Claurst
Your favorite Terminal Coding Agent, now in Rust & a Breakdown of the Claude Code leak & discoveries
Install / Use
/learn @Kuberwastaken/ClaurstQuality Score
Category
Development & EngineeringSupported Platforms
README
[!NOTE] 100% Coverage complete from original source on the
src-rustand it's already much more memory effecient than the original port, along with no tracking, experimental features unlocked and more. We're at a stage where I'm using Claurst to further build Claurst in <2 days and it's incredibly exciting.A huge revision with multi provider support, many more features and optimisations is actively being worked on and will be pushed ideally by tomorrow :) I would love to hear thoughts, help you set up or squash any bugs you encounter in the process, please don't refrain from reaching out or repoting any issues. Thank you for your support !
IMPORTANT NOTICE
This repository does not hold a copy of the proprietary Claude Code typescript source code. This is a clean-room Rust reimplementation of Claude Code's behavior.
The process was explicitly two-phase:
Specification spec/ - An AI agent analyzed the source and produced exhaustive behavioral specifications and improvements, deviated from the original: architecture, data flows, tool contracts, system designs. No source code was carried forward.
Implementation src-rust/- A separate AI agent implemented from the spec alone, never referencing the original TypeScript. The output is idiomatic Rust that reproduces the behavior, not the expression.
This mirrors the legal precedent established by Phoenix Technologies v. IBM (1984) — clean-room engineering of the BIOS — and the principle from Baker v. Selden (1879) that copyright protects expression, not ideas or behavior.
The analysis below is commentary on publicly available software, protected under fair use (17 U.S.C. § 107). Code excerpts are quoted to illustrate technical points from a public source - no unauthorized access was involved in this process or research.
Claude Code's Entire Source Code Got Leaked via a Sourcemap in npm, Let's Talk About It
Technical Breakdown
PS: I've also published this breakdown on my blog with a better reading experience and UX :)
Earlier today (March 31st, 2026) - Chaofan Shou on X discovered something that Anthropic probably didn't want the world to see: the entire source code of Claude Code, Anthropic's official AI coding CLI, was sitting in plain sight on the npm registry via a sourcemap file bundled into the published package.
This repository is a backup of that leaked source, and this README is a full breakdown of what's in it, how the leak happened and most importantly, the things we now know that were never meant to be public.
Let's get into it.
How Did This Even Happen?
This is the part that honestly made me go "...really?"
When you publish a JavaScript/TypeScript package to npm, the build toolchain often generates source map files (.map files). These files are a bridge between the minified/bundled production code and the original source, they exist so that when something crashes in production the stack trace can point you to the actual line of code in the original file, not some unintelligible line 1, column 48293 of a minified blob.
But the fun part is source maps contain the original source code. The actual, literal, raw source code, embedded as strings inside a JSON file.
The structure of a .map file looks something like this:
{
"version": 3,
"sources": ["../src/main.tsx", "../src/tools/BashTool.ts", "..."],
"sourcesContent": ["// The ENTIRE original source code of each file", "..."],
"mappings": "AAAA,SAAS,OAAO..."
}
That sourcesContent array? That's everything.
Every file. Every comment. Every internal constant. Every system prompt. All of it, sitting right there in a JSON file that npm happily serves to anyone who runs npm pack or even just browses the package contents.
This is not a novel attack vector. It's happened before and honestly it'll happen again.
The mistake is almost always the same: someone forgets to add *.map to their .npmignore or doesn't configure their bundler to skip source map generation for production builds. With Bun's bundler (which Claude Code uses), source maps are generated by default unless you explicitly turn them off.
The funniest part is, there's an entire system called "Undercover Mode" specifically designed to prevent Anthropic's internal information from leaking.
They built a whole subsystem to stop their AI from accidentally revealing internal codenames in git commits... and then shipped the entire source in a .map file, likely by Claude.
What's Claude Under The Hood?
If you've been living under a rock, Claude Code is Anthropic's official CLI tool for coding with Claude and the most popular AI coding agent.
From the outside, it looks like a polished but relatively simple CLI.
From the inside, It's a 785KB main.tsx entry point, a custom React terminal renderer, 40+ tools, a multi-agent orchestration system, a background memory consolidation engine called "dream," and much more
Enough yapping, here's some parts about the source code that are genuinely cool that I found after an afternoon deep dive:
BUDDY - A Tamagotchi Inside Your Terminal
I am not making this up.
Claude Code has a full Tamagotchi-style companion pet system called "Buddy." A deterministic gacha system with species rarity, shiny variants, procedurally generated stats, and a soul description written by Claude on first hatch like OpenClaw.
The entire thing lives in buddy/ and is gated behind the BUDDY compile-time feature flag.
The Gacha System
Your buddy's species is determined by a Mulberry32 PRNG, a fast 32-bit pseudo-random number generator seeded from your userId hash with the salt 'friend-2026-401':
// Mulberry32 PRNG - deterministic, reproducible per-user
function mulberry32(seed: number): () => number {
return function() {
seed |= 0; seed = seed + 0x6D2B79F5 | 0;
var t = Math.imul(seed ^ seed >>> 15, 1 | seed);
t = t + Math.imul(t ^ t >>> 7, 61 | t) ^ t;
return ((t ^ t >>> 14) >>> 0) / 4294967296;
}
}
Same user always gets the same buddy.
18 Species (Obfuscated in Code)
The species names are hidden via String.fromCharCode() arrays - Anthropic clearly didn't want these showing up in string searches. Decoded, the full species list is:
| Rarity | Species | |--------|---------| | Common (60%) | Pebblecrab, Dustbunny, Mossfrog, Twigling, Dewdrop, Puddlefish | | Uncommon (25%) | Cloudferret, Gustowl, Bramblebear, Thornfox | | Rare (10%) | Crystaldrake, Deepstag, Lavapup | | Epic (4%) | Stormwyrm, Voidcat, Aetherling | | Legendary (1%) | Cosmoshale, Nebulynx |
On top of that, there's a 1% shiny chance completely independent of rarity. So a Shiny Legendary Nebulynx has a 0.01% chance of being rolled. Dang.
Stats, Eyes, Hats, and Soul
Each buddy gets procedurally generated:
- 5 stats:
DEBUGGING,PATIENCE,CHAOS,WISDOM,SNARK(0-100 each) - 6 possible eye styles and 8 hat options (some gated by rarity)
- A "soul" as mentioned, the personality generated by Claude on first hatch, written in character
The sprites are rendered as 5-line-tall, 12-character-wide ASCII art with multiple animation frames. There are idle animations, reaction animations, and they sit next to your input prompt.
The Lore
The code references April 1-7, 2026 as a teaser window (so probably for easter?), with a full launch gated for May 2026. The companion has a system prompt that tells Claude:
A small {species} named {name} sits beside the user's input box and
occasionally comments in a speech bubble. You're not {name} - it's a
separate watcher.
So it's not just cosmetic - the buddy has its own personality and can respond when addressed by name. I really do hope they ship it.
KAIROS - "Always-On Claude"
Inside [assistant/](https://github.com/kuberwastaken/claude-code/tree/main/src-
