the claude code sourcemaps leaked march 31
1# Claude Code — recovered source tree
2
3## What this is
4
5On **31 March 2026**, developers reported that the published npm package for Anthropic’s **Claude Code** CLI shipped a large bundled `cli.js` together with a **source map** (`.map`). Because the map pointed back to original paths and content, the TypeScript/React implementation could be reconstructed from the registry artifact. This repository holds that kind of **recovered `src/` tree** — useful for understanding architecture and integration, not an official release or supported SDK.
6
7## How it leaked
8
9Chaofan Shou (@Fried_rice) discovered the leak and posted it publicly:
10
11> Claude code source code has been leaked via a map file in their npm registry!
12>
13> — @Fried_rice, 31 March 2026
14
15The source map file in the published npm package contained a reference to the full, unobfuscated TypeScript source, which was downloadable as a zip archive from Anthropic’s R2 storage bucket.
16
17## Overview
18
19Claude Code is Anthropic’s official CLI tool that lets you interact with Claude directly from the terminal to perform software engineering tasks — editing files, running commands, searching codebases, managing git workflows, and more.
20
21This repository contains the leaked `src/` directory.
22
23| Property | Value |
24| ----------- | ------------------------------------ |
25| Leaked on | 2026-03-31 |
26| Language | TypeScript |
27| Runtime | Bun |
28| Terminal UI | React + Ink (React for CLI) |
29| Scale | ~1,900 files, 512,000+ lines of code |
30
31Discussion and context: [Hacker News thread on the npm source-map leak](https://news.ycombinator.com/item?id=47584540).
32
33**Legal / ethical note:** The underlying software is Anthropic’s proprietary product. This README describes structure for analysis only; redistribution or use beyond fair use / your local law is your responsibility.
34
35## How the codebase fits together
36
37The CLI is a **Bun-bundled** application whose spine is `src/main.tsx`: a [Commander](https://github.com/tj/commander.js)-based program named `claude` that registers global options, subcommands, and a `preAction` hook where trust, settings, telemetry gates, and prefetch work run before the interactive or print-mode loop.
38
39### Directory structure
40
41The tree below matches this repo’s `src/` layout. For root-level filenames, per-folder notes, and selected subtrees (`services/`, `tools/`, `utils/`), see [docs/directory-structure.md](docs/directory-structure.md).
42
43```text
44src/
45├── main.tsx
46├── QueryEngine.ts
47├── Task.ts
48├── Tool.ts
49├── commands.ts
50├── context.ts
51├── cost-tracker.ts
52├── costHook.ts
53├── dialogLaunchers.tsx
54├── history.ts
55├── ink.ts
56├── interactiveHelpers.tsx
57├── projectOnboardingState.ts
58├── query.ts
59├── replLauncher.tsx
60├── setup.ts
61├── tasks.ts
62├── tools.ts
63│
64├── assistant/
65├── bootstrap/
66├── bridge/
67├── buddy/
68├── cli/
69├── commands/
70├── components/
71├── constants/
72├── context/
73├── coordinator/
74├── entrypoints/
75├── hooks/
76├── ink/
77├── keybindings/
78├── memdir/
79├── migrations/
80├── moreright/
81├── native-ts/
82├── outputStyles/
83├── plugins/
84├── query/
85├── remote/
86├── schemas/
87├── screens/
88├── server/
89├── services/
90├── skills/
91├── state/
92├── tasks/
93├── tools/
94├── types/
95├── upstreamproxy/
96├── utils/
97├── vim/
98└── voice/
99```
100
101### High-level layers
102
103| Area | Role |
104| ------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------- |
105| **`main.tsx` + `cli/`** | Argument parsing, early startup (MDM/keychain prefetch side effects), routing to REPL, `-p`/`--print`, doctor, install, MCP helpers, etc. |
106| **`replLauncher.js` / `components/` / `ink/`** | Terminal UI built with **React + Ink**; dialogs, status, and input handling. |
107| **`services/api/`** | HTTP client to Anthropic APIs, bootstrap, files, session ingress, usage, retries. |
108| **`services/mcp/`** | Model Context Protocol: config parsing, stdio/SDK transports, connection manager, OAuth, enterprise/XAA paths. |
109| **`services/compact/`** | Session compaction (memory/context management hooks the model loop). |
110| **`services/lsp/`** | Optional LSP integration for editor-like features in the terminal workflow. |
111| **`tools/`** | Tool implementations the agent invokes (bash, read/write, grep/glob, web, todos, tasks, teammates, MCP tools, etc.). |
112| **`utils/swarm/`** | Multi-agent **teammate** flows: backends for tmux, iTerm, in-process runners, permission sync, reconnection. |
113| **`coordinator/`** | Gated behind bundle feature `COORDINATOR_MODE` (multi-agent coordination). |
114| **`assistant/`** | Gated behind bundle feature `KAIROS` (assistant / Agent SDK–oriented mode). |
115| **`plugins/`**, **`skills/`** | Bundled and user plugins; skill loading and telemetry. |
116| **`utils/settings/`**, **`services/policyLimits/`**, **`services/remoteManagedSettings/`** | Layered configuration, enterprise policy, and remote-managed settings. |
117| **`buddy/`**, **`upstreamproxy/`**, **`voice/`**, **`vim/`** | Product features (buddy flows, upstream proxy, voice, vim-style editing). |
118| **`utils/deepLink/`**, **`utils/claudeInChrome/`** | OS integration: URL schemes, Chrome native messaging, optional MCP entrypoints. |
119
120Execution paths converge on shared **state** (`state/`, `bootstrap/`), **permissions** (`utils/permissions/`), and **session storage** (`utils/sessionStorage.js`, hooks in `utils/sessionStart.js`). Non-interactive and SDK-style use share much of the same stack as the full-screen REPL, with different front-ends for I/O.
121
122## Documentation (GitHub Pages)
123
124Full internals documentation is built with **MkDocs Material** from [`docs-site/`](docs-site/). The site includes **system design** (layers, state flow, security/trust), **architecture** overview and **workflows**, a **developer hub** (editing docs, navigating `src/`, Bun feature flags), **guides** for greenfield agentic CLI and docs/CI patterns, **reference** pages per subsystem, **official docs map**, and **appendices** (directory layout, tools, env vars, glossary).
125
126- **Live site:** [https://mehmoodosman.github.io/claude-code-source-code/](https://mehmoodosman.github.io/claude-code-source-code/)
127- **Local preview:** `cd docs-site && python3 -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt && mkdocs serve`
128- **Publish:** pushing to `main` runs [`.github/workflows/pages.yml`](.github/workflows/pages.yml) and deploys to `gh-pages`.
129
130Canonical `site_url` and `repo_url` are set in [`docs-site/mkdocs.yml`](docs-site/mkdocs.yml) for this deployment. Forks should change those values to match their own GitHub user/org and Pages URL.
131
132**Contributing to docs:** edit Markdown under `docs-site/docs/`; keep the [official docs map](docs-site/docs/official-docs-map.md) in sync with [Anthropic’s docs index](https://code.claude.com/docs/llms.txt) when adding major features.
133
134### Next steps (forks / new clones)
135
1361. **Commit and push** so `main` includes `docs-site/` and `.github/workflows/pages.yml`.
1372. **Run the Pages workflow** (or wait for it on push).
1383. **Settings → Pages** → deploy from branch **`gh-pages`** / **`/ (root)`** (unless you switch to the GitHub Actions Pages source).
1394. Set **`site_url`** in `mkdocs.yml` to your live URL and align **`repo_url`** / **`extra.social`** with your fork, then push to refresh the site.
140
141## Repository layout
142
143- **`src/`** — Application source (thousands of modules) as recovered from the bundle map.
144- **`docs-site/`** — MkDocs source for the GitHub Pages documentation site.
145- **`docs/`** — Short pointer plus [`directory-structure.md`](docs/directory-structure.md) (`src/` layout reference).
146- **`scripts/`** — Optional helpers (e.g. `gen-appendices.sh`).
147- There is **no `package.json` in this clone**; building would require the original toolchain (Bun, internal `bun:bundle` features, and private deps). Treat this tree as a **read-only architectural reference**.