settings, but only after an explicit consent record — and they run in a scrubbed environment

policyHelpers previously only came from admin sources (MDM or managed settings). It can now also be armed from remote settings, but a remote-armed helper won't run until its payload is both verified and explicitly consented to; without consent it logs "not yet approved in the managed-settings dialog" and emits settings_policy_helpers_per_os / remote_consent_missing telemetry. Consent is stored under remote-settings-helper-consent (now included in the purge list), is revoked automatically if the payload changes, and revoking mid-execution discards the helper's output.

A remote-armed helper also runs in a hardened environment: known secret variables like ANTHROPIC_API_KEY, AWS_SESSION_TOKEN, and GOOGLE_APPLICATION_CREDENTIALS, plus loader-hijack variables such as LD_, DYLD_, NODE_OPTIONS, and GIT_ prefixes, are stripped, and PATH/HOME-like variables are pinned to fixed values under /var/empty/claude-code-policy-helper (or the Windows equivalent). This only applies to organizations whose remote settings include a per-OS policyHelpers entry and who approve it.