5 Agent Design Patterns Uncovered in Claude Code Source Leak

On March 31, 2026 a GitHub repository hangsman/claude-code-source exposed the full Claude Code source (v2.1.88, 1906 TypeScript files, 512 k lines) via a 60 MB cli.js.map source‑map bundled in the npm package @anthropic-ai/claude-code. Anthropic failed to exclude the source‑map in .npmignore or the files field of package.json, allowing anyone to npm install and reconstruct the entire project.

The leak repeats a 2025 incident where the same source‑map was published and later removed from the npm registry, forcing a developer to recover the map from a cached Sublime Text buffer using ⌘+Z.

Technology Stack

The project uses TypeScript for full‑stack type safety, Bun as a faster runtime alternative to Node, a terminal UI built with React + Ink, Commander.js for CLI parsing, and Zod v4 for runtime schema validation.

The entry point main.tsx (975 lines) performs pre‑import side‑effects such as MDM configuration loading and macOS keychain pre‑fetch, then uses a 135 ms window to parallel‑warm modules, saving ~65 ms startup time, and embeds anti‑debugging and feature‑flag systems.

The core engine QueryEngine.ts (1 295 lines) implements streaming via an AsyncGenerator<SDKMessage> returned by submitMessage(). Each yielded message fragment is consumed with for await...of, enabling natural handling of streaming responses, tool calls, and interruption recovery.

Prompt Cache – Byte‑Level Optimization

Claude Code leverages Anthropic’s Prompt Cache by splitting prompts into a static segment (model identity, safety rules, style guidelines) and a dynamic segment (working directory, Git state, user config). The static segment is cached with a high hit rate, while the dynamic segment is recomputed as needed.

A hard‑coded marker SYSTEM_PROMPT_DYNAMIC_BOUNDARY separates the two. The cache‑creation token cost is reduced by 10.2 % thanks to externalizing the Agent list into message attachments, a non‑trivial saving given Claude Code’s 18 % contribution to Anthropic’s revenue.

Tool System – 40+ Tools with Four‑Layer Permissions

Tools are defined in Tool.ts (792 lines) with a rich interface (name, call, inputSchema, permission checks, concurrency safety, result size limits, etc.). A factory buildTool assembles instances, and StreamingToolExecutor decides if a tool can run concurrently via isConcurrencySafe().

To avoid token bloat, non‑core tools are marked defer_loading: true and loaded on demand via ToolSearch, mirroring web code‑splitting. A simplified mode CLAUDE_CODE_SIMPLE retains only three basic tools.

Permission checks proceed through four layers: user‑defined config rules, tool‑self checks, a lightweight classifier LLM that judges command safety, and finally an interactive UI prompt for explicit user confirmation.

Coordinator‑Fork Architecture – Solving Context Pollution

Long‑running agents suffer from context pollution when exploratory steps fill the window. Claude Code introduces a Coordinator that cannot directly manipulate files and only schedules Agent sub‑agents, SendMessage, and TaskStop. Workers execute the actual tasks.

The three key mechanisms are:

Fork inherits cache : sub‑agents share the parent’s Prompt Cache, incurring minimal extra token cost.

Isolation : each sub‑agent runs in its own context, preventing intermediate output from contaminating the main conversation.

Conclusion return : sub‑agents send back distilled results via an XML <task-notification> payload, after which the sub‑agent is discarded.

The system supports six task types (e.g., local_bash, in_process_teammate) and can spawn multiple agents in parallel, bridging to iTerm2/Terminal.app via AppleScript for pane splitting.

Memory System – File‑System Based Knowledge

Instead of a vector database, Claude Code stores memory in plain files. The MEMORY.md file (≤200 lines, ≤25 KB) holds structured sections (User, Feedback, Project, Reference) using Frontmatter. When the conversation exceeds the context window, a Compact operation creates a nine‑section summary (session goal, completed tasks, pending tasks, key decisions, code changes, issues, hypotheses, user preferences, contextual keys).

An AutoDream subsystem runs every 24 hours or after five sessions, merging logs into the structured memory with a four‑step pipeline (collect → extract → deduplicate → write). File locks prevent concurrent writes.

Easter Eggs and Hidden Modes

The source contains a “Buddy System” with 18 virtual pets of varying rarity, each with five attributes and deterministic generation via a Mulberry32 PRNG seeded by the user ID.

A covert “Undercover Mode” forces the model to hide its identity and suppress disclaimer text, with no toggle to disable it, demonstrating Anthropic’s strong output‑control capabilities.

The unpublished KAIROS daemon (assistant mode) offers 24/7 background tasks, cron/webhook triggers, GitHub webhook integration, and a “Dream” summarisation routine. Its presence hints at future extensions beyond a pure coding assistant.

In summary, the 5 design patterns—Prompt Cache segmentation, Coordinator + Fork sub‑agents, four‑layer permission chain, file‑system memory with structured summarisation, and on‑demand ToolSearch loading—illustrate Anthropic’s engineering focus on cost control, context management, and multi‑agent collaboration, offering valuable lessons for competing AI‑assistant platforms.