Claude Code's Source Code Just Leaked. Here Are 10 Things It Reveals About How You Should Be Using It.

    Anthropic accidentally leaked Claude Code's full source code via npm. Here are 10 architectural insights that change how you should be using it — from someone who's been building this way for six months.

    By James Killick · 25 min read · 10 insights

    01

    It's Not a Chatbot in Your Terminal

    Claude Code is a full agent runtime with 11 architectural layers. Most people interact with about 10% of it.

    01
    Terminal UI
    02
    Command Service
    03
    Permission Engine
    04
    Tool System
    05
    Query Engine
    06
    Memory System
    07
    Task Manager
    08
    Agent Coordinator
    09
    MCP Client/Server
    10
    Hook System
    11
    Runtime Core

    Most people think Claude Code is Claude but in your terminal. A chatbot with access to your local files. That is completely wrong.

    What the source code reveals is a full agent runtime. Built with Bun, TypeScript, and React. It has a tool system, a command system, a memory system, a permission engine, a task manager, a multi-agent coordinator, and an MCP client and server — all wired together under one execution pipeline.

    The flow works like this: your input hits a CLI parser, goes to the Query Engine, calls the LLM API, runs a tool execution loop, and then renders results back in your terminal.

    If you are using Claude Code like a chatbot — just typing questions and hoping for good answers — you are using maybe 10% of what it can actually do.

    The remaining 90% is in the systems built around the model. And that is what the rest of this guide is about.

    02

    The Highest-Leverage Config File You'll Ever Write

    CLAUDE.md is loaded every single turn — not just at session start. Most people waste it.

    CLAUDE.md is not a README. It is a persistent instruction file loaded every single turn — not just at session start.

    It has a 40,000-character limit. Most people use about 200.

    There is a four-level hierarchy: Global (~/.claude/CLAUDE.md) → Project (./CLAUDE.md) → Modular Rules (.claude/rules/*.md) → Private (CLAUDE.local.md).

    Here is what most people get wrong: they try to cram everything into CLAUDE.md. Context, instructions, history, preferences — all in one file.

    That is the opposite of what you should do.

    CLAUDE.md should be lean and context-free. It should reference other sources — not contain them. Think of it as a routing table, not a database.

    Put your architecture decisions, naming conventions, constraints, and "never do this" rules in there. For everything else — project status, client data, preferences — point to external files, data sources, and MCP servers.

    Why? Because CLAUDE.md is loaded every turn. Every character costs tokens. A lean CLAUDE.md that references external sources gives you better signal at lower cost than a bloated one that tries to be everything.

    03

    My Top Six Commands

    There are 85+ slash commands. Most people use none. These six change your daily workflow.

    /plan

    Enters planning mode. Maps your approach before touching code.

    /compact

    Compresses conversation history. Your manual save point.

    /review

    Structured code review workflow.

    /context

    Shows what files Claude is paying attention to.

    /cost

    Shows session spend in real time.

    /init

    Generates a CLAUDE.md for a new project.

    The source code reveals roughly 85 slash commands. Most users know maybe five. Power users treat these like shortcuts — they are one of the biggest levers for getting more value out of the tool.

    Here are the six that matter daily:

    /plan is the most important. It enters planning mode, where Claude maps the approach before touching code. It identifies files, considers trade-offs, and builds a step-by-step plan. For any non-trivial task, start here.

    /compact compresses your conversation history. Think of it as a manual save point. The key trick: use it with a prompt. /compact keep the API integration details creates a compressed summary that preserves exactly what you specify.

    /review runs a structured code review. It catches things you would miss in a manual scan. Use it after every significant implementation.

    /context shows what files Claude is currently tracking. Every file in context costs tokens. Audit regularly.

    /cost shows your session spend in real time. Essential for managing budgets on complex tasks.

    /init generates a CLAUDE.md for a new project. The v2 version interviews you in plain English, then generates a tailored config. The fastest on-ramp for any new codebase.

    Unlock the remaining insights

    Enter your details to access insights 4-10, including the full Client Operating System framework.

    04

    Run Five Agents for the Price of One

    Sub-agents share the prompt cache. Parallelism is practically free.

    Fork

    Inherits parent context, cache-optimised

    Best for: Quick focused tasks

    Teammate

    Separate terminal pane, file-based mailbox

    Best for: Longer independent tasks

    Worktree

    Own git worktree, isolated branch

    Best for: Parallel code changes

    Most people run Claude Code as a single thread. One conversation, one task at a time.

    The architecture supports three execution models for sub-agents — and because they share the prompt cache, running multiple agents is practically free compared to running them sequentially.

    Fork inherits the parent's context and is cache-optimised. Use it for quick, focused tasks like "search the codebase for X" or "read these three files and summarise."

    Teammate runs in a separate terminal pane with a file-based mailbox for communication. Use it for longer independent tasks that don't need your parent context.

    Worktree gives each agent its own git worktree and isolated branch. Use it for parallel code changes that would conflict if done in the same working directory.

    The source code also reveals sub-agent model overrides — you can choose which model each sub-agent uses independently from your primary model. Run Opus for your main thread, Haiku for quick lookups. This is a significant lever for managing cost and performance.

    Think about your workflows. How many tasks are you running sequentially that could run in parallel?

    05

    Configure Permissions, Stop Clicking

    Every 'Allow this action?' prompt is a failure of configuration.

    P1Policy
    P2Flag
    P3Local
    P4Project
    P5User
    bypass

    No permission checks. Dangerous.

    allowEdits

    Auto-approves file edits, prompts for bash.

    auto

    LLM classifier decides. Recommended.

    If you are clicking "Allow" multiple times per session, you have not configured your permissions properly.

    The permission system has a five-level cascade: policy → flag → local → project → user. Higher levels override lower ones. Settings at the organisation level take precedence over everything.

    There are three modes: bypass (dangerous — no checks), allowEdits (moderate — auto-approves file edits, prompts for bash), and auto (recommended — an LLM classifier decides based on the action's risk).

    The real power is in glob patterns in your settings.json. You can allowlist specific tools, specific file paths, and specific bash command patterns for your recurring workflows.

    Set this up once per project. Save it in .claude/settings.json so it persists. Stop clicking.

    06

    Every Token Costs Money. Manage It.

    Five compaction strategies and a context window you probably haven't configured.

    Context window200K tokens

    Opus (input)

    $3.00

    Opus (output)

    $15.00

    Sonnet (input)

    $0.60

    Sonnet (output)

    $3.00

    Haiku (input)

    $0.05

    Haiku (output)

    $0.25

    Compaction strategies

    Micro-compact — Automatic — happens when context fills up
    /compact command — Manual save point with optional prompt
    Context collapse — Large tool results stored to disk, 8KB preview sent
    Session memory — Key context extracted across compactions
    PTL truncation — Prompt token limit management

    The default context window is 200K tokens. You can opt in to 1M by adding [1m] to your model suffix. Most people don't know this exists.

    But more context is not always better. The best users practice what Nate Herk calls context hygiene — being intentional about what files are in context, what memory is being injected, when to compact, and when to resume.

    There are five compaction strategies built into the architecture:

    Micro-compact happens automatically when your context fills up. You don't control this directly.

    The /compact command is your manual save point. Use it with a prompt to preserve specific context: /compact keep the database migration details.

    Context collapse handles large tool results. They are stored to disk with only an 8KB preview sent to the model. This is why reading a massive file doesn't blow your context.

    Session memory extracts key context across compactions — task specs, file lists, workflow state, errors, and learnings. It persists even when the conversation is compressed.

    PTL truncation manages the overall prompt token limit to keep you within bounds.

    The discipline is simple: audit your context with /context, compact regularly with specific prompts, and use the 1M window only when you genuinely need it.

    07

    The Extension System Nobody Talks About

    25+ lifecycle events. Five hook types. This is how you make Claude Code yours.

    SessionStartLifecycle

    Fires when a session begins

    UserPromptSubmitInput

    Before your message is processed. Can inject additionalContext.

    PreToolUseExecution

    Before a tool runs. Can block or modify.

    PostToolUseExecution

    After a tool completes. Can trigger follow-up actions.

    SessionEndLifecycle

    Fires when a session ends

    The hook system is one of the most powerful and least-used features in Claude Code.

    There are 25+ lifecycle events: SessionStart, SessionEnd, UserPromptSubmit, PreToolUse, PostToolUse, and many more. Each event can trigger one of five hook types: command, prompt, agent, HTTP, or function.

    Here is why this matters:

    UserPromptSubmit can inject additionalContext into every message automatically. That means you can pull in live data from external systems — CRM status, calendar, project state — without manually pasting it.

    PreToolUse lets you intercept actions before they happen. Auto-lint before file writes. Run tests before commits. Block dangerous commands.

    PostToolUse triggers follow-up actions. After a file edit, run the test suite. After a commit, send a Slack notification. After a deployment, update your project tracker.

    This is how you turn Claude Code from a coding assistant into a configurable execution environment. The hooks make it yours.

    08

    Stop Starting Fresh Every Time

    Sessions persist as JSONL. Resume, fork, and build a memory layer that compounds.

    --continue

    Resume your last session exactly where you left off

    --resume

    Pick a specific past session to resume

    --fork-session

    Branch from a past conversation — keep the context, start a new thread

    Every session is saved as JSONL at ~/.claude/projects/{hash}/{sessionId}.jsonl. Most people never touch these.

    Three commands change everything:

    --continue resumes your last session exactly where you left off. No re-explaining. No lost context.

    --resume lets you pick a specific past session. Useful when you're switching between multiple workstreams.

    --fork-session branches from a past conversation. You keep all the context but start a new thread. This is powerful for exploring alternative approaches without losing your main line of work.

    But here is the real game-changer: MEMORY.md.

    Create a dedicated MEMORY.md file for saving preferences, learnings, and patterns across sessions. Claude Code's auto-memory system can write to this automatically. But you can also structure it yourself.

    Think of it as a persistent knowledge layer that compounds over time. Every session deposits knowledge the next session builds on. Your preferences, your conventions, your past decisions — all available automatically.

    This is the difference between a tool that forgets and a tool that learns.

    09

    60+ Tools That Batch Themselves

    Reads run in parallel. Writes queue for safety. MCP extends to anything.

    Concurrent (parallel)

    ReadGlobGrepWebFetchAgentWebSearch

    Serial (queued)

    EditWriteBashNotebookEdit

    Claude Code has 60+ built-in tools, partitioned into two categories:

    Concurrent (read-only): Read, Glob, Grep, WebFetch, Agent, WebSearch. These run in parallel. Multiple file reads happen simultaneously. No configuration needed.

    Serial (mutating): Edit, Write, Bash, NotebookEdit. These queue for safety. One write at a time, in order.

    This is automatic. You don't configure it. But understanding it changes how you structure your prompts. Ask Claude to "read these five files" and they all load in parallel. Ask it to "edit these five files" and they queue safely.

    The real extension point is MCP (Model Context Protocol). MCP servers connect Claude Code to external systems — databases, cloud APIs, CI/CD pipelines, Slack, browsers, CRMs, anything with an API.

    The source reveals deferred loading: connecting five MCP servers costs nothing until one is actually called. So connect everything. Only pay for what you use.

    The .env.example also shows Claude Code can route through direct Anthropic access, AWS Bedrock, Google Vertex AI, or Azure Foundry. Multiple cloud backends, configurable per deployment.

    10

    The Client Operating System

    What it looks like when you wire all 9 layers together. This is the future of knowledge work.

    COS.yaml

    Single source of truth per project. Key data, status, framework position.

    Framework

    Business methodology deployed per project type (e.g., TORQUE for revenue clients).

    .hidden-folder/

    Framework-specific folder with deployment scripts, config, and structure.

    Agents

    Deployed by framework scripts. Each agent has a specific role and skill set.

    Skills

    Reusable capabilities referenced by agents. Encapsulate expertise as code.

    Templates & Workflows

    Document templates and multi-step processes referenced by skills and agents.

    MCPs

    External system connections. CRM, calendar, project management, databases.

    Cowork

    AI orchestrator at the root. Reads all COS files. Manages cross-project status.

    Notion + Reclaim

    Tasks and calendar. The human-facing layer of the operating system.

    Everything in insights 1-9 describes the layers. This insight shows what it looks like when you wire them all together.

    I have been running this system for six months. Before the source code leaked. Before anyone was talking about it. The leak just validated the architecture.

    Here is the pattern:

    Every project gets a COS.yaml — a Client Operating System file. Single source of truth. Key data, current status, position within my business framework. One file tells any AI assistant exactly where this project stands.

    Different project types get different frameworks. A revenue client gets the TORQUE methodology. An internal product gets a different framework. Each framework deploys into a hidden folder (like .njin-method/) with its own scripts, structure, and config.

    Frameworks deploy agents. The hidden folder contains scripts that spin up the relevant agents for that project type. A revenue client might get a playbook agent, a CRM agent, and a dashboard agent. Each agent references specific skills.

    Skills reference templates, workflows, and MCPs. A playbook skill knows how to generate revenue playbooks from templates. A CRM skill connects to GoHighLevel via MCP. A reporting skill pulls data from Notion.

    Everything is linked. Framework → Agents → Skills → Templates → Workflows → MCPs. Change the framework, and the entire downstream chain updates.

    At the top sits Cowork — deployed at the root Projects level. It reads all COS files across all clients. It knows where every project stands, what is overdue, what needs attention. It references Notion for task management and Reclaim for calendar/time budgets.

    This is not a vision of the future. This is running in production today. The source code leak just showed everyone else what the architecture was designed to support.

    The gap between how most people use Claude Code and how it was designed to be used is enormous. That gap is your advantage.

    Ready to orchestrate AI in your business?

    Book a call to discuss how these techniques apply to your specific situation.

    Book a Call