CodeVetter · Repo Unpack · System map
anthropics/claude-code
There is no package.json and no CLI source in this tree. The product is installed separately; this repo holds plugins, the source of four mods that ship inside the binary, Bun scripts for GitHub issue lifecycle, and reference deployments. Runtime for mods is the Claude Code function-hook host (no DOM, no Node). CI typechecks mods with tsc and optionally runs claude plugin test. GitHub workflows call anthropics/claude-code-action with Workload Identity Federation rather than a static API key.
- README installs the product outside this repo (curl https://claude.ai/install.sh, brew install --cask claude-code, irm install.ps1, winget, or deprecated npm i -g @anthropic-ai/claude-code) and tells the user to run claude in a project. There is no package.json in the tree.
- mods/README.md defines a mod as a plugin whose behaviour is one register(on, options) entry hooking engine events as ($, e, next). The four shipped mods are sec-default (outermost when managed settings or a Team/Enterprise org exist, unless prependPlugins overrides), diff, telemetry, and agents-md. Each folder has .claude-plugin/plugin.json, hooks/hooks.json, and TypeScript under hooks/ importing types from claude-code.
- mods/types/claude-code.d.ts is the function-hook API, header-stamped 'Written by Claude Code 2.1.277' and '/plugin-types'. A hooks module is an ES module (.ts/.tsx/.js/…) with no require, no DOM, and no Node; JSX compiles against globals h and Fragment; UI elements come from $.ui.resolve(e), not globals. Tests import claude-code/testing and run under claude plugin test.
- mods/tsconfig.json typechecks every mod's hooks and tests: target es2023, module esnext, moduleResolution bundler, strict, noUncheckedIndexedAccess, noEmit, jsx react with jsxFactory h and jsxFragmentFactory Fragment, include types, */types/**/*.d.ts, */hooks, */tests.
- .github/workflows/mod-tests.yml runs on pull_request paths mods/**. It checks out with persist-credentials false, npm-installs @anthropic-ai/claude-code and typescript@5.9.3 globally, runs tsc -p mods/tsconfig.json, then for each mods/*/ with a tests/ dir runs claude plugin test, but exits 0 if claude plugin test --help lacks the usage line. Tests need CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1. Permissions are contents:read only.
- The marketplace manifest .claude-plugin/marketplace.json (name claude-code-plugins) lists 13 plugins sourced from ./plugins/* and does not list the four mods. mods/README.md says the mods are not in the marketplace; the copies that matter are already in the installed Claude Code.
- telemetry's plugin.json sets types to ./types/index.d.ts. That contract exports Telemetry and declares EngineInterface.telemetry. mods/tsconfig.json includes */types/**/*.d.ts so other mods (diff, agents-md) type $.telemetry.log/mark against it without copying the types.
- Issue automation is Bun, not the hook host. sweep.yml (cron 0 10,22 * * *) runs bun scripts/sweep.ts with GITHUB_TOKEN, GITHUB_REPOSITORY_OWNER, and GITHUB_REPOSITORY_NAME. auto-close-duplicates.yml (cron 0 9 * * *) runs bun scripts/auto-close-duplicates.ts and also passes STATSIG_API_KEY. issue-lifecycle-comment.yml runs bun scripts/lifecycle-comment.ts on issues labeled.
- Claude-invoking workflows (.github/workflows/claude.yml, claude-issue-triage.yml, claude-dedupe-issues.yml) use anthropics/claude-code-action@v1 and authenticate with Workload Identity Federation vars ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID, ANTHROPIC_SERVICE_ACCOUNT_ID, ANTHROPIC_WORKSPACE_ID plus id-token: write. claude.yml triggers when an issue, comment, or review contains @claude and passes --model claude-sonnet-4-5-20250929.
- .devcontainer/devcontainer.json names the environment Claude Code Sandbox, builds a Dockerfile with CLAUDE_CODE_VERSION latest, and adds Linux capabilities NET_ADMIN and NET_RAW. It installs the anthropic.claude-code VS Code extension.
- examples/gateway/aws and examples/gateway/gcp are reference artifacts (setup.sh, Dockerfile, gateway.yaml.example, terraform/) for a Claude apps gateway in front of Bedrock or the GCP equivalent. The AWS README says they are a working example, not a supported production deployment, and points at code.claude.com docs.
- examples/settings and examples/mdm are enterprise policy templates, not runtime code. settings-strict.json sets permissions.disableBypassPermissionsMode disable, ask Bash, deny WebSearch and WebFetch, allowManagedPermissionRulesOnly, allowManagedHooksOnly, and strictKnownMarketplaces []. MDM templates target Jamf/Kandji plist, Intune, and Group Policy and write managed settings that users cannot override.