$ the-wire · showcase
Claude Code ships hooks-module plugins as source, security-guidance learns repo resolution
By RepoJournal · Filed · About Anthropic · Composed from the cited sources · methodology
Anthropic published the three hooks-module plugins built into Claude Code (sec-default, diff, telemetry) as complete, readable plugin folders, while security-guidance 2.0.8 learned to find the repository it is supposed to be guarding.
`mods/` lands in claude-code with three hook-module plugins as full source: `sec-default` (an organization's default outermost plugin), `diff` (exposed as `/diff`), and `telemetry` (surfaced under `$.telemetry`) [1]. Each folder is a complete plugin, and `mods/README.md` carries the layout. This is early access and the wire says so plainly: they load only where function hooks are enabled, and the API may change [1]. Read it as reference source for building your own hooks rather than as a stable surface.
security-guidance 2.0.7 → 2.0.8 rewrites where the plugin looks for the repository [2]. It now resolves the repo from `git -C <dir>` / `cd <dir>` in the hook command, from the commit SHA, and from edited file paths when the hook cwd is not a git repository; an explicit `git -C <dir>` / `cd <dir>` naming another repository takes precedence over the hook cwd [3]. It adds PostToolUse matchers for `git -C … commit` and `git -C … push`, registers `SubagentStop`, and adds `repo_resolution` / `cwd_is_repo` metric fields [2]. The SubagentStop behavior is the part to read before upgrading: reviews no longer consume or advance the session's Stop state, an identical diff is not reviewed twice, and a SubagentStop from a different working tree than the project is skipped [3]. Git invocation is hardened, tokenizing keeps Windows path separators, and diff/show invocations add `--no-textconv` [3].
buffa's descriptor reject invalid extension range bounds: empty and reversed ranges where `start >= end` now fail with a new `PoolError::InvalidExtensionRange` carrying the message and the offending bounds [4]. Valid one-element ranges are kept, including `MAX_FIELD_NUMBER..MAX_FIELD_NUMBER + 1`, and failed pool additions stay transactional [4]. If you construct descriptors programmatically, a range you previously got away with will now be rejected at pool-add time.
Routine on the other desks: claude-code-action bumps Claude Code to 2.1.267 and Agent SDK to 0.3.267 [5], and claude-code's CHANGELOG.md and feed.xml were regenerated by the automation [6].
Action items
- → Review the security-guidance 2.0.8 SubagentStop and repository-precedence changes before upgrading anthropics/claude-plugins-official [plan]
- → Read mods/README.md in claude-code and treat the three plugins as early-access source, not a stable API anthropics/claude-code [monitor]
- → Check programmatic descriptor construction for empty or reversed extension ranges that buffa now rejects anthropics/buffa [plan]
References
- [1] Add mods: sec-default, diff and telemetry ↗ anthropics/claude-code
- [2] security-guidance: resolve repository from command and edited paths (2.0.7 → 2.0.8) ↗ anthropics/claude-plugins-official
- [3] Adjust SubagentStop handling and repository precedence ↗ anthropics/claude-plugins-official
- [4] descriptor: reject invalid extension range bounds ↗ anthropics/buffa
- [5] chore: bump Claude Code to 2.1.267 and Agent SDK to 0.3.267 ↗ anthropics/claude-code-action
- [6] chore: Update CHANGELOG.md and feed.xml ↗ anthropics/claude-code
