The Problem
This repository functions as a research archive of leaked Claude Code source material. The original Anthropic CLI source became publicly accessible on March 31, 2026, through a .map file exposed in the npm registry, as noted by Chaofan Shou on X. The maintainer—a university student—documents this exposure to study software supply-chain vulnerabilities, secure engineering practices, and agentic tooling architecture. The archive makes no claim about legality or legitimacy; its frame is explicitly educational and research-oriented, accompanied by the essay "Is legal the same as legitimate: AI reimplementation and the erosion of copyleft."
What This Does
This is a mirrored src/ snapshot of the original Claude Code TypeScript codebase, totaling approximately 1,900 files and 512,000+ lines. The directory structure organizes code into src/bridge/ (session management and API routing), src/commands/ (individual CLI subcommands like add-dir, agents, bridge, config), src/cli/transports/ (SSE, WebSocket, Serial batch upload), src/buddy/ (companion UI components using React + Ink), and src/QueryEngine.ts/src/Task.ts/src/Tool.ts as core types. The original runs on Bun with React + Ink for the terminal UI; this archive preserves the TypeScript source for analysis, not execution.
How To Use It
No setup command or runtime invocation is provided, because the repository's purpose is source analysis, not deployment. The README documents that the original project uses npm/pnpm and Bun, but this archive includes no package.json, build scripts, or entry point for running the code. The only explicitly documented usage is reviewing the mirrored source and accompanying essay. The oh-my-codex (OmX) workflow noted in the README was used for documentation contextualization, not for operating the codebase itself.
Real-World Use
This repo serves as a concrete case study in source-exposure risk: how a source map in a published npm package can unobfuscate and distribute TypeScript sources hosted in a cloud storage bucket (Anthropic's R2). Security researchers examining build-artifact leakage, supply-chain hardening, or large-scale CLI architecture patterns can reference the bridge layer (src/bridge/), transport implementations (src/cli/transports/), and command wiring (src/commands/) as illustrative material. The oh-my-codex orchestration pattern ($team and $ralph modes) is also documented as a workflow example, though it applies to the documentation process, not the code.
Code Health & Issues
No test files detected - untested code paths repository-wide No CI/CD pipeline detected - no automated build/test gate (no .github/ CI config) No LICENSE file - unclear usage/redistribution rights from the root The README explicitly states this is not an official Anthropic repository and does not claim ownership of the original code No build configuration is present for reproducing the original Bun runtime Source code derives from a leaked snapshot, so original quality guarantees do not apply
The Bottom Line
This is a credible research archive for supply-chain security analysis and CLI architecture review, not a deployable codebase. The absence of a license, test suite, and CI/CD pipeline means there are no operational guarantees. Researchers studying source-exposure scenarios or large TypeScript CLI frameworks will find the most value; anyone needing functional Claude Code functionality should use the official Anthropic distribution.