Live data from Hacker News

Claude Code's source code has been leaked via a map file in their NPM registry

twitter.com

581–590 of 1001 posts

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#581

Why is Claude Code, a desktop tool, written in JS? Is the future of all software JS or Typescript?

LLMs are good in JS and Python which means everything from now on will be written in or ported to either of those two languages. So yeah, JS is the future of all software.

Would have believed you if you have said that a day later.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#582

src/cli/print.ts This is the single worst function in the codebase by every metric: - 3,167 lines long (the file itself is 5,594 lines) - 12 levels of nesting at its deepest - ~486 branch points of cyclomatic complexity - 12 parameters + an options object with 16 sub-properties - Defines 21 inner functions and closures - Handles: agent run loop, SIGINT, rate-limits, AWS auth, MCP lifecycle, plugin install/refresh, wo…

> This should be at minimum 8–10 separate modules.

Can't really say that for sure. The way humans structure code isn't some ideal best possible state of computer code, it's the ideal organization of computer code for human coders.

Nesting and cyclomatic complexity are indicators ("code smells"). They aren't guaranteed to lead to worse outcomes. If you have a function with 12 levels of nesting, but in each nest the first line is 'return true', you actually have 1 branch. If 2 of your 486 branch points are hit 99.999% of the time, the code is pretty dang efficient. You can't tell for sure if a design is actually good or bad until you run it a lot.

One thing we know for sure is LLMs write code differently than we do. They'll catch incredibly hard bugs while making beginner mistakes. I think we need a whole new way of analyzing their code. Our human programming rules are qualitative because it's too hard to prove if an average program does what we want. I think we need a new way to judge LLM code.

The worst outcome I can imagine would be forcing them to code exactly like we do. It just reinforces our own biases, and puts in the same bugs that we do. Vibe coding is a new paradigm, done by a new kind of intelligence. As we learn how to use it effectively, we should let the process of what works develop naturally. Evolution rather than intelligent design.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#583
post #575

Earlier quoted context omitted.

We used this in 2011 at the startup I worked for. 20 positive and 20 negative words was good enough to sell Twitter "sentiment analysis" to companies like Apple, Bentley, etc...

Did you also forget to ignore case sensitivity back then?

[deleted]

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#584

src/cli/print.ts This is the single worst function in the codebase by every metric: - 3,167 lines long (the file itself is 5,594 lines) - 12 levels of nesting at its deepest - ~486 branch points of cyclomatic complexity - 12 parameters + an options object with 16 sub-properties - Defines 21 inner functions and closures - Handles: agent run loop, SIGINT, rate-limits, AWS auth, MCP lifecycle, plugin install/refresh, wo…

the claude code team ethos, as far as i’ve been lead to understand— which i agree with, mind you— is that there is no point in code-reviewing ai-generated code… simply update your spec(s) and regenerate. it is just a completely different way of interacting with the world. but it clearly works for them, so people throwing up their hands should at least take notice of the fact that they are absolutely not competing wit…

>there is no point in code-reviewing ai-generated code

the idea that you should just blindly trust code you are responsible for without bothering to review it is ludicrous.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#587
post #539
post #302

Earlier quoted context omitted.

They stole everything and now they want to close the gates behind them. "I got the loot, Steve!" I feel like the distillation stuff will end up in court if they try to sue an American company about it. We'll see what a judge says.

[flagged]

next you should explain idioms

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#588

Earlier quoted context omitted.

They're searching for multiple substrings in a single pass, regexes are the optimal solution for that.

The issue isn't that regex are a solution to find a substring. The issue is that you shouldn't be looking for substrings in the first place. This has buttbuttin energy. Welcome to the 80s I guess.

> The issue is that you shouldn't be looking for substrings in the first place.

Why? They clearly just want to log conversations that are likely to display extreme user frustration with minimal overhead. They could do a full-blown NLP-driven sentiment analysis on every prompt but I reckon it would not be as cost-effective as this.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#589
post #575

Earlier quoted context omitted.

We used this in 2011 at the startup I worked for. 20 positive and 20 negative words was good enough to sell Twitter "sentiment analysis" to companies like Apple, Bentley, etc...

Did you also forget to ignore case sensitivity back then?

the string is lowercased before the regex is run, fwiw

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#590

Earlier quoted context omitted.

An LLM company using regexes for sentiment analysis? That's like a truck company using horses to transport parts. Weird choice.

The difference in response time - especially versus a regex running locally - is really difficult to express to someone who hasn't made much use of LLM calls in their natural language projects. Someone said 10,000x slower, but that's off - in my experience - by about four orders of magnitude. And that's average, it gets much worse. Now personally I would have maybe made a call through a "traditional" ML widget (sciki…

They're sending it to an llm anyway tho? Not sure why they wouldn't just add a sentiment field to the requested response shape.
Post reply on HN