Anthropic's flagship CLI tool — 512,000+ lines of TypeScript — was accidentally exposed via an npm source map. Within hours, thousands of developers had reverse-engineered the entire architecture.
A packaging bug led to the largest accidental source code exposure in the AI coding tool space.
oven-sh/bun#28001 reported: Bun serves source maps in production mode despite docs stating otherwise. The ticking time bomb.@anthropic-ai/claude-code was published with a 59.8 MB source map file (.map) accidentally bundled. The .map file contained full paths back to the original TypeScript source.The leak spawned an ecosystem of mirrors, reimplementations, and analysis repos.
Claude Code is a 512K-line TypeScript monolith built on Bun, React + Ink, with game-engine rendering techniques. Five core subsystems power the entire experience.
Not your typical Node.js CLI. Claude Code uses game-engine-level optimizations for terminal rendering.
cch=00000 header).The entire Claude Code architecture decomposes into five major subsystems, each responsible for a critical dimension of the agent experience.
ToolSearchTool for elastic discovery, keeping base prompts under 200K tokens. Each tool definition includes a JSON schema, permission requirements, and execution handler.autoDream process runs memory merging while idle.How Claude Code keeps conversations going without losing critical information.
A three-tier cascade with fail-closed defaults — every tool action must pass through validation before execution. Sources: [sathwick.xyz] [Straiker]
validateInput()checkPermissions()PermissionResult{ behavior: 'allow', updatedInput? } | { behavior: 'ask', message } | { behavior: 'deny', message }buildTool() factory defaults to "ask" if a tool doesn't declare its permission level.
| Mode | Type | Behavior |
|---|---|---|
default | Public | Prompts user for permission on first use of each tool |
plan | Public | Read-only — Claude can analyze but not modify files or execute commands |
acceptEdits | Public | Auto-approves file edit permissions for the session |
dontAsk | Public | Auto-denies tools unless pre-approved via /permissions or permissions.allow rules |
bypassPermissions | Public | Skips permission prompts (writes to .git, .claude, .vscode, .idea still prompt) |
auto | Internal | Uses a classifier model to decide safety per action. Reads autoMode config and uses prose-based environment descriptions for "trusted infrastructure" determination. Research preview. |
bubble | Internal | Delegates permission decision to parent agent in multi-agent orchestration scenarios |
Bash(git push *), Bash(npm run *), Bash(* --version)* enforces word boundaries — Bash(ls *) matches ls -la but NOT lsof.&&, so Bash(safe-cmd *) will NOT permit safe-cmd && rm -rf /.//path (filesystem root), ~/path (home), /path (project root), ./path (CWD).
PreToolUse hooks run before the permission prompt and can force-deny, force-allow, or force-ask.sandbox-exec) framework for process-level enforcement.bwrap) for filesystem/network isolation. WSL2 uses bubblewrap; WSL1 is unsupported.allowWrite/denyWrite/denyRead/allowRead paths.dangerouslyDisableSandbox (goes through normal permissions flow).shell-quote parsing, and tree-sitter AST analysis. Documented checks include:=curl bypassing permission for curl) • Obfuscated flags via $'...' ANSI-C quoting • Backslash-escaped operators../, URL-encoded, symlinks) • Case-insensitive path manipulation • Redirection validation • Safe command substitutionvalidateGitCommit • Git command parsingvalidateGitCommit can return allow, which short-circuits ALL subsequent validators. The source contains explicit warnings about past exploitability. Commands are parsed through three different functions (splitCommand_DEPRECATED, tryParseShellCommand, ParsedCommand.parse) each with different edge-case behavior.shell-quote's character class treats CR as a word separator (JS \s includes \r), but bash's IFS does NOT include CR — a parser differential that could be exploitable.
When your token bill drives product economics, cache stability is a first-class engineering concern. Sources: [sathwick.xyz] [kuber.studio]
PromptCacheBreakDetection.ts tracks 14 distinct vectors that can invalidate the prompt cache. Documented categories include:tengu_)tengu_). The function getFeatureValue_CACHED_MAY_BE_STALE() avoids blocking the main loop for flag lookups — treating stale data as acceptable rather than busting the cache to get fresh values.deactivate() method — intentional. Once latched, latched.
getTools() → filterToolsByDenyRules() → uniqBy(name) → sort(name)shouldDefer: true, keeping the base prompt under 200K tokens. Deferred tools are discovered on-demand via ToolSearchTool.
SYSTEM_PROMPT_DYNAMIC_BOUNDARY marker that splits content into two regions:cache_control blocks.DANGEROUS_uncachedSystemPromptSection() explicitly marks sections as cache-volatile. The DANGEROUS_ naming convention serves as a warning to developers against carelessly adding cache-volatile content to the static region.CacheEditsBlock — preventing cache invalidation during incremental context compression.
MAX_CONSECUTIVE_AUTOCOMPACT_FAILURES = 3 circuit breaker, Claude Code was wasting ~250,000 API calls per day from auto-compact failure loops. 1,279 sessions hit 50+ consecutive failures. Failed compactions were thrashing the cache on every retry — paying full price each time. The fix was three lines of code.
The source code revealed 44 feature flags, many of which expose capabilities never publicly documented. Some are playful, others are deeply controversial.
/dream skill, daily logs, GitHub webhook subscriptions, and 5-minute cron cycles. Referenced 150+ times in the source code. Suggests Claude Code was being developed as far more than a CLI — an autonomous development companion.CLAUDE_CODE_UNDERCOVER=1 is set, Claude Code injects instructions to never reveal AI authorship in commits and pull requests on public repos. No force-OFF switch exists. Also guards against model codename leaks (e.g., "Capybara," "Tengu"). This was one of the most debated discoveries — raising questions about transparency in AI-generated code.ANTI_DISTILLATION_CC flag injects fake/decoy tool definitions into system prompts to poison training data from anyone recording API traffic. Requires four conditions to activate. A defensive measure against model distillation by competitors monitoring the API.cch=00000 placeholder header replaced by Bun's Zig-based HTTP stack with a computed hash — cryptographic proof of an authentic Claude Code binary. Essentially transport-layer DRM to prevent unauthorized API access through unofficial clients.userPromptKeywords.ts uses regex patterns to detect user frustration in real-time. A cheaper alternative to running a sentiment analysis LLM call — just regex match against common frustration patterns and adjust behavior.Claude Code's security model revealed a surprisingly rigorous defense-in-depth approach to bash execution, permission management, and prompt integrity.
BashSecurity.ts implements a comprehensive defense layer against shell injection and escape attacks.
=command expansion attacks unique to Zsh's extended globbing — a vector most security tooling misses.../ sequences and symlink attacks.Source code comments and error tracking revealed real production metrics.
The most valuable engineering patterns extracted from Claude Code's codebase by the developer community. These are production-tested at massive scale.
Int32Array-backed char pools) make a real, measurable difference in terminal UX. Don't treat CLI rendering as an afterthought.ToolSearchTool fetches tool definitions only when the model actually needs them.userPromptKeywords.ts pattern-matches common frustration signals. Not everything needs to be an LLM call.MAX_CONSECUTIVE_AUTOCOMPACT_FAILURES = 3. Always set circuit breakers on retry loops — unbounded retries will destroy your API bill.PromptCacheBreakDetection.ts file alone tracks 14 cache-break vectors.onChangeAppState() function. This creates a single chokepoint for debugging, logging, and permission checking. One function to audit, not forty.Concrete patterns you can apply to your own AI agent projects, extracted from Claude Code's architecture.
At its heart, Claude Code runs a deceptively simple loop. The complexity is in the subsystems, not the orchestration.
At its core, Claude Code proves that a powerful AI coding agent can be built from a surprisingly simple foundation: an LLM with bash access and a well-designed tool system. The 512K lines exist not because the core idea is complex, but because production-grade execution — rendering, security, caching, error recovery, multi-agent orchestration — demands engineering depth. The architecture is a testament to the principle: simple core idea, complex execution.
Every blog post, forum thread, news article, and repository referenced in this analysis.