Anthropic published the source of Claude Code's built-in plugins, and a second plugin architecture came with it

On September 9, Anthropic added a mods/ folder to the public claude-code repo containing the full source of three plugins compiled into the binary: sec-default, diff and telemetry. 52 commits by September 13. None of it appears in the CHANGELOG, so the repo is running ahead of the release notes.

A mod is a plugin whose behavior is a hooks module instead of a hooks.json of shell commands. One register(on, options) entry point, functions shaped ($, e, next), registered against the engine's own events. The contract is public now: mods/types/claude-code.d.ts is 9,880 lines generated by /plugin-types, naming roughly 80 hookable events across session.*, turn.*, tool.*, prompt.*, ui.*, fs.*, store.*, clock.*, model.*, plus mcp.call, http.fetch, process.run and engine.create. The old settings hooks survive as classic.PreToolUse, just another event. Hooks nest in five ordered tiers, outermost first: prepend, user, append, builtin, core, where prepend and append are administrator-listed plugins and user is everything a person installs.

Which creates a problem, and sec-default is the answer to it. Function hooks give every plugin a say on every event, so things an org previously controlled outright (classic hooks, managed CLAUDE.md and rules, settings, the MCP allowlist) became reachable from the user tier. sec-default is seated first in the prepend tier on any machine with managed settings or any Team/Enterprise org, and has exactly three moves: next.to(e, "append") to skip the user tier entirely, { deny } for a user-tier caller, or pass. It skips the user tier on classic.*, prompt.section, prompt.context, skill.prompt, attribution.text and settings.read. And it fails closed. An unreadable policy counts as a policy in force.

Three things you can do this afternoon. Run a built-in from source with claude --plugin-dir mods/diff to read the shipped /diff implementation as ordinary TypeScript, with the one asymmetry that sec-default's next.to is refused outside a managed tier, so loading it that way gives you a plugin that can only pass. Write real tests with claude plugin test mods/diff, a different command from claude plugin eval, which imports { describe, expect, mock, test, tier } from claude-code/testing, declares its tier with tier('builtin'), and receives the engine's own $. Any engine call your mocks leave unanswered throws and names its event, so an incomplete mock fails instead of passing silently. And audit telemetry if you care where rows go: $.telemetry.log({ event, props }) POSTs as tengu_plugin_<event>, nothing free-form gets through (snake_case tokens only, values must be a finite number, a boolean, or a Choice), and it sends nothing under DISABLE_TELEMETRY, CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC or DO_NOT_TRACK, on Bedrock/Vertex/Foundry, or on a deployment with its own OAuth URL. Each switch is re-read at every call.

I've written a dozen hooks.json shell hooks and every one was a small shell script pretending to be an API. This is the API. The five-tier ordering and a fail-closed security mod seated at position zero is more architecture than the plugin system had a week ago, and publishing the reference implementations is the part that makes it usable instead of aspirational.