How it got out

On March 31 a source map file shipped alongside the Claude Code npm package, which turns minified JavaScript back into readable source. The package was pulled once the mistake was noticed, but mirrors already existed and the code was picked apart on Hacker News and GitHub within hours. We are going to read what the analysis reported rather than the code, and we are not going to reproduce any of it. The interesting thing here is not the source, it is what a shipped agent harness turns out to be made of.

The short version is that the harness is far larger and more defensive than the tidy mental model of an agent suggests. Mihail Eric's well-known piece makes the point that the core loop of a coding agent, send request, model picks a tool, program runs it, result goes back, is about 200 lines. That is true and it is also the part that matters least in production. Everything else in the leaked harness is the difference between that loop and a product.

The clever parts

Some of what was found is genuine engineering worth naming. The reported anti-distillation flag injects fake tool definitions into the API request, so that traffic captured by someone trying to clone the tool by recording its behaviour is polluted with tools that do not exist. Whatever one thinks of the goal, poisoning a scraped training set with plausible decoys is a real idea, not a hack. A second mechanism reportedly summarises connector text server-side with cryptographic signatures, keeping reasoning chains out of recordable traffic.

The performance notes are the most educational. One comment reportedly traced roughly 250,000 wasted API calls a day, globally, to consecutive context compaction failures, fixed by capping retries at three. That is the kind of number you only get from operating at scale, and it is a good reminder that in an agent the expensive bugs are in the loop control, not the prompt. There was also an unreleased autonomous mode with background daemon workers, webhook subscriptions and five-minute refresh cycles, which reads as the direction these tools are heading.

The workarounds

Then there is the part that is funny and instructive. The harness reportedly contains a regex that matches user profanity and frustration, terms like wtf and variants of pissed off, to detect when a user is annoyed. An LLM company using a regular expression for sentiment rather than an inference call is exactly the kind of pragmatic shortcut real systems are full of, and the analyst's own note is fair, a regex is faster and cheaper than a model call. It is a workaround, and it is the right workaround.

The codebase shape tells the same story. One function in the print file reportedly ran 3,167 lines with twelve levels of nesting inside a file of 5,594 lines. That is not how anyone designs a printer, it is how a printer grows when every edge case in a shipping product gets its own branch. The gap between the 200-line clean loop and the 5,594-line print file is the actual work of turning a demo into something people rely on daily.

The uncomfortable parts

Two reported features are worth flagging plainly. One is an undercover mode that strips traces of internal tooling from non-internal repositories and instructs the model never to mention internal codenames, with the note that there is no way to force it off because it guards against codename leaks. The other is a native client attestation layer, a DRM-style cryptographic check below the JavaScript runtime, reportedly using a Zig-based hash, to verify that requests come from a genuine client.

These are not agent-reasoning features, they are supply-chain and secrecy controls, and their presence is the honest picture of what a commercial agent carries. A frustration regex is a shortcut. Attestation and codename stripping are a company drawing boundaries around what its tool will reveal about itself. Reading them is a reminder that the harness is a business artifact as much as a technical one, and that the parts protecting the company are woven through the parts serving the user.

What we take from it

If you build agents, the leak is a free look at the ratio nobody publishes. The reasoning loop is small and mostly solved. The mass of the system is retry logic, compaction, error handling, cost control, and a long tail of product-specific branches, plus a layer of defensive and secrecy machinery that has nothing to do with making the agent smarter. Eric's 200 lines get you the behaviour. The other several thousand get you something people trust with their code.

The thing we would not do is over-read the clever parts. Fake-tool injection and signed summaries are interesting, but a competitor does not need the source to build a good coding agent, as the 200-line demo shows. What the source gives away is the accumulated knowledge of which edge cases bite and how much they cost, and that is exactly the kind of thing you cannot get from a clean reimplementation. The value that leaked is the scar tissue, not the architecture.

Sources

  1. Alex Kim, Notes on the Claude Code source leak (March 31, 2026)
  2. Mihail Eric, The Emperor Has No Clothes: coding a coding agent in 200 lines