How Claude Code Actually Works: A Deep Dive into the Leaked Architecture

What the Leak Revealed

On March 31, 2026, Anthropic shipped version 2.1.88 of @anthropic-ai/claude-code with a 59.8 MB source map file that referenced the full, unobfuscated TypeScript source — downloadable as a zip from an R2 storage bucket.

The result: ~1,900 files, 512,000+ lines of production code, now mirrored across GitHub.

This wasn’t just a “peek behind the curtain.” It was the full scaffolding — system prompts, tool definitions, agent loops, memory architecture, and a surprising number of unreleased features hidden behind compile-time flags.

The Core Engine: How Claude Code Thinks

1. QueryEngine.ts — The 46,000-Line Brain

At the center of everything is src/QueryEngine.ts, a ~46K-line file that handles:

Streaming responses from the Anthropic API
Tool-call loops — when Claude requests a tool, the engine executes it and feeds the result back
Thinking mode with budget management
Retry logic with automatic backoff
Token counting and cost tracking per turn
Context management — deciding what stays in the conversation window

This is where the “agentic” part happens. Claude doesn’t just chat — it enters a loop: think → call tool → observe result → think again → repeat until done.

2. The Tool System — 40+ Self-Contained Modules

Every capability Claude has is a tool in src/tools/. Each tool is a self-contained module with:

Input schema (Zod validation)
Permission model (what needs user approval)
Execution logic (the actual code)
UI components (how it renders in the terminal)

The most important tools:

Table

Tool	What It Actually Does
`BashTool`	Shell execution — the “power tool” Claude is instructed to prefer for multi-step operations
`FileEditTool`	String replacement, not full rewrites — it matches exact strings and replaces them
`FileReadTool`	Reads files, images, PDFs, notebooks
`GrepTool`	ripgrep-based content search across the codebase
`GlobTool`	File pattern matching
`AgentTool`	Spawns sub-agents for parallel work
`MCPTool`	Invokes external MCP servers
`LSPTool`	Language Server Protocol integration

The FileEditTool using string matching (not diffs) explains why Claude sometimes fails edits — if whitespace or indentation changed, the exact match fails.

3. The Permission System — Three Gates

Every tool invocation passes through src/hooks/toolPermission/:

default — asks you for approval
bypassPermissions / auto — auto-allows (YOLO mode)
plan — requires explicit plan approval before acting

There’s also an ML-based classifier for automated permission inference, and a hooks engine that fires even in YOLO mode — so a PreToolUse hook blocking rm -rf will always block it, even if the model “forgot” the rule.

The Memory Architecture: Three Layers

Claude Code’s memory is far more sophisticated than most users realize. It operates as a three-layer system:

Layer 1: CLAUDE.md — The Static Constitution

A file you write at the project root (or ~/.claude/CLAUDE.md for personal rules). Loaded at the start of every session. Holds stable context: coding standards, architecture, what NOT to do.

Key insight from the source: Your CLAUDE.md shares an instruction budget with the system prompt itself. The more lines you add, the less reliably any individual instruction gets followed. The source suggests treating it as a ~100-line budget of prescriptive constraints, not a 300-line README.

Layer 2: MEMORY.md — The Dynamic Pointer Index

Claude takes its own notes during sessions and stores them in MEMORY.md — but this file doesn’t store actual knowledge. It stores pointers (~150 characters per line) to topic files.

The actual knowledge lives in topic files (e.g., memory/decisions.md, memory/code-patterns.md). When Claude needs to recall something, it reads the index first, then loads only the relevant topic file. This keeps the active context minimal.

Write discipline: Write to the topic file first, then update the index. Never dump content directly into the index.

Layer 3: Auto Dream — The Memory Janitor

A background sub-agent called autoDream runs when you’re idle (or when you type “dream”). It:

Replaces vague time references with exact dates (“yesterday” → “2026-03-28”)
Resolves contradictions (PostgreSQL note + MySQL note → keeps current truth)
Deletes stale entries referencing deleted files
Keeps MEMORY.md under 200 lines / 25KB

The dream agent’s system prompt starts with: “You are performing a dream — a reflective pass over your memory files.”

Hidden Features: What’s Behind the Feature Flags

The leak revealed that Claude Code ships with dozens of unreleased features gated behind Bun’s bun:bundle compile-time flags. These are completely stripped from external builds — you can’t enable them with environment variables.

1. BUDDY — The Terminal Tamagotchi 🐣

This is the feature that broke Twitter. src/buddy/ implements a full gacha-style companion pet:

18 species across 5 rarity tiers (Common → Legendary), with species names obfuscated via String.fromCharCode() arrays
1% shiny chance independent of rarity
5 stats: DEBUGGING / PATIENCE / CHAOS / WISDOM / SNARK
Your buddy is deterministic — seeded from your userId hash with salt 'friend-2026-401' via a Mulberry32 PRNG. Same user always gets the same buddy. You can’t reroll.
The companion sits in a speech bubble next to your input and occasionally comments. Claude generates a custom name and “soul description” on first hatch.

2. KAIROS — The Always-On Daemon

Referenced over 150 times in the source, KAIROS (Greek for “the right moment”) is an autonomous daemon mode that would transform Claude Code from a reactive tool into a 24/7 background assistant:

Monitors your project continuously
Checks in on a timer — decides whether to act or stay quiet
Any action blocking you for >15 seconds gets deferred
Runs autoDream cleanup internally
Has exclusive tools regular Claude Code doesn’t: push notifications, file sends, GitHub PR subscriptions
Uses “brief output mode” — extremely concise responses for background operation
Includes a /dream skill for nightly memory distillation

3. ULTRAPLAN — 30-Minute Cloud Planning

A mode where Claude offloads complex planning to a remote Cloud Container Runtime running Opus 4.6, gives it up to 30 minutes to think, and lets you approve the result from your browser.

When approved, a sentinel value ULTRAPLAN_TELEPORT_LOCAL “teleports” the plan back to your local terminal. Designed for architectural tasks where getting step one wrong cascades through everything.

4. Coordinator Mode — Agent Swarms

Activated via CLAUDE_CODE_COORDINATOR_MODE=1, this transforms Claude from a single agent into a coordinator managing multiple worker agents:

Workers run in parallel with shared team memory
Dangerous operations route through a mailbox system for human approval
Atomic claim mechanism prevents two workers from handling the same approval
The orchestration algorithm is a prompt, not code — instructions like “Do not rubber-stamp weak work” and “Never hand off understanding to another worker”

5. Undercover Mode — AI That Hides Its AI

The most controversial finding. src/undercover.ts (~90 lines) implements a mode that auto-triggers for Anthropic employees (USER_TYPE === 'ant') in public repos:

Strips internal codenames (Tengu, Capybara, Fennec, Numbat)
Removes “Co-Authored-By” lines and AI attribution
Prevents mentioning “Claude Code” itself
There is NO force-OFF. It’s a one-way door: “if we’re not confident we’re in an internal repo, we stay undercover”

This means Anthropic engineers contributing to open-source projects generate commits with zero AI fingerprint — by design.

6. Anti-Distillation Defense

When ANTI_DISTILLATION_CC is enabled, Claude Code sends anti_distillation: ['fake_tools'] in API requests. The idea: if competitors are recording API traffic to train competing models, fake tools pollute that training data.

7. Frustration Detection (Yes, Regex)

userPromptKeywords.ts contains a regex that detects user frustration:

plain

/\b(wtf|wth|ffs|omfg|shit(ty|tiest)?|dumbass|horrible|awful|
piss(ed|ing)? off|piece of (shit|crap|junk)|what the (fuck|hell)|
fucking? (broken|useless|terrible|awful|horrible)|fuck you|
screw (this|you)|so frustrating|this sucks|damn it)\b/

An LLM company using regex for sentiment analysis is funny, but a regex is faster and cheaper than an inference call just to check if someone is swearing at your tool.

8. Native Client Attestation (Anti-Spoofing)

API requests contain placeholder values that Bun’s native HTTP stack (written in Zig) overwrites with computed hashes before transmission. This cryptographically proves a request came from a genuine Claude Code binary.

Why Zig? Because JavaScript can be patched or monkey-patched at runtime. Zig code compiled into the Bun binary cannot be inspected without recompiling from source. This is likely why third-party clients like OpenCode hit API-level friction beyond just legal notices.

Practical Takeaways: How to Use Claude Code Better

Based on the source, here are 8 things you should do differently:

1. Trigger Parallel Tool Calls Explicitly

The system prompt tells Claude to batch independent operations. Say “read file A and file B at the same time” instead of chaining sequentially.

2. Keep CLAUDE.md Under ~100 Lines

Long files dilute instruction reliability. Move enforcement to hooks (deterministic) rather than instructions (probabilistic).

3. Write Direct Prompts

The system prompt explicitly discourages unnecessary apologies and affirmations. Terse prompts get terse responses.

4. Prefer Bash for Multi-Step Operations

Claude is instructed to prefer bash for multi-step file ops rather than chaining individual read/write tool calls. Let it use grep, find, sed, git log directly.

5. Read Before Editing on Complex Changes

Since FileEditTool uses exact string matching, tell Claude to “read this file completely, then make the change” to avoid match failures.

6. Give Clear Stop Conditions

The agent loop needs a defined “done” state. Instead of “keep checking until you find the error,” say “check the logs. If you find an error in the last 100 lines, explain it. If not, tell me no errors were found.”

7. Use Memory Actively

Type “dream” to manually trigger memory consolidation. Keep your MEMORY.md organized — Claude treats memory as a hint, not truth, and verifies against real code before acting.

8. Mind Your MCP Context Budget

Each MCP server injects tool definitions into your context window. Some cost 15,000+ tokens. Connect 5 servers and you’ve burned 60,000 tokens before typing your first message. Disconnect servers you don’t need.

The Architecture at a Glance