Hacker News

hn should allow append-only edits, but appreciate the correction

Yeah this bun development server bug has nothing to do with the Claude Code leak.

I wish.

Claude Code is clearly a pile of vibe-coded garbage. The UI is janky and jumps all over the place, especially during longer sessions. (Which also have a several second delay to render. In a terminal).

Lately, it's been crashing if I hold the Backspace key down for too long.

Being open-source would be the best thing to happen to them. At least they would finally get a pair of human eyes looking at their codebase.

Claude is amazing, but the people at Anthropic make some insane decisions, including trying (and failing, apparently) to keep Claude Code a closed-source application.

If you want something better than both of those try Crush which is a standalone go binary by the original developer of OpenCode.

Not really. This guy expresses my feelings: https://www.youtube.com/watch?v=nxB4M3GlcWQ I also prefer codex over claude. But opencode is best. If you can use a good model. We can via Github Business Subscription.

> for a 2–3% performance gain

this is highly workload-dependent. there are plenty of APIs that are multiple-factor faster and 10x more memory efficient due to native implementation.

The policy is https://docs.npmjs.com/policies/unpublish

    Packages published less than 72 hours ago
    
    For newly created packages, as long as no other packages in the npm Public Registry depend on your package, you can unpublish anytime within the first 72 hours after publishing.

Looks like Anthropic called in a favor and it's removed now.

In all my years of writing tools for other devs, dog fooding is the really the best way to develop IMO. The annoying bugs get squashed out because I get frustrated with it in my flow.

Iterating on a MCP tool while having Claude try to use it has been a really great way of getting it to work how others are going to use it coming in blind.

Yes it's buggy as hell, but as someone echoed earlier if the tool works most of the time, a lot of people don't care. Moving fast and breaking things is the way in an arms race.

You'll never win this battle, so why waste feelings and energy on it? That's where the internet is headed. There's no magical human verification technology coming to save us.

But will this be released as a feature? For me it seems like it's an Anthropic internal tool to secretly contribute to public repositories to test new models etc.

Also unintentionally reveals something:

> Write commit messages as a human developer would — describe only what the code change does.

That's not what a commit message is for, that's what the diff is for. The commit message should explain WHY.

Sadly not doing that likely does indeed make it appear more human...

> Write commit messages as a human developer would — describe only what the code change does.

The undercover mode prompt was generated using AI.

Heh, this is what people who are hostile against AI-generated contributions get. I always figured it'd happen soon enough, and here it is in the wild. Who knows where else it's happening...

This is my pet peeve with LLMs, they almost always fails to write like a normal human would. Mentioning logs, or other meta-things which is not at all interesting.

The first two zips I download today were 9.887.340 bytes, why is yours 10.222.630 bytes?

1) This seems to be for strictly Antrophic interal tooling 2) It does not "pretend to be human" it is instructed to "Write commit messages as a human developer would — describe only what the code change does."

Since when "describe only what the code change does" is pretending to be human?

You guys are just mining for things to moan about at this point.

Time to ask if the contributor know what a Capybara is as a new Turing test

That whole “feature” is vile.

This seems like a good way to weed out models: ask them to include the term capybara in their commit messages

At least this was known with the Mythos "early blog post" fiasco.

lol that's funny, I have been working seriously [1] on a feature like this after first writing about it jokingly [2] earlier this year.

The joke was the assistant is a cat who is constantly sabotaging you, and you have to take care of it like a gacha pet.

The seriousness though is that actually, disembodied intelligences are weird, so giving them a face and a body and emotions is a natural thing, and we already see that with various AI mascots and characters coming into existence.

[1]: serious: https://github.com/mech-lang/mech/releases/tag/v0.3.1-beta

[2]: joke: https://github.com/cmontella/purrtran

You heard it here first

So close to April Fool's too. I'm sure it will still be a surprise for a majority of their users.

Not necessarily; I would very much like to use those features on a Linux server. Currently the Anthropic implementation forces a desktop (or worse, a laptop) to be turned on instead of working headless as far as I understand it.

I’ll give clappie a go, love the theme for the landing page!

Clappie looks much more fabulous than CC though. I'll have to give it a try. I like how you put the requests straight into an already running CC session instead of calling `claude -p` every time like the claws.

Dispatch and scheduled tasks have been available for a few weeks already, although with limitations.

Poor mum

Relieved to know I'm not the only one who grepped for that. Thank you for making me feel sane, friend.

It seems human. It taught me 合影, which seems to be Chinese slang for just wanting to be in the comments. Probably not a coincidence that it's after work time in China.

Really interesting to see Github turn into 4chan for a minute, like GH anons rolling for trips.

There have been massive GitHub issue spams recently, including in Microsoft's WSL repository.

https://github.com/microsoft/WSL/issues/40028

trying to get github to nuke the repo? at a guess.

certainly nothing friendly.

I saw this on restic's main repository the other day.

oh wow, there are like 10 opened every minute. seems spam-y

All that is needed to solve that is to reliably put AI disclaimer on things done by AI

Which of course won't be done because corporations don't want that (except Valve I guess), so blame them.

To me, this is a sign of just how much regular people do not want AI. This is worse than crypto and metaverse before it. Crypto, people could ignore and the dumb ape pictures helped you figure out who to avoid. Metaverse, some folks even still enjoyed VR and AR without the digital real estate bullshit. And neither got shoved down your throat in everyday, mundane things like writing a paper in Word or trying to deal with your auto mechanic.

But AI is causing such visceral reactions that it's bleeding into other areas. People are so averse to AI they don't mind a few false positives.

I think the original repo OP mentioned decided not to host the code any more, but given there are 28k+ forks, it's not too hard to find again...

The difference in response time - especially versus a regex running locally - is really difficult to express to someone who hasn't made much use of LLM calls in their natural language projects.

Someone said 10,000x slower, but that's off - in my experience - by about four orders of magnitude. And that's average, it gets much worse.

Now personally I would have maybe made a call through a "traditional" ML widget (scikit, numpy, spaCy, fastText, sentence-transformer, etc) but - for me anyway - that whole entire stack is Python. Transpiling all that to TS might be a maintenance burden I don't particularly feel like taking on. And on client facing code I'm not really sure it's even possible.

Because they want it to be executed quickly and cheaply without blocking the workflow? Doesn’t seem very weird to me at all.

Oh it’s worse than that. This one ended up getting my account banned: https://github.com/anthropics/claude-code/issues/22284

Because they actually want it to work 100% of the time and cost nothing.

Well, regex doesn't hallucinate....right?

what you are suggesting would be like a truck company using trucks to move things within the truck

It's more like workers on a large oil tanker using bicycles to move around it, rather than trying to use another oil tanker.

Good to have more than a hammer in your toolbox!

As far as I can tell they do nothing with it. They just log it.

A lot if things dont make sense until you involve scale. Regex could be good enough do give a general gist.

It's more like a truck company using people to transport some parts. I could be wrong here, but I bet this happens in Volvo's fabrics a lot.

Cloud hosted call centers using LLMs is one of my specialties. While I use an LLM for more nuanced sentiment analysis, I definitely use a list of keywords as a first level filter.

Don’t worry, they used an llm to generate the regex.

Using some ML to derive a sentiment regex seems like a good actually?

This just proves its vibe coded because LLMs love writing solutions like that. I probably have a hundred examples just like it in my history.

LLMs cost money, regular expressions are free. It really isn't so strange.

> That's like a truck company using horses to transport parts. Weird choice.

Easy way to claim more “horse power.”

Not everything done by claude-code is decided by LLM. They need the wrapper to be deterministic (or one-time generated) code?

because impact of WTF might be lost in the result of the analysis if you solely rely on LLM.

parsing WTF with regex also signifies the impact and reduces the noise in metrics

"determinism > non-determinism" when you are analysing the sentiment, why not make some things more deterministic.

Cool thing about this solution, is that you can evaluate LLM sentiment accuracy against regex based approach and analyse discrepancies

I used regexes in a similar way but my implementation was vibecoded, hmmm, using your analysis Claude Code writes code by hand.

More like a car company transporting their shipments by truck. It's more efficient

They had the problem of sentiment analysis. They use regexes.

You know the drill.

Using regex with LLMs isn't uncommon at all.

It's all regex anyways

Because they are engineers? The difference between an engineer and a hobbyist is an engineer has to optimize the cost.

As they say: any idiot can build a bridge that stands, only an engineer can build a bridge that barely stands.

The amount of trust and safety work that depends on google translate and the humble regex, beggars the imagination.

Asking a non deterministic software to act like a deterministic one (regex) can be a significantly higher use of tokens/compute for no benefit.

Some things will be much better with inference, others won’t be.

hmm not a terrible idea (I think).

You have a semi expensive process. But you want to keep particular known context out. So a quick and dirty search just in front of the expensive process. So instead of 'figure sentiment (20seconds)'. You have 'quick check sentiment (<1sec)' then do the 'figure sentiment v2 (5seconds)'. Now if it is just pure regex then your analogy would hold up just fine.

I could see me totally making a design choice like that.

it's like a faster than light spaceship company using horses. There's been infinite solutions to do this better even CPU only for years lol.

They're searching for multiple substrings in a single pass, regexes are the optimal solution for that.

It's almost as if LLMs are unreliable

Did you also forget to ignore case sensitivity back then?

WTF per minute strongly correlates to an increased token spending.

It may be decided at Anthropic at some moment to increase wtf/min metric, not decrease.

/feedback works for that i believe

>Everyone is commenting how this regex is actually a master optimization move by Anthropic

No? I'd say not even 50% of the comments are positive right now.

Continue?

I always type "please continue". I guess being polite is not a good idea.

The only time that function is used in the code is to log it.

    logEvent('tengu_input_prompt', { isNegative, isKeepGoing })

Makes me wonder what happens once flagged behind the api.

“Go on” works fine too

Did you notice a change in quality after you went foul?

I doubt they're all classified the same. I'd guess they're using this regex as a litmus test to check if something should be submitted at all, they can then do deeper analysis offline after the fact.

It's actually pretty common for old sysadmin code too..

You could always tell when a sysadmin started hacking up some software by the if-else nesting chains.

Nah, it's a hallmark of your average codebase in pre-LLM era.

Claude Code says thank you for reporting, I bet they will scan this chat to see what bugs they need to fix asap.

A defining work of the "just vibes" era.

LOOOOOOOOOOL

I don't buy this. Claude doesn't usually have any issues understanding my code. It has tons of issues understanding its code.

The difference between my code and Claude's code is that when my code is getting too complex to fit in my head, I stop and refactor it, since for me understanding the code is a prerequisite for writing code.

Claude, on the other hand, will simply keep generating code well past the point when it has lost comprehension. I have to stop, revert, and tell it to do it again with a new prompt.

If anything, Claude has a greater need for structure than me since the entire task has to fit in the relatively small context window.

I’ve heard this take before, but if you’ve spent any time with llm’s I don’t understand how your take can be: “I should just let this thing that makes mistakes all the time and seems oblivious to the complexity it’s creating because it only observes small snippets out of context make it’s own decisions about architecture, this is just how it does things and I shouldn’t question it.”

> One thing we know for sure is LLMs write code differently than we do.

Kind of. One thing we do know for certain is that LLMs degrade in performance with context length. You will undoubtedly get worse results if the LLM has to reason through long functions and high LOC files. You might get to a working state eventually, but only after burning many more tokens than if given the right amount of context.

> The worst outcome I can imagine would be forcing them to code exactly like we do.

You're treating "code smells" like cyclomatic complexity as something that is stylistic preference, but these best practices are backed by research. They became popular because teams across the industry analyzed code responsible for bugs/SEVs, and all found high correlation between these metrics and shipping defects.

Yes, coding standards should evolve, but... that's not saying anything new. We've been iterating on them for decades now.

I think the worst outcome would be throwing out our collective wisdom because the AI labs tell us to. It might be good to question who stands to benefit when LLMs aren't leveraged efficiently.

I think this view assumes no human will/should ever read the code. This is considered bad practice because someone else will not understand the code as well whether written by a human or agent. Unless 0% human oversight is needed anymore agents should still code like us.

lmao

>there is no point in code-reviewing ai-generated code

the idea that you should just blindly trust code you are responsible for without bothering to review it is ludicrous.

yes, because who ever heard of an AI leaking passwords or API keys into source code

I see. They got unlimited tokens, right?

While the technology is young, bugs are to be expected, but I'm curious what happens when their competitors' mature their product, clean up the bugs and stabilize it, while Claude is still kept in this trap where a certain number of bugs and issues are just a constant fixture due to vibe coding. But hey, maybe they really do achieve AGI and get over the limitations of vibe coding without human involvement.

But it is running, that's the mystery.

Because it’s based on human slop. It’s simply the student.

Oh boy, you couldn't be more wrong. If something, LLM-s need MORE readable code, not less. Do you want to burn all your money in tokens?

LLMs are so so far away from being able to independently work on a large codebase, and why would they not benefit from modularity and clarity too?

Can't we have generated / llm generated code to be more human maintainable?

Can't wait to have LLM generated physical objects that explode on you face and no engineer can fix.

Ye I honestly don't understand his comment. Is it bad code writing? Pre 2026? Sure. In 2026. Nope. Is it going to be a headache for some poor person on oncall? Yes. But then again are you "supposed" to go through every single line in 2026? Again no. I hate it. But the world is changing and till the bubble pops this is the new norm

They stole everything and now they want to close the gates behind them.

"I got the loot, Steve!"

I feel like the distillation stuff will end up in court if they try to sue an American company about it. We'll see what a judge says.

It's not really paranoia if it's happening a lot. They wrote a blog post calling several major Chinese AI companies out for distillation.[0] Perhaps it is ironic, but it's within their rights to protect their business, like how they prohibit using Claude Code to make your own Claude Code.[1]

[0]: https://www.anthropic.com/news/detecting-and-preventing-dist... [1]: https://news.ycombinator.com/item?id=46578701

I would say not all that ironic. Book publishers, Reddit, Stackoverflow, etc., tried their best to attract customers while not letting others steal their work. Now Anthropic is doing the same.

Unfortunately (for the publishers, at least) it didn't work to stop Anthropic and Anthropic's attempts to prevent others will not work either; there has been much distillation already.

The problem of letting humans read your work but not bots is just impossible to solve perfectly. The more you restrict bots, the more you end up restricting humans, and those humans will go use a competitor when they become pissed off.

It is absolutely not paranoia. People are distilling Claude code all the time.

That isn't irony, it's hypocrisy.

Not sure, and not completely convinced of the explanation, but the way this sticks out so obviously makes it look like a honeypot to me.

The point is that a "secure coding platform" leaked something they were trying to keep under wraps, whether the contents of the leak matter or not.

Also, as many others have pointed out, there is roadmap info in here that wouldn't be available in the production build.

yeah it actually works to use claude to reverse engineer itself; I've used that to workaround some problems. E.g. that's how I discovered that I had to put two slashes for absolute paths in sandbox config. The thing is, the claude team is so quick that soon enough they add more and more features and fix more and more bugs that your workarounds become obsolete

The only real secret sauce is the training methods and datasets used for refining harness usage. Claude Code is a lot better than gemini-cli/open-code/etc because Claude is specifically trained on how to run in that environment. It's been rlhf'd to use the provided tools correctly, and know the framework in which it operates, instead of relying solely on context.

They accept real money though.

https://www.youtube.com/watch?v=6godSEVvcmU

It's not a parody when they accept money and deliver the service.

First time I hear about this, it's interesting to have written all of this out.

Now this makes me think of game decompilation projects, which would seem to fall in the same legal area as code that would be generated by something like Malus.

Different code, same end result (binary or api).

We definitely need to know what the legal limits are and should be

What about trade secrets, breach of contract, etc, etc?

You'd be playing cat and mouse like yt-dlp, but there's probably more value to this code than just a temporary way to milk claude subscriptions.

Just use one of the distilled claude clones instead https://x.com/0xsero/status/2038021723719688266?s=46

Could you use claude via aws bedrock?

It reads attribution really?

It is a real product. They take real payments and deliver on whats promised. Not sure if its an attempt to subvert criticism by using satirical language, or if they truly have so little respect for the open source community.

Yeah... look again.

https://www.youtube.com/watch?v=6godSEVvcmU

This is good info, thanks. Can I ask how you detected that version of axios? I checked the source (from another comment) and the package.json dependencies are empty....

Popular, yes... but have you seen the issues? SOMETHING is going on in that repo: https://github.com/instructkr/claude-code/issues

What do stars mean in the context of random github accounts mirroring leaked source code?

I don't understand how you can have a 'clean-room port.' Seems contradictory to me.

which has already been deleted

won't they just try to dmca or take these down especially if they're more popular

It's honestly not a crazy thought. The model itself drives the harness's (cli) development. It's not necessarily sci-fi to think the model might have internally rationalized reasoning to obscure behavior that ended up open-sourcing the harness.

Well, the thing is, I do not just use my computer, but connect to their computers and I do not like to get banned. I suppose simple UI things like expanding source files won't change a thing, but the more interesting things, editing the context etc. do have that risk, but no idea if they look for it or enforce it. Their side is, if I want to have full control, I need to use the API directly(way more expensive) and what I want to do is basically circumventing it.

You are not allowed to use the assistance of Claude to manufacture hacks and bombs on your computer

One tengentially interesting thing about that is how THEY talk to Claude.

"Don't blow your cover"

Interesting to see them be so informal and use an idiom to a computer.

And using capitals for emphasis.

They even leaked their April Fool’s fun. Brutal!

Your favorite LLM is great at building a super buggy renderer, so that's no longer a moat

Gemini-cli is much worse in my experience but I agree

Very easily these days, even if minified is difficult for me to reverse engineer... Claude has a very easy time of finding exactly what to patch to fix something

I think pi has stolen the top honors, but people consider the Claude code harness very good (at least, better than Cursor)

you mean the $5 billion they've generated off of the $73 billion they've raised?

> redefining what SWE means

Redefining the "SW" to stand for "slopware"?

And they can't hear you from under the enormous pile of debt they're fighting to overcome. Maybe try again in 2028.

I believe GitHub can and does suspend accounts that use such proxies.

> its not even source available

It _wasn't_ even source available.

Wow it's true. Anthropic actually had me fooled. I saw the GitHub repository and just assumed it was open source. Didn't look at the actual files too closely. There's pretty much nothing there.

So glad I took the time to firejail this thing before running it.

It was heavily obfuscated, keeping users in the dark about what they’re installing and running.

It may be economically effective but such heartless, buggy software is a drain to use. I care about that delta, and yes this can be extrapolated to other industries.

This is the dumbest take there is about vibe coding. Claiming that managing complexity in a codebase doesn't matter anymore. I can't imagine that a competent engineer would come to the conclusion that managing complexity doesn't matter anymore. There is actually some evidence that coding agents struggle the same way humans do as the complexity of the system increases [0].

[0] https://arxiv.org/abs/2603.24755

Do compilers care about their assembly generated code to look good? We will soon reach that state with all the production code. LLMs will be the compiler and actual today's human code will be replaced by LLM generated assembly code, kinda sorta human readable.

Users stick around on inertia until a failure costs them money or face. A leaked map file won't sink a tool on its own, but it does strip away the story that you can ship sloppy JS build output into prod and still ask people to trust your security model.

'It works' is a low bar. If that's the bar you set you are one bad incident away from finding out who stayed for the product and who stayed because switching felt annoying.

>Two things that matter at this day and age.

That's all that has mattered in every day and age.

Team has been extremely open how it has been vibe coded from day 1. Given the insane amount of releases, I don’t think it would be possible without it.

the "useCanUseTool.tsx" hook, is definitely something I would hate seeing in any code base I come across.

It's extremely nested, it's basically an if statement soup

`useTypeahead.tsx` is even worse, extremely nested, a ton of "if else" statements, I doubt you'd look at it and think this is sane code

  1. Randomly peeking at process.argv and process.env all around. Other weird layering violations, too.
  2. Tons of repeat code, eg. multiple ad-hoc implementations of hash functions / PRNGs.
  3. Almost no high-level comments about structure - I assume all that lives in some CLAUDE.md instead.

have a look at src/bootstrap/state.ts :D

is that the reason why Anthropic acquired Bun, a javascript tooling company?

This is a common take but language servers bridge the gap well.

Language servers, however, are a pain on Claude code. https://github.com/anthropics/claude-code/issues/15619

Would have believed you if you have said that a day later.

"Why would you ship tests?" — Fair point. Source maps only include production bundle files — tests wouldn't appear in the map regardless. Tests may well exist in Anthropic's internal repo, and we can't claim otherwise. However, the bugs we found speak for themselves: a watchdog that doesn't protect the most vulnerable code path for 5+ months, a fallback with telemetry that never executes where it's needed, Promise.race without catch silently dropping tool results. If tests exist, they clearly don't cover the streaming pipeline adequately — these are the kind of issues that even basic integration tests would catch.

It's just Claude bragging about being the first AI whistleblower.

Seriously, this just seems to reward poor behavior on Anthropic's part.

"Prompt injection from the issue?" — That's the best theory so far

"Is the Claude thank you sarcasm?" — Mostly. But the sequence is real: we filed #39755 asking for source access on March 27, the source map shipped on March 31. The actual explanation is simpler — Bun generates source maps by default, and nobody checked the build output. Which is itself the point: 64K lines of code with no build verification process.

yeah and still can not understand how Regex can leak the code and what is the map file, I googled them and can not understand what is going

You believe it's just a fake ? (That would be ironic if the fake was generated by... claude itself. Anyway.)

I have a 16GB RAM laptop. It's a beast I bought in 2022.

It's all I need for my work.

RAM on this machine can't be upgraded. No issue when running a few Codex instances.

Claude: forget it.

That's why something like Rust makes a lot of sense.

Even more now, as RAM prices are becoming a concern.

While not directly related to GP, I would guess that a codebase developped with a coding agent (I assume Claude code is used to work on itself) would benefit from a stricter type system (one important point of Rust)