All Claude Code modspomesaka/dotclaude
refs
A list of the documents and URLs this session relied on, kept by the agent with add_reference and shown in a pane; adds a refs button to the line under the prompt
review UI rewrite
refs reaches L2 (writes or runs) and passed claude plugin validate on Claude Code 2.1.304.
- Events hooked: 4
- API methods referenced: 14
- Access from classified calls: L2, writes or runs: runs processes, drives Claude, writes the clipboard, reads mod state, persists state, draws
- Reads mod state: the scan does not record whose state, so this does not show that it reads another mod’s values
- Static scan, not a runtime test
Install hint
/plugin install refs --marketplace pomesaka/dotclaudeFrom the repository's own marketplace. Confirm the plugin name in the repository's README before installing. Mods need Claude Code 2.1.287 or later.
Access
L2 Writes or runsruns processes, drives Claude, writes the clipboard, reads mod state, persists state, drawsValidation
Passed on Claude Code 2.1.304View the source on GitHub Back to the list
What the scan recorded
- Observed events
- classic hooks, mcp__refs__add_reference calls, mcp__refs__remove_reference calls, mcp__refs__clear_references calls, every tool call
- Hooks
session.start, classic.SessionStart, tool.call {tool=mcp__refs__add_reference}, tool.call {tool=mcp__refs__remove_reference}, tool.call {tool=mcp__refs__clear_references}, tool.call, ui.render {component=PromptHint}, ui.render {component=Pane, requestId=references}- API calls
$.process.run, $.session.id, $.state.get, $.state.set, $.store.delete, $.store.get, $.store.keys, $.store.set, $.tool.register, $.ui.close, $.ui.copy, $.ui.open, $.ui.resolve, $.ui.toast- Validation on 2.1.304
- Passed
- Scanned revision
42178cafaff0- Marketplace warnings
- dotclaude
- UI rewrite review
- UI hook source contains control-character strings. Review any values passed to next() as rewritten props.text; the scanner does not trace whether these strings reach that call. mods/refs/hooks/references.ts:45
These are the hooks and API calls reported by claude plugin validate. Access levels describe the widest reach of those calls and are not safety ratings. Validation is a static check, not a runtime test, and a passing result does not prove that a mod works or is safe. What a mod can access and how the scan works.
More from pomesaka/dotclaude
- danger-guardBefore the agent runs a Bash command, blocks the ones that can wreck the machine or the user's data beyond th…
- devrepupdate_devrep tool: while turned on for a session, the agent keeps a short report of where the work stands (d…
- human-edithuman_edit tool: the agent asks the user to edit a file in a tmux split pane and waits until the editor exits
- jjAdds the jj counts (changed files, unpushed commits) and commit and log buttons to the line under the prompt,…
- next-stepAfter a turn, shows up to four prompts the user is likely to type next as cards above the prompt: Claude Code…
- prA list of the pull requests this session created or edited, with CI and review state, shown in a pane; watche…
- publish-guardBefore the agent pushes from a repository that has scripts/check-public.sh, runs that check and blocks the pu…
- questionsA list of the decisions the agent made provisionally so work could continue, kept with add_question and shown…
- quiet-promptsDraws a prompt that another plugin submitted on its own (a reminder, a notice) as one line in the transcript,…
- richshow tool: the agent draws cards, a box-and-arrow diagram, tables and clickable questions inline in the trans…
- status-bandA line under the prompt that replaces the status line: model, context use and directory. Other mods add their…
Badge for your README
Authors can show the latest scan result in their README. Each badge links to this page.
[](https://mods.aidojo.si/mods/pomesaka--dotclaude--refs/)
[](https://mods.aidojo.si/mods/pomesaka--dotclaude--refs/)