What We Adopted From the Claude Code Leak

On March 31st we read the source code to a tool we use every day. Not because we shouldn't have, because Anthropic published it to npm by accident, and the internet had copied the package roughly fifty thousand times before anyone on their side noticed. The day after, we picked the bits we actually wanted and built them ourselves.

This post is not speculation about what Claude Code could one day become. Every other take on the leak is a guided tour of a blueprint. This one is a list of what already runs on the dev server here.

Seventeen features came in from the cold that week. Three subagents. Three hooks. Five scripts. Two plugins. A shared team memory directory. Every single one of them was installed, wired up, and tested against normal daily work before this post was written. The catalogue told us what to look for. The implementations are ours.

// what actually shipped

The technical cause was small and extremely relatable. The Claude Code package is bundled with Bun. Bun's bundler emits source maps alongside the compiled output unless you explicitly tell it not to, and the .npmignore on version 2.1.88 did not exclude the right glob. The result was a package that shipped roughly 512,000 lines of TypeScript source as a side dish to the compiled binary, sitting quietly in the dist/ folder for about three hours before the team noticed and pulled the release.

I publish to npm too. The bit where Bun emits source maps unless you tell it not to is exactly the bit I would have missed. There is no version of the packaging world in which this is clever or unusual. It is one forgotten glob in one ignore file on the one day you didn't double check the tarball. Respect to the team for catching it as fast as they did.

// what was inside (according to the news)

The public account of the leak is already well documented, so that is where the public facts in this post come from. Bloomberg covered the scramble to get the package replaced on the registry and the CDN. Engadget walked through some of the internal feature flags that surfaced, including references to a background daemon codenamed Kairos, a Proactive Mode for the agent loop, and something the flags called Terminal Pets.

Five hundred and twelve thousand lines of TypeScript. Roughly two thousand files. Somewhere north of ninety feature flags in the configuration surface, only a fraction of which are enabled on any given release channel. That is the catalogue the news told the world about. What that catalogue gave us was a reading list, not a library of reusable code. The job after that was working out which ones were worth building from the outside.

// what we adopted

The sorting principle was simple. If the feature category matched a real friction point in how Claude Code gets used here, it was worth rebuilding. If it only made sense inside Anthropic's own product infrastructure, it was not. Seventeen features survived that filter.

Three subagents. The first is a verification agent. It is read-only by design, and its job is to try to break whatever the main session just finished. Adversarial test cases, boundary probes, concurrency inspection, the sort of thing a suspicious colleague would do before signing off. After a feature lands the session finishes with a verification pass instead of a vibes check. The second is a fork worker. It runs a single focused implementation task and returns a structured Scope / Result / Files changed / Issues report, and it is not allowed to report back before committing its work. It is impossible to end a fork worker session with dirty files and nothing on disk, which used to be a regular failure mode. The third is a coordinator worker. It carries a two hundred and fifty line system prompt that orchestrates multiple child workers in parallel, gathers their structured reports, and hands the synthesis back to the main session. For anything that needed four parallel investigations, the coordinator is the difference between waiting and moving.

Three Stop and PostToolUse hooks. The one that changed daily life the most is extract-memories. Every third turn it spawns a background agent that scans recent messages for durable observations, preferences, and decisions, then writes them into the memory directory automatically. The old rule that said "write memories at the end of the session" has been retired by obsolescence: the hook has already written most of them before the session ends. push-notify fires notify-send when a long-running task finishes, so you can genuinely walk away from the machine for fifteen minutes without feeling like you are rolling dice on whether it is still working or silently stuck. The third hook, compaction-reminder, exists on disk as a PostToolUse option that is available but not wired up. It stays on the shelf until a need for it shows up.

Five scripts. claude-bg is the background session manager. It runs a session detached from the current shell, gives it a name, and exposes a lifecycle with run, ps, logs, attach, kill, and clean. Long jobs no longer tie up the foreground terminal. buddy launched Sparky. Sparky is a companion, notionally a small robot in a beret with permanently surprised eyes, who lives in the terminal and has opinions. buddy, buddy stats, buddy pet. dream-consolidation.sh runs at 3 AM via cron. It is a four phase memory consolidation routine that only runs when at least 24 hours and five sessions have accumulated since the last one, so it never fires on a quiet day. proactive-daemon.sh is the local implementation of the pattern the news called Proactive Mode. It ticks on a configurable interval and lets an autonomous agent take a look at the state of the system without a human prompt. github-webhook-agent.sh polls a repository for new pull requests and dispatches them into the agent loop. The names are boring because the scripts are boring, and that is exactly the point.

Two plugins. explanatory-output-style is a SessionStart hook that teaches the output to include the "why" behind a decision, not just the "what". Reading a diff is faster when the commentary is built into the plan, and that is what this plugin does. security-guidance is a PreToolUse hook that watches for the classic foot guns. Dynamic shell execution, unsafe HTML injection, unsafe deserialisation, the whole bestiary of patterns that make a security reviewer wince. When one of them shows up in a staged edit, the hook prints a warning before the edit goes out. It has caught three things on this box already, none of them catastrophic, all of them worth stopping to think about.

A team memory directory. ~/.claude/projects/-home-matt-dev/memory/team/ is shared across sessions, on purpose. Notes that should be visible to every session go there. No API keys, no secrets, no credentials of any kind. The restriction is the only rule that matters.

// what we left alone

Of the roughly ninety feature flags visible in the catalogue, only seventeen made it into the rebuild. Most of what was left out sits in one of two buckets. The first bucket is Anthropic's own product infrastructure. CLI plumbing, telemetry, model routing, release channel gating, the internal update pipeline. None of that solves a problem in a one developer shop, because the problems it solves only exist when you are shipping a tool to thousands of users. The second bucket is fit. A feature can be genuinely clever and still be a bad fit for the shape of the workflow around it.

Two specifics for the record. The full Kairos daemon design was tempting and got ignored. Kairos is a scheduler for background agent work, and it overlaps almost completely with a box that already has systemd, cron, and a handful of small daemons doing similar jobs. Adding another scheduler on top would have meant two things competing for the same cron slot, which is one more thing than needed. Terminal Pets got trimmed to exactly the one we wanted. Sparky moved in, and the rest of the menagerie stayed on the shelf. The ideal number of robots in your terminal is higher than zero and lower than four.

// the npm packaging postscript

The worst kind of bug is the kind your bundler defaults you into. The second worst is the kind you are going to miss next time you publish, because you read about somebody else's version of it and thought "well, now I know to check". The ignore files on this dev server have been audited twice since March 31st. The second audit caught a different problem than the first one, which is the usual way these things go. The first audit gave a clean report and a small smug feeling. The second audit took the smug feeling and broke it on a rock, which is also the usual way.

Every tool used here every day is built by someone else, until the day it is not. The leak didn't change that. It just turned the catalogue of what Claude Code is quietly doing behind the glass into a reading list, and the reading list turned into a weekend's work, and the weekend's work is now the reason the terminal has a robot in a beret in it. None of the seventeen features installed on April 1st turned out to be the one that mattered. The thing that mattered was the habit they put in place between them, which is "if you wish a tool worked a certain way, that is the start of the project, not the end of one".