Claude Code's npm build shipped its full TypeScript source

The npm package for Claude Code shipped with the original TypeScript inside it. The .js.map files carried a sourcesContent field with nearly two thousand readable files, and Claude Code from Source is what happened when someone read every one of them: an 18-chapter book about how the agent is built.

At a glance

• Claude Code is used by hundreds of thousands of developers, and the book distills its architecture into 18 chapters, six core abstractions, and five transferable patterns at the end of every chapter.
• Numbers from the source: startup in 240 ms via parallel I/O, a 14-step tool pipeline, four layers of context compression, and fork agents reusing a cached prompt prefix to cut input tokens roughly 95%.
• Thirty-six AI agents produced the text in four phases in about six hours, and a final audit replaced every code block with pseudocode written under different variable names.

Source maps are the debugging aid that maps minified JavaScript back to what you actually wrote, and their sourcesContent field is literally the original files, so rebuilding a project from one takes a JSON parse and nothing cleverer. According to BSWEN, Anthropic exposed Claude Code's source on March 31, 2026 through a single 57MB cli.js.map holding 1,906 TypeScript and TSX files and more than 512,000 lines. DEV Community notes that a similar npm slip already hit another AI company's CLI tool in early 2025.

One async generator drives the whole agent

The loop at the centre of Claude Code is a single async generator. It yields messages while the model streams, returns a typed terminal value when the turn ends, and gets cancellation and backpressure for free: the loop advances only when whoever consumes it asks for the next item, like a conveyor that moves one step when someone lifts a part off the end.

Between the model asking for a tool and the result coming back sits a 14-step pipeline: permission resolution, speculative execution, concurrent batching. Read-only tools start while the model is still streaming, before the response is finished. Tools are partitioned by safety classification, so reads run in parallel and writes are serialized.

The same loop handles error recovery and context compression, and compression is layered: four passes named snip, microcompact, collapse and autocompact, each lighter than the next, so the cheap trim runs far more often than the heavy rewrite.

Fork agents cut input tokens by about 95%

The expensive part of any multi-agent run is that every child re-sends the same large prompt. Fork agents spawn children whose prompt prefixes are byte-identical to the parent's, so the shared part is a cache hit instead of fresh input, and input tokens fall by roughly 95%.

Prompt caching stores reused prompt segments so later requests read them instead of reprocessing them. According to DeepWiki, a cache write on Sonnet 4.5 costs $3.75/MTok against $3.00 for normal input while a read costs $0.30/MTok, which turns profitable after about 1.3 requests; the cached block must reach 1,024 tokens on Sonnet 4.5, and the ephemeral cache has a five-minute TTL that resets on every read.

Byte-identical means byte-identical, which is why sticky latches exist: once a beta header has gone out in a session it is never unset mid-session, because flipping it would change the prefix and throw the cache away. The book also covers coordinator mode and swarm teams with mailbox messaging.

Startup takes 240 ms and the output cap starts at 8K

Claude Code boots in 240 ms, and the book credits module-level parallel I/O: everything that can be read from disk at once is. Fuzzy search runs bitmap pre-filters before the expensive comparison, so most candidates are thrown out cheaply.

Slot reservation is the neat one. Rather than reserving room for a large answer in every request, the agent caps output at 8K tokens and escalates to 64K only when a response hits the ceiling, which saves context in 99% of requests.

Memory is files rather than a database: four memory types with staleness warnings, and a Sonnet side-query that picks the relevant ones, which the book says beats embedding search. Skills load in two phases, frontmatter at startup and full content on invocation, and all 27 lifecycle hooks read from a config snapshot frozen at startup, so nothing can inject a hook at runtime.

36 agents wrote the book in roughly six hours

The writing itself was agentic, in four phases. Six exploration agents read every file in the source tree; twelve analysis agents produced 494KB of raw technical documentation; fifteen writing agents rewrote all of it from scratch as narrative chapters; three reviewers filed 900 lines of feedback and three more agents applied the fixes.

The whole run, from pulling source out of the maps to the revised text, took about six hours. A final audit pass confirmed no verbatim source code remained: every code block is original pseudocode with different variable names, and the NO'REILLY cover is a parody with no affiliation to O'Reilly Media.

It is not the first attempt at this material. According to Bright Coding, the open-source project sanbuphy/learn-coding-agent had already reverse-engineered Claude Code's architecture from public references, reaching 12,144 stars and 19,661 forks and documenting roughly 1,884 files and 512,664 lines in v2.1.88, with query.ts at about 785KB carrying the core loop.

The audit that stripped verbatim code also removed what would let you verify the claims: the 240 ms boot and the 99% figure are the book's reading of a build you cannot diff against the pseudocode. Oddly for a project built entirely on provenance, the version of Claude Code it read is never named, and nothing in it says whether those .js.map files are still in the package you install today.

Whether the maps ship again

The prevention side is cheap and well documented: disable source maps in production builds, or ship hidden ones that omit the sourceMappingURL comment, or generate maps without sourcesContent, and pair an explicit files allowlist in package.json with a comprehensive .npmignore, since .npmignore overrides .gitignore when publishing. Whether the next Claude Code release on npm does any of that is something you can check yourself, with a download and a JSON parse.