NHacker Next
  • new
  • past
  • show
  • ask
  • show
  • jobs
  • submit
Claude Code's source code has been leaked via a map file in their NPM registry (twitter.com)
treexs 1 hours ago [-]
The big loss for Anthropic here is how it reveals their product roadmap via feature flags. A big one is their unreleased "assistant mode" with code name kairos.

Just point your agent at this codebase and ask it to find things and you'll find a whole treasure trove of info.

Edit: some other interesting unreleased/hidden features

- The Buddy System: Tamagotchi-style companion creature system with ASCII art sprites

- Undercover mode: Strips ALL Anthropic internal info from commits/PRs

avaer 24 minutes ago [-]
(spoiler alert)

Buddy system is this year's April Fool's joke, you roll your own gacha pet that you get to keep. There are legendary pulls.

They expect it to go viral on Twitter so they are staggering the reveals.

ben8bit 59 minutes ago [-]
[dead]
lukan 15 minutes ago [-]
Neat. Coincidently recently I asked Claude about Claude CLI, if it is possible to patch some annoying thing (like not being able to expand Ctrl + O more than once, so never be able to see some lines and have more control over the context) and it happily proclaimed it is open source and it can do it ... and started doing something. Then I checked a bit and saw, nope, not open source. And by the wording of the TOS, it might brake some sources. But claude said, "no worries", it only break the TOS technically. So by saving that conversation I would have some defense if I would start messing with it, but felt a bit uneasy and stopped the experiment. Also claude came into a loop, but if I would point it at this, it might work I suppose.
avaer 45 minutes ago [-]
Would be interesting to run this through Malus [1] or literally just Claude Code and get open source Claude Code out of it.

I jest, but in a world where these models have been trained on gigatons of open source I don't even see the moral problem. IANAL, don't actually do this.

https://malus.sh/

NitpickLawyer 44 minutes ago [-]
The problem is the oauth and their stance on bypassing that. You'd want to use your subscription, and they probably can detect that and ban users. They hold all the power there.
woleium 37 minutes ago [-]
Just use one of the distilled claude clones instead https://x.com/0xsero/status/2038021723719688266?s=46
avaer 39 minutes ago [-]
You'd be playing cat and mouse like yt-dlp, but there's probably more value to this code than just a temporary way to milk claude subscriptions.
dhruv3006 10 minutes ago [-]
I have a feeling this is like llama.

Original llama models leaked from meta. Instead of fighting it they decided to publish them officially. Real boost to the OS/OW models movement, they have been leading it for a while after that.

It would be interesting to see that same thing with CC, but I doubt it'll ever happen.

Squarex 18 minutes ago [-]
Codex and gemini cli are open source already. And plenty of other agents. I don't think there is any moat in claude code source.
rafram 11 minutes ago [-]
Well, Claude does boast an absolutely cursed (and very buggy) React-based TUI renderer that I think the others lack! What if someone steals it and builds their own buggy TUI app?
theanonymousone 17 minutes ago [-]
I am waiting now for someone to make it work with a Copilot Pro subscription.
ChicagoDave 9 minutes ago [-]
I hope everyone provides excellent feedback so they improve Claude Code.
dheerajmp 23 minutes ago [-]
karimf 34 minutes ago [-]
Is there anything special here vs. OpenCode or Codex?

There were/are a lot of discussions on how the harness can affect the output.

isodev 4 minutes ago [-]
Can we stop referring to source maps as leaks? It was packaged in a way that wasn’t even obfuscated. Same as websites - it’s not a “leak” that you can read or inspect the source code.
vbezhenar 51 minutes ago [-]
LoL! https://news.ycombinator.com/item?id=30337690

Not exactly this, but close.

anhldbk 16 minutes ago [-]
I guess it's time for Anthropic to open source Claude Code.
DeathArrow 10 minutes ago [-]
And while they are at it, open source Opus and Sonet. :)
3 minutes ago [-]
mapcars 1 hours ago [-]
Are there any interesting/uniq features present in it that are not in the alternatives? My understanding is that its just a client for the powerful llm
swimmingbrain 1 hours ago [-]
From the directory listing having a cost-tracker.ts, upstreamproxy, coordinator, buddy and a full vim directory, it doesn't look like just an API client to me.
58 minutes ago [-]
LeoDaVibeci 1 hours ago [-]
Isn't it open source?

Or is there an open source front-end and a closed backend?

avaer 1 hours ago [-]
No, it was never open source. You could always reverse engineer the cli app but you didn't have access to the source.
dragonwriter 60 minutes ago [-]
> Isn't it open source?

No, its not even source available,.

> Or is there an open source front-end and a closed backend?

No, its all proprietary. None of it is open source.

karimf 33 minutes ago [-]
The Github repo is only for issue tracker
matheusmoreira 19 minutes ago [-]
Wow it's true. Anthropic actually had me fooled. I saw the GitHub repository and just assumed it was open source. Didn't look at the actual files too closely. There's pretty much nothing there.

So glad I took the time to firejail this thing before running it.

agluszak 1 hours ago [-]
You may have mistaken it with Codex

https://github.com/openai/codex

yellow_lead 1 hours ago [-]
No
bob1029 59 minutes ago [-]
Is this significant?

Copilot on OAI reveals everything meaningful about its functionality if you use a custom model config via the API. All you need to do is inspect the logs to see the prompts they're using. So far no one seems to care about this "loophole". Presumably, because the only thing that matters is for you to consume as many tokens per unit time as possible.

The source code of the slot machine is not relevant to the casino manager. He only cares that the customer is using it.

esseph 56 minutes ago [-]
> The source code of the slot machine is not relevant to the casino manager.

Now do you want the list of the people it would be relevant to?

People playing the game, criminals, auditors that could shut the casino down and/or fine them.

Much bigger pool of people.

DeathArrow 14 minutes ago [-]
I wonder what will happen with the poor guy who forgot to delete the code...
matltc 5 minutes ago [-]
Ha. I'm surprised it's not a CI job
epolanski 10 minutes ago [-]
Responsibility goes upwards.

Why weren't proper checks in place in the first place?

Bonus: why didn't they setup their own AI-assisted tools to harness the release checks?

DeathArrow 7 minutes ago [-]
Why is Claude Code, a desktop tool, written in JS? Is the future of all software JS or Typescript?
bigbezet 22 seconds ago [-]
It's not a desktop tool, it's a CLI tool.

But a lot of desktop tools are written in JS because it's easy to create multi-platform applications.

jsk2600 1 minutes ago [-]
Original author of Claude Code is expert on TypeScript [1]

[1] https://www.amazon.com/Programming-TypeScript-Making-JavaScr...

q3k 60 minutes ago [-]
The code looks, at a glance, as bad as you expect.
tokioyoyo 8 minutes ago [-]
It really doesn’t matter anymore. I’m saying this as a person who used to care about it. It does what it’s generally supposed to do, it has users. Two things that matter at this day and age.
breppp 8 minutes ago [-]
Honestly when using it, it feels vibe coded to the bone, together with the matching weird UI footgun quirks
tokioyoyo 7 minutes ago [-]
Team has been extremely open how it has been vibe coded from day 1. Given the insane amount of releases, I don’t think it would be possible without it.
loevborg 56 minutes ago [-]
Can you give an example? Looks fairly decent to me
Insensitivity 50 minutes ago [-]
the "useCanUseTool.tsx" hook, is definitely something I would hate seeing in any code base I come across.

It's extremely nested, it's basically an if statement soup

`useTypeahead.tsx` is even worse, extremely nested, a ton of "if else" statements, I doubt you'd look at it and think this is sane code

Overpower0416 7 minutes ago [-]

  export function extractSearchToken(completionToken: {
    token: string;
    isQuoted?: boolean;
  }): string {
    if (completionToken.isQuoted) {
      // Remove @" prefix and optional closing "
      return completionToken.token.slice(2).replace(/"$/, '');
    } else if (completionToken.token.startsWith('@')) {
      return completionToken.token.substring(1);
    } else {
      return completionToken.token;
    }
  }
Why even use else if with return...
matltc 2 minutes ago [-]
Lol even the name is crazy
loevborg 32 minutes ago [-]
useCanUseTool.tsx looks special, maybe it'scodegen'ed or copy 'n pasted? `_c` as an import name, no comments, use of promises instead of async function. Or maybe it's just bad vibing...
Insensitivity 29 minutes ago [-]
Maybe, I do suspect _some_ parts are codegen or source map artifacts.

But if you take a look at the other file, for example `useTypeahead` you'd see, even if there are a few code-gen / source-map artifacts, you still see the core logic, and behavior, is just a big bowl of soup

luc_ 45 minutes ago [-]
Fits with the origin story of Claude Code...
q3k 43 minutes ago [-]

  1. Randomly peeking at process.argv and process.env all around. Other weird layering violations, too.
  2. Tons of repeat code, eg. multiple ad-hoc implementations of hash functions / PRNGs.
  3. Almost no high-level comments about structure - I assume all that lives in some CLAUDE.md instead.
delamon 13 minutes ago [-]
What is wrong with peeking at process.env? It is a global map, after all. I assume, of course, that they don't mutate it.
hu3 8 minutes ago [-]
For one it's harder to unit test.
s3p 14 minutes ago [-]
It probably exists only in CLAUDE or AGENTS.md since no humans are working on the code!
loevborg 29 minutes ago [-]
You're right about process.argv - wow, that looks like a maintenance and testability nightmare.
darkstar_16 6 minutes ago [-]
They use claude code to code it. Makes sense
PierceJoy 21 minutes ago [-]
Nothing a couple /simplify's can't take care of.
kevinbaiv 9 minutes ago [-]
[dead]
mergeshield 27 minutes ago [-]
[dead]
sixhobbits 11 minutes ago [-]
[dead]
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact
Rendered at 10:19:35 GMT+0000 (Coordinated Universal Time) with Vercel.