Deep-Diving into Claude Code Source

Claude Code is a TypeScript terminal application built with Ink (React for the terminal), the Anthropic SDK, Commander.js for CLI parsing, and Zod for input validation. Internal codename: "Tengu" — visible in all analytics events like tengu_init, tengu_api_query.

The end-to-end flow:

15 tools total. Read-only tools run concurrently (up to 10). Write tools run serially. Everything gates through the permission system: always-allowed (reads), session-scoped (file writes), persistent (bash commands).

It's the whole thing. The system field in the Messages API is the entire system-level instruction. There is no hidden base prompt server-side. What prompts.ts produces is all Claude sees.

Two reasons:

1. Primacy-recency attention bias — LLMs attend more strongly to content at the start and end of long prompts. Placing guardrails at both positions maximizes their influence.
2. Sandwich defense — the <context> blocks that follow contain user-controlled content (README, CLAUDE.md, git status). The second guardrail is the last thing before untrusted content enters the prompt. Defense against prompt injection in repo files.

This is best-effort. The real defense-in-depth is: prompt guardrails + permission system + Zod validation + command injection detection + file path restrictions + Docker-only bypass mode.

The "wizard comment" documents three API constraints the developer learned the hard way:

1. Thinking requires thinking — if history contains thinking blocks, the next call must have max_thinking_length > 0.
2. Thinking can't be terminal — a thinking block cannot be the last content block.
3. Thinking must be preserved — if an assistant turn has thinking + tool_use, those blocks must survive through tool_result and the next response.

And the two mechanisms are mutually exclusive by design:

If ThinkTool is enabled, maxThinkingTokens returns 0. Extended thinking wasn't available to external users at launch. ThinkTool was the externally-shippable workaround — a feature flag migration pattern: ship the tool-based workaround, gate the native feature, deprecate the workaround once native goes GA.

Yes. ThinkTool removed entirely in January 2026. Extended thinking went GA, then adaptive (thinking: {type: "adaptive"}) in February 2026. "Ultrathink" was deprecated, then re-introduced in March after users complained about losing the ability to force deep reasoning. The team learned that user agency over reasoning depth matters, even with adaptive mode.

The full arc: tool workaround → API feature (gated) → GA → fixed budget → adaptive → user-controlled effort levels. Simultaneously more automatic and more user-controllable.

No separate process. It calls the same query() function recursively within the same Node.js process:

• Fresh message history: [UserMessage(prompt)]
• Leaner system prompt (getAgentPrompt() — ~15 lines vs ~120)
• Read-only tools only. No Bash, no FileEdit. And no AgentTool itself — "No recursive agents, yet.."

The parent sees only the final text. The entire agent trajectory is compressed into a single tool_result. And because isReadOnly() = true, multiple agents run concurrently via the same pool used for read-only tools.

That comment — "No recursive agents, yet.." — suggested they'd eventually allow nesting. Instead, in v2.1.88, they went a different direction entirely: flat teams over deep trees.

Tools: 15 → 30+

ThinkTool removed. ArchitectTool replaced by EnterPlanMode/ExitPlanMode — planning promoted from a tool to a workflow. Memory tools replaced by auto memory. WebFetch and WebSearch added. Every addition reflects a bottleneck observed in real usage.

Agents: read-only singleton → specialized fleet

One dispatch_agent became five built-in types (Explore on Haiku, Plan on main model, general-purpose with full tool access), custom agents via .claude/agents/, and agent teams with inter-agent messaging. No recursion — flat teams over deep trees.

Permissions: 3-tier → 6-mode governance

Six modes: default, acceptEdits, plan, auto, dontAsk, bypassPermissions. Plus 28 hook events and auto mode — a second AI model reviewing each tool call. AI supervising AI.

Thinking: hidden keywords → adaptive reasoning

ThinkTool removed. Native thinking went GA, then adaptive. "Ultrathink" deprecated then un-deprecated. User agency over reasoning depth matters.

Context: static assembly → dynamic orchestration

3 prompt strings became 110+ assembled dynamically. Context 200K → 1M. CLAUDE.md survives compaction. Auto memory replaced explicit tools.

Every change increases autonomy while simultaneously increasing controllability. Auto mode makes the agent more autonomous. Hooks, rules, managed settings make it more controllable. The team is solving for "maximum useful autonomy within user-defined boundaries" — the central problem of AI deployment.

VCR — "Video Cassette Recorder." Deterministic test fixtures. SHA-1 hashes the dehydrated message history, replays cached responses. Solves the fundamental testing problem: API responses are non-deterministic.

Binary feedback — Ant-only RLHF. Two API calls in parallel, user picks the preferred response. This is why temperature = 1 — not for creativity, but to maximize variation between A/B calls.

MCP — Server configs loaded at startup, tools wrapped as standard Tool objects. MCP tools look identical to built-in tools from the model's perspective.

REPL — Not a readline loop. A React (Ink) component with a state machine managing messages, permissions, binary feedback, and input modes.

The bundled cli.mjs on npm contained an inline base64 source map. The full TypeScript source embedded as a data URL at the bottom of the compiled JavaScript. Discovered on February 24, 2025 — launch day.

A missing .npmignore or misconfigured files field in package.json. The extraction is trivial: decode the base64, parse the JSON, read the sourcesContent array. Every original TypeScript file, with comments intact.

Found and cloned Exhen/claude-code-2.1.88. The scale difference is staggering:

Discoveries that stopped me cold:

• KAIROS — autonomous daemon mode via cron scheduler, compile-time gated out of external builds
• BUDDY — virtual pet with 18 species, gacha rarities, RPG stats, ASCII sprites. Species names hex-encoded because "capybara" collides with a model codename in the build scanner
• Undercover mode — auto-activates for Anthropic employees on public repos, strips all internal info. "There is NO force-OFF."
• Anti-distillation — anti_distillation: ['fake_tools'] injected into API body to prevent competitor model training on outputs
• 4 sub-agent execution models — fork (cache-sharing), teammate (file mailbox), worktree (git isolation), remote (process isolation)
• GrowthBook replacing Statsig — richer targeting with subscriptionType, rateLimitTier, organizationUUID

Push failed initially — shallow clone had graft points where parent objects weren't downloaded. Fixed by reinitializing the git history from scratch.

claw-code is not a copy of Claude Code. It's a clean-room Python + Rust rewrite. Different language, different legal status, different purpose.

• 48,599 lines of Rust across 9 workspace crates, built in 3 days
• 292 commits, March 31 – April 3, 2026
• Maintained entirely by autonomous AI agents coordinated through Discord
• PHILOSOPHY.md: "humans set direction; claws perform the labor"

Why: DMCA-proof alternative. The TypeScript leaks are legally risky. A clean-room rewrite in a different language establishes independent creation. Also a demo of autonomous agent capability — 48K lines of systems Rust in 72 hours.

Seven modules, each with ordered reading lists and the design belief it reveals:

1. The Agentic Loop — query.ts → QueryEngine.ts. The recursive async generator.
2. System Prompt Engineering — prompts.ts → buildEffectiveSystemPrompt(). 3 strings → 110+ dynamic.
3. The Tool System — 15 inline → 40+ with deferred loading via ToolSearchTool.
4. Permission & Safety — 3-tier → 6-mode + LLM classifier + 23-check bash scanner.
5. Memory & Context — flat files → 4-type system + 5-stage compaction stack.
6. Multi-Agent — read-only singleton → fork/teammate/worktree/remote + coordinator.
7. Telemetry & Culture — Statsig → GrowthBook + BUDDY + hooks + undercover mode.

Three building blocks:

• yield — suspend and hand a value to the caller. The caller controls pacing (backpressure).
• yield* — delegate to another generator. Pipes — does not collect.
• async — each await pauses for I/O without blocking.

Mapping to query.ts

Three properties gained: streaming (first token in ~300ms), composability (AgentTool.call() does yield* query(agentMessages) — sub-agent events pipe into the parent with no special casing), and backpressure (Ctrl+C breaks the generator mid-execution, no wasted API calls).

SYSTEM_PROMPT_DYNAMIC_BOUNDARY = '__SYSTEM_PROMPT_DYNAMIC_BOUNDARY__'

Before every API call, splitSysPromptPrefix() splits the system prompt into 4 blocks:

scope: 'global' = cross-org cache. The block is identical for every Claude Code user worldwide. Cached once, shared globally. Everything after — environment info, memory, CLAUDE.md, git status — changes per user, per session.

MCP tools break global caching because schemas are per-user. Source comment: "IMPORTANT: Do not add any more blocks for caching or you will get a 400."

The boundary marker is load-bearing: moving content before it silently corrupts other users' caches.

Six categories, strict priority. First match wins:

The non-obvious case: proactive/KAIROS mode. Normal agents replace the default entirely. But when isProactiveActive() is true, agent instructions append to the default. The daemon already has the right base identity — the agent definition adds domain-specific behavior on top.

Two axes: identity (what kind of agent? winner-takes-all) and constraint (what additional rules? always composable via appendSystemPrompt). Override dropping append is intentional: loop mode needs total determinism.

KAIROS — The Daemon

A non-React cron scheduler core shared by the REPL and Agent SDK. Polls scheduled_tasks.json every second. Lock-based ownership — only one Claude session per project fires tasks. Non-owners probe every 5 seconds to take over if the owner crashes.

• GrowthBook killswitch — stops already-running schedulers mid-session, not just new ones
• Jitter config — ops can widen the window live during a :00 load spike without restarting clients
• Missed tasks — wraps prompts in a code fence whose length is max(3, longestBacktickRun + 1). Prevents a malicious task prompt from escaping the fence. Requires user confirmation before execution.

autoDream — Memory Consolidation

Triple gate (cheapest first): time ≥24h → sessions ≥5 → lock. Fires a forked subagent with bash restricted to read-only commands. Reviews past transcripts, improves memory files. User can kill from the bg-tasks dialog — lock rollback handles cleanup.

ULTRAPLAN — Remote Opus Planning

/ultraplan creates a Cloud Code Runner session, runs Opus in plan mode with a browser UI. The local repo is teleported via a git bundle:

1. git bundle create --all — full history (100MB max)
2. git bundle create HEAD — current branch only
3. git commit-tree HEAD^{tree} — single parentless commit, just the snapshot

The teleport sentinel — finally answered:

ULTRAPLAN_TELEPORT_SENTINEL = '__ULTRAPLAN_TELEPORT_LOCAL__'

When the user clicks "teleport back to terminal" in the browser, it sends an is_error: true tool_result with the sentinel on the first line, plan text on the next. Two exit paths: teleport (plan comes back to terminal, remote archived) or remote (CCR executes, delivers a PR). The ExitPlanModeScanner is a pure stateful classifier with no I/O — feed it recorded events for unit tests and offline replay.

Updated KNOWLEDGE.md — now 1,800+ lines across 14 sessions. Seven design beliefs extracted from the code:

1. The Loop Is the Product — recursive async generator, unchanged across versions
2. Safety Is the Architecture — 3-tier → 6 modes + LLM classifier + invisible sandbox bypass
3. Context Is the Scarce Resource — 1-stage compaction → 5-stage stack; tool deferral via ToolSearch
4. One Model Is Not Enough — single agent → 4 execution models + coordinator
5. The Boundary Is Architectural — compile-time dead-code elimination, undercover mode
6. Shipping Is a System — feature flags + kill switches + GrowthBook
7. Joy Is Not Optional — BUDDY, 187 spinner verbs, hex-encoded species names

Core thesis:

An agentic coding tool should be a reliable system, not a capable demo. v0.2.8 was the capable demo. v2.1.88 is the beginning of the system.

Published to twyoon.com.

14 sessions. Two source trees. 540,000 lines of TypeScript. Seven beliefs. One conclusion: the code is the artifact. The thinking is the product.