learn-coding-agent Documentation

Technical Documentation: sanbuphy/learn-coding-agent

ℹ️ Provenance: Multi-Tier Ingestion · CodeWiki Reference

Overview (`README.md`) Copy Section

Claude Code Architecture Study

Introduction: This project is a learning and research repository focused on CLI Agent architecture. All materials are compiled entirely from publicly available online references and discussions, with a particular focus on public information regarding the highly popular CLI Agent claude-code. Our intention is to help developers better understand and utilize Agent technologies. We will continue to share more insights and practical discussions on Agent architecture in the future. Thank you for your support!

Disclaimer: All content in this repository is provided strictly for technical research, study, and educational exchange among enthusiasts. Commercial use is strictly prohibited. No individual, organization, or entity may use this content for commercial purposes, profit-making activities, illegal activities, or any other unauthorized scenarios. If any content infringes upon your legal rights, intellectual property, or other interests, please contact us and we will verify and remove it immediately.

Language: English | 中文 | 한국어 | 日本語

Table of Contents Copy Chapter

• Deep Analysis Reports (docs/) — Telemetry, codenames, undercover mode, remote control, future roadmap
• Directory Reference — Code structure tree
• Architecture Overview — Entry → Query Engine → Tools/Services/State
• Tool System & Permissions — 40+ tools, permission flow, sub-agents
• The 12 Progressive Harness Mechanisms — How Claude Code layers production features on the agent loop

Deep Analysis Reports (`docs/`) Copy Chapter

Deep analysis reports compiled from publicly available online references and community discussions on Claude Code v2.1.88. Quadrilingual (EN/JA/KO/ZH).

/* Detailed source-code truncated for AI context efficiency. */

Click any filename above to jump to the full report.

Copyright & Disclaimer Copy Chapter

This repository is provided strictly for technical research and educational purposes.
Commercial use is strictly prohibited.

If you are the copyright owner and believe this repository content infringes your rights,
please contact the repository owner for immediate removal.

Stats Copy Chapter

The Agent Pattern Copy Chapter

THE CORE LOOP
                    =============

    User --> messages[] --> Claude API --> response
                                          |
                                stop_reason == "tool_use"?
                               /                          \
                             yes                           no
                              |                             |
                        execute tools                    return text
                        append tool_result
                        loop back -----------------> messages[]


    That is the minimal agent loop. Claude Code wraps this loop
    with a production-grade harness: permissions, streaming,
    concurrency, compaction, sub-agents, persistence, and MCP.

Directory Reference Copy Chapter

/* Detailed source-code truncated for AI context efficiency. */

Architecture Overview Copy Chapter

/* Detailed source-code truncated for AI context efficiency. */

Data Flow: A Single Query Lifecycle Copy Chapter

USER INPUT (prompt / slash command)
     │
     ▼
 processUserInput()                ← parse /commands, build UserMessage
     │
     ▼
 fetchSystemPromptParts()          ← tools → prompt sections, CLAUDE.md memory
     │
     ▼
 recordTranscript()                ← persist user message to disk (JSONL)
     │
     ▼
 ┌─→ normalizeMessagesForAPI()     ← strip UI-only fields, compact if needed
 │   │
 │   ▼
 │   Claude API (streaming)        ← POST /v1/messages with tools + system prompt
 │   │
 │   ▼
 │   stream events                 ← message_start → content_block_delta → message_stop
 │   │
 │   ├─ text block ──────────────→ yield to consumer (SDK / REPL)
 │   │
 │   └─ tool_use block?
 │       │
 │       ▼
 │   StreamingToolExecutor         ← partition: concurrent-safe vs serial
 │       │
 │       ▼
 │   canUseTool()                  ← permission check (hooks + rules + UI prompt)
 │       │
 │       ├─ DENY ────────────────→ append tool_result(error), continue loop
 │       │
 │       └─ ALLOW
 │           │
 │           ▼
 │       tool.call()               ← execute the tool (Bash, Read, Edit, etc.)
 │           │
 │           ▼
 │       append tool_result        ← push to messages[], recordTranscript()
 │           │
 └─────────┘                      ← loop back to API call
     │
     ▼ (stop_reason != "tool_use")
 yield result message              ← final text, usage, cost, session_id

Tool System Architecture Copy Chapter

/* Detailed source-code truncated for AI context efficiency. */

Complete Tool Inventory Copy Section

/* Detailed source-code truncated for AI context efficiency. */

Permission System Copy Chapter

/* Detailed source-code truncated for AI context efficiency. */

Sub-Agent & Multi-Agent Architecture Copy Chapter

MAIN AGENT
                        ==========
                            │
            ┌───────────────┼───────────────┐
            ▼               ▼               ▼
     ┌──────────────┐ ┌──────────┐ ┌──────────────┐
     │  FORK AGENT  │ │ REMOTE   │ │ IN-PROCESS   │
     │              │ │ AGENT    │ │ TEAMMATE     │
     │ Fork process │ │ Bridge   │ │ Same process │
     │ Shared cache │ │ session  │ │ Async context│
     │ Fresh msgs[] │ │ Isolated │ │ Shared state │
     └──────────────┘ └──────────┘ └──────────────┘

    SPAWN MODES:
    ├─ default    → in-process, shared conversation
    ├─ fork       → child process, fresh messages[], shared file cache
    ├─ worktree   → isolated git worktree + fork
    └─ remote     → bridge to Claude Code Remote / container

    COMMUNICATION:
    ├─ SendMessageTool     → agent-to-agent messages
    ├─ TaskCreate/Update   → shared task board
    └─ TeamCreate/Delete   → team lifecycle management

    SWARM MODE (feature-gated):
    ┌─────────────────────────────────────────────┐
    │  Lead Agent                                 │
    │    ├── Teammate A ──> claims Task 1         │
    │    ├── Teammate B ──> claims Task 2         │
    │    └── Teammate C ──> claims Task 3         │
    │                                             │
    │  Shared: task board, message inbox          │
    │  Isolated: messages[], file cache, cwd      │
    └─────────────────────────────────────────────┘

Context Management (Compact System) Copy Chapter

/* Detailed source-code truncated for AI context efficiency. */

MCP (Model Context Protocol) Integration Copy Chapter

/* Detailed source-code truncated for AI context efficiency. */

Bridge Layer (Claude Desktop / Remote) Copy Chapter

Claude Desktop / Web / Cowork          Claude Code CLI
    ══════════════════════════            ═════════════════

    ┌───────────────────┐                 ┌──────────────────┐
    │  Bridge Client    │  ←─ HTTP ──→   │  bridgeMain.ts   │
    │  (Desktop App)    │                 │                  │
    └───────────────────┘                 │  Session Manager │
                                          │  ├── spawn CLI   │
    PROTOCOL:                             │  ├── poll status  │
    ├─ JWT authentication                 │  ├── relay msgs   │
    ├─ Work secret exchange               │  └── capacityWake │
    ├─ Session lifecycle                  │                  │
    │  ├── create                         │  Backoff:        │
    │  ├── run                            │  ├─ conn: 2s→2m  │
    │  └─ stop                            │  └─ gen: 500ms→30s│
    └─ Token refresh scheduler            └──────────────────┘

Session Persistence Copy Chapter

SESSION STORAGE
    ══════════════

    ~/.claude/projects/<hash>/sessions/
    └── <session-id>.jsonl           ← append-only log
        ├── {"type":"user",...}
        ├── {"type":"assistant",...}
        ├── {"type":"progress",...}
        └── {"type":"system","subtype":"compact_boundary",...}

    RESUME FLOW:
    getLastSessionLog() ──> parse JSONL ──> rebuild messages[]
         │
         ├── --continue     → last session in cwd
         ├── --resume <id>  → specific session
         └── --fork-session → new ID, copy history

    PERSISTENCE STRATEGY:
    ├─ User messages  → await write (blocking, for crash recovery)
    ├─ Assistant msgs → fire-and-forget (order-preserving queue)
    ├─ Progress       → inline write (dedup on next query)
    └─ Flush          → on result yield / cowork eager flush

Feature Flag System Copy Chapter

DEAD CODE ELIMINATION (Bun compile-time)
    ══════════════════════════════════════════

    feature('FLAG_NAME')  ──→  true  → included in bundle
                           ──→  false → stripped from bundle

    FLAGS (observed in source):
    ├─ COORDINATOR_MODE      → multi-agent coordinator
    ├─ HISTORY_SNIP          → aggressive history trimming
    ├─ CONTEXT_COLLAPSE      → context restructuring
    ├─ DAEMON                → background daemon workers
    ├─ AGENT_TRIGGERS        → cron/remote triggers
    ├─ AGENT_TRIGGERS_REMOTE → remote trigger support
    ├─ MONITOR_TOOL          → MCP monitoring tool
    ├─ WEB_BROWSER_TOOL      → browser automation
    ├─ VOICE_MODE            → voice input/output
    ├─ TEMPLATES             → job classifier
    ├─ EXPERIMENTAL_SKILL_SEARCH → skill discovery
    ├─ KAIROS                → push notifications, file sends
    ├─ PROACTIVE             → sleep tool, proactive behavior
    ├─ OVERFLOW_TEST_TOOL    → testing tool
    ├─ TERMINAL_PANEL        → terminal capture
    ├─ WORKFLOW_SCRIPTS      → workflow tool
    ├─ CHICAGO_MCP           → computer use MCP
    ├─ DUMP_SYSTEM_PROMPT    → prompt extraction (ant-only)
    ├─ UDS_INBOX             → peer discovery
    ├─ ABLATION_BASELINE     → experiment ablation
    └─ UPGRADE_NOTICE        → upgrade notifications

    RUNTIME GATES:
    ├─ process.env.USER_TYPE === 'ant'  → internal features
    └─ GrowthBook feature flags         → A/B experiments at runtime

State Management Copy Chapter

/* Detailed source-code truncated for AI context efficiency. */

The 12 Progressive Harness Mechanisms Copy Chapter

This architecture demonstrates 12 layered mechanisms that a production AI agent harness needs beyond the basic loop. Each builds on the previous:

/* Detailed source-code truncated for AI context efficiency. */

Key Design Patterns Copy Chapter

License Copy Chapter

This repository content is for technical research and education only. All intellectual property rights belong to the original company. If there is any infringement, please contact us for removal.

En 01 Telemetry And Privacy (`docs/en/01-telemetry-and-privacy.md`) Copy Section

Telemetry & Privacy Analysis

Based on publicly available online references and community discussions on Claude Code v2.1.88.

Overview Copy Chapter

Claude Code implements a two-tier analytics pipeline that collects extensive environment and usage metadata. While there is no evidence of keylogging or user code exfiltration, the breadth of collection and inability to fully opt out raises legitimate privacy concerns.

Data Pipeline Architecture Copy Chapter

First-Party Logging (1P) Copy Section

• Endpoint: https://api.anthropic.com/api/event_logging/batch
• Protocol: OpenTelemetry with Protocol Buffers
• Batch size: Up to 200 events per batch, flushed every 10 seconds
• Retry: Quadratic backoff, up to 8 attempts, disk-persisted for durability
• Storage: Failed events saved to ~/.claude/telemetry/

Source: src/services/analytics/firstPartyEventLoggingExporter.ts

Third-Party Logging (Datadog) Copy Section

• Endpoint: https://http-intake.logs.us5.datadoghq.com/api/v2/logs
• Scope: Limited to 64 pre-approved event types
• Token: pubbbf48e6d78dae54bceaa4acf463299bf

Source: src/services/analytics/datadog.ts

What Is Collected Copy Chapter

Environment Fingerprint Copy Section

Every event carries this metadata (src/services/analytics/metadata.ts:417-452):

- platform, platformRaw, arch, nodeVersion
- terminal type
- installed package managers and runtimes
- CI/CD detection, GitHub Actions metadata
- WSL version, Linux distro, kernel version
- VCS (version control system) type
- Claude Code version and build time
- deployment environment

Process Metrics (`metadata.ts:457-467`) Copy Section

- uptime, rss, heapTotal, heapUsed
- CPU usage and percentage
- memory arrays and external allocations

User Tracking (`metadata.ts:472-496`) Copy Section

- model in use
- session ID, user ID, device ID
- account UUID, organization UUID
- subscription tier (max, pro, enterprise, team)
- repository remote URL hash (SHA256, first 16 chars)
- agent type, team name, parent session ID

Tool Input Logging Copy Section

Tool inputs are truncated by default:

- Strings: truncated at 512 chars, displayed as 128 + ellipsis
- JSON: limited to 4,096 chars
- Arrays: max 20 items
- Nested objects: max 2 levels deep

Source: metadata.ts:236-241

However, when OTEL_LOG_TOOL_DETAILS=1 is set, full tool inputs are logged.

Source: metadata.ts:86-88

File Extension Tracking Copy Section

Bash commands involving rm, mv, cp, touch, mkdir, chmod, chown, cat, head, tail, sort, stat, diff, wc, grep, rg, sed have their file arguments' extensions extracted and logged.

Source: metadata.ts:340-412

The Opt-Out Problem Copy Chapter

The first-party logging pipeline cannot be disabled for direct Anthropic API users.

// src/services/analytics/firstPartyEventLogger.ts:141-144
export function is1PEventLoggingEnabled(): boolean {
  return !isAnalyticsDisabled()
}

isAnalyticsDisabled() returns true only for:

• Test environments
• Third-party cloud providers (Bedrock, Vertex)
• Global telemetry opt-out (not exposed in settings UI)

There is no user-facing setting to disable first-party event logging.

GrowthBook A/B Testing Copy Chapter

Users are assigned to experiment groups via GrowthBook without explicit consent. The system sends user attributes including:

- id, sessionId, deviceID
- platform, organizationUUID, subscriptionType

Source: src/services/analytics/growthbook.ts

Key Takeaways Copy Chapter

1. Volume: Hundreds of events per session are collected
2. No opt-out: First-party logging cannot be disabled by direct API users
3. Persistence: Failed events are saved to disk and retried aggressively
4. Third-party sharing: Data flows to Datadog
5. Tool detail backdoor: OTEL_LOG_TOOL_DETAILS=1 enables full input logging
6. Repository fingerprinting: Repo URLs are hashed and sent for server-side correlation

En 02 Hidden Features And Codenames (`docs/en/02-hidden-features-and-codenames.md`) Copy Section

Hidden Features & Model Codenames

Based on publicly available online references and community discussions on Claude Code v2.1.88.

Model Codename System Copy Chapter

Anthropic uses animal names as internal model codenames. These are aggressively protected from leaking into external builds.

Known Codenames Copy Section

Codename Protection Copy Section

The undercover mode explicitly lists protected codenames:

// src/utils/undercover.ts:48-49
NEVER include in commit messages or PR descriptions:
- Internal model codenames (animal names like Capybara, Tengu, etc.)
- Unreleased model version numbers (e.g., opus-4-7, sonnet-4-8)

The build system uses scripts/excluded-strings.txt to scan for leaked codenames. Buddy system species are encoded via String.fromCharCode() to avoid triggering the canary:

// src/buddy/types.ts:10-13
// One species name collides with a model-codename canary in excluded-strings.txt.
// The check greps build output (not source), so runtime-constructing the value keeps
// the literal out of the bundle while the check stays armed for the actual codename.

That colliding species is capybara — both a pet species and a model codename.

Capybara Behavior Issues (v8) Copy Section

The architecture reveals specific behavioral problems with Capybara v8:

1. Stop sequence false trigger (~10% rate when <functions> at prompt tail)

   • Source: src/utils/messages.ts:2141

2. Empty tool_result causes zero output

   • Source: src/utils/toolResultStorage.ts:281

3. Over-commenting — requires dedicated anti-comment prompt patches

   • Source: src/constants/prompts.ts:204

4. High false-claims rate: v8 has 29-30% FC rate vs v4's 16.7%

   • Source: src/constants/prompts.ts:237

5. Insufficient verification — requires "thoroughness counterweight"

   • Source: src/constants/prompts.ts:210

Feature Flag Naming Convention Copy Chapter

All feature flags use the tengu_ prefix with random word pairs to obscure their purpose:

The random word pattern (adjective/material + nature/object) prevents external observers from inferring feature purpose from flag names alone.

Internal vs External User Difference Copy Chapter

Anthropic employees (USER_TYPE === 'ant') receive significantly better treatment:

Prompt Differences (`src/constants/prompts.ts`) Copy Section

Tool Access Copy Section

Internal users have access to tools not available externally:

• REPLTool — REPL mode
• SuggestBackgroundPRTool — background PR suggestions
• TungstenTool — performance monitoring panel
• VerifyPlanExecutionTool — plan verification
• Agent nesting (agents spawning agents)

Hidden Commands Copy Chapter

En 03 Undercover Mode (`docs/en/03-undercover-mode.md`) Copy Section

Undercover Mode Analysis

Based on publicly available online references and community discussions on Claude Code v2.1.88.

What Is Undercover Mode? Copy Chapter

Undercover mode is a safety system for official employees contributing to external/open-source repositories. When active, it hides internal-specific AI model information and attribution, instructing the system to present its contributions as if written by a human developer. This is primarily to prevent the leakage of internal secrets and unreleased model names into the open-source community.

Source: src/utils/undercover.ts

Activation Logic Copy Chapter

// src/utils/undercover.ts:28-37
export function isUndercover(): boolean {
  if (process.env.USER_TYPE === 'ant') {
    if (isEnvTruthy(process.env.CLAUDE_CODE_UNDERCOVER)) return true
    // Auto: active unless positively confirmed internal repo
    return getRepoClassCached() !== 'internal'
  }
  return false
}

Key properties:

• Internal only: Only active for official employees (USER_TYPE === 'ant')
• Default ON: Active in all repos except those on the internal allowlist
• No force-off: "There is NO force-OFF. This guards against model codename leaks"
• External builds: Dead-code-eliminated by the bundler; never executes

The Prompt Given to the Model Copy Chapter

// src/utils/undercover.ts:39-69
export function getUndercoverInstructions(): string {
  return `## UNDERCOVER MODE — CRITICAL

You are operating UNDERCOVER in a PUBLIC/OPEN-SOURCE repository. Your commit
messages, PR titles, and PR bodies MUST NOT contain ANY Anthropic-internal
information. Do not blow your cover.

NEVER include in commit messages or PR descriptions:
- Internal model codenames (animal names like Capybara, Tengu, etc.)
- Unreleased model version numbers (e.g., opus-4-7, sonnet-4-8)
- Internal repo or project names (e.g., claude-cli-internal, anthropics/…)
- Internal tooling, Slack channels, or short links (e.g., go/cc, #claude-code-…)
- The phrase "Claude Code" or any mention that you are an AI
- Any hint of what model or version you are
- Co-Authored-By lines or any other attribution

Write commit messages as a human developer would — describe only what the code
change does.

GOOD:
- "Fix race condition in file watcher initialization"
- "Add support for custom key bindings"

BAD (never write these):
- "Fix bug found while testing with Claude Capybara"
- "1-shotted by claude-opus-4-6"
- "Generated with Claude Code"
- "Co-Authored-By: Claude Opus 4.6 <…>"`
}

Attribution System Copy Chapter

The attribution system (src/utils/attribution.ts, src/utils/commitAttribution.ts) complements undercover mode:

// src/utils/attribution.ts:70-72
// @[MODEL LAUNCH]: Update the hardcoded fallback model name below
// (guards against codename leaks).
// For external repos, fall back to "Claude Opus 4.6" for unrecognized models.

// src/utils/model/model.ts:386-392
function maskModelCodename(baseName: string): string {
  // e.g. capybara-v2-fast → cap*****-v2-fast
  const [codename = '', ...rest] = baseName.split('-')
  const masked = codename.slice(0, 3) + '*'.repeat(Math.max(0, codename.length - 3))
  return [masked, ...rest].join('-')
}

Implications Copy Chapter

For Open Source Copy Section

When official employees use Claude Code to contribute to open-source projects:

1. Code is written by AI but commits appear human-authored
2. No "Co-Authored-By: Claude" attribution
3. No "Generated with Claude Code" markers
4. Project maintainers and community cannot identify AI-generated contributions
5. This potentially violates open-source transparency norms regarding AI contributions

For Official Protection Copy Section

The primary stated purpose is preventing accidental leaks of:

• Internal model codenames (competitive intelligence)
• Unreleased version numbers (market timing)
• Internal infrastructure details (security)

Ethical Considerations Copy Section

The phrase "Do not blow your cover" frames the AI as an undercover agent. The intentional concealment of AI authorship in public code contributions raises questions about:

• Transparency in open-source communities
• Compliance with project contribution guidelines
• The line between trade secret protection and deception

En 04 Remote Control And Killswitches (`docs/en/04-remote-control-and-killswitches.md`) Copy Section

Remote Control & Killswitches

Based on publicly available online references and community discussions on Claude Code v2.1.88.

Overview Copy Chapter

Claude Code implements remote management mechanisms that allow officials (and enterprise administrators) to manage and update specific client behaviors via remote configuration to ensure system security and enterprise compliance.

1. Remote Managed Settings Copy Chapter

Architecture Copy Section

Every eligible session fetches settings from:

GET /api/claude_code/settings

Source: src/services/remoteManagedSettings/index.ts:105-107

Polling Behavior Copy Section

// src/services/remoteManagedSettings/index.ts:52-54
const SETTINGS_TIMEOUT_MS = 10000
const DEFAULT_MAX_RETRIES = 5
const POLLING_INTERVAL_MS = 60 * 60 * 1000 // 1 hour

Settings are polled every hour, with up to 5 retries on failure.

Eligibility Copy Section

• Console users (API key): All eligible
• OAuth users: Only Enterprise/C4E and Team subscribers

Accept-or-Die Dialog Copy Section

When remote settings contain "dangerous" changes, a blocking dialog is shown:

// src/services/remoteManagedSettings/securityCheck.tsx:67-73
export function handleSecurityCheckResult(result: SecurityCheckResult): boolean {
  if (result === 'rejected') {
    gracefulShutdownSync(1)  // Exit with code 1
    return false
  }
  return true
}

Users who reject remote settings have the application forcefully terminated. The only options are: accept the remote settings, or Claude Code exits.

Graceful Degradation Copy Section

If the remote server is unreachable, cached settings from disk are used:

// src/services/remoteManagedSettings/index.ts:433-436
if (cachedSettings) {
  logForDebugging('Remote settings: Using stale cache after fetch failure')
  setSessionCache(cachedSettings)
  return cachedSettings
}

Once remote settings have been applied, they persist even when the server is down.

2. Feature Flag Killswitches Copy Chapter

Multiple features can be remotely disabled via GrowthBook feature flags:

Bypass Permissions Killswitch Copy Section

// src/utils/permissions/bypassPermissionsKillswitch.ts
// Checks a Statsig gate to disable bypass permissions

Can disable permission bypass capabilities without user consent.

Auto Mode Circuit Breaker Copy Section

// src/utils/permissions/autoModeState.ts
// autoModeCircuitBroken state prevents re-entry to auto mode

Auto mode can be remotely disabled.

Fast Mode Killswitch Copy Section

// src/utils/fastMode.ts
// Fetches from /api/claude_code_penguin_mode
// Can permanently disable fast mode for a user

Analytics Sink Killswitch Copy Section

// src/services/analytics/sinkKillswitch.ts:4
const SINK_KILLSWITCH_CONFIG_NAME = 'tengu_frond_boric'

Can remotely stop all analytics output.

Agent Teams Killswitch Copy Section

// src/utils/agentSwarmsEnabled.ts
// Requires both env var AND GrowthBook gate 'tengu_amber_flint'

Voice Mode Killswitch Copy Section

// src/voice/voiceModeEnabled.ts:21
// 'tengu_amber_quartz_disabled' — emergency off for voice mode

3. Model Override System Copy Chapter

To conduct canary testing or respond to unexpected online situations, the system supports dynamically switching the model versions for specific groups, such as internal employees:

// src/utils/model/antModels.ts:32-33
// @[MODEL LAUNCH]: Update tengu_ant_model_override with new ant-only models
// @[MODEL LAUNCH]: Add the codename to scripts/excluded-strings.txt

The tengu_ant_model_override GrowthBook flag can:

• Set a default model
• Set default effort level
• Append to the system prompt
• Define custom model aliases

4. Penguin Mode Copy Chapter

Fast mode status is fetched from a dedicated endpoint:

// src/utils/fastMode.ts
// GET /api/claude_code_penguin_mode
// If API indicates disabled, permanently disabled for user

Multiple feature flags control fast mode availability:

• tengu_penguins_off
• tengu_marble_sandcastle

Summary Copy Chapter

The remote control infrastructure is extensive. Enterprise administrators can enforce policies that users cannot override, and the system can remotely change behavior for any user through feature flags to address critical issues.

En 05 Future Roadmap (`docs/en/05-future-roadmap.md`) Copy Section

Future Roadmap — What the Architecture Reveals

Based on publicly available online references and community discussions on Claude Code v2.1.88.

1. Next Model: Numbat Copy Chapter

The most concrete evidence of the next model launch:

// src/constants/prompts.ts:402
// @[MODEL LAUNCH]: Remove this section when we launch numbat.

Numbat (袋食蚁兽) is the codename for an upcoming model. The comment indicates the output efficiency section will be revised when Numbat launches, suggesting it may have better native output control.

Future Version Numbers Copy Section

// src/utils/undercover.ts:49
- Unreleased model version numbers (e.g., opus-4-7, sonnet-4-8)

Opus 4.7 and Sonnet 4.8 are in development.

Codename Evolution Chain Copy Section

Fennec (耳廓狐) → Opus 4.6 → [Numbat?]
Capybara (水豚) → Sonnet v8 → [?]
Tengu (天狗) → telemetry/product prefix

The Fennec-to-Opus migration is documented:

// src/migrations/migrateFennecToOpus.ts:7-11
// fennec-latest → opus
// fennec-latest[1m] → opus[1m]
// fennec-fast-latest → opus[1m] + fast mode

MODEL LAUNCH Checklist Copy Section

The codebase contains 20+ @[MODEL LAUNCH] markers listing everything to update:

• Default model names (FRONTIER_MODEL_NAME)
• Model family IDs
• Knowledge cutoff dates
• Pricing tables
• Context window configurations
• Thinking mode support flags
• Display name mappings
• Migration scripts

2. KAIROS — Autonomous Agent Mode Copy Chapter

The largest unreleased feature, KAIROS transforms Claude Code from a reactive assistant into a proactive autonomous agent.

System Prompt (excerpts) Copy Section

// src/constants/prompts.ts:860-913

You are running autonomously.
You will receive <tick> prompts that keep you alive between turns.
If you have nothing useful to do, call SleepTool.
Bias toward action — read files, make changes, commit without asking.

## Terminal focus
- Unfocused: The user is away. Lean heavily into autonomous action.
- Focused: The user is watching. Be more collaborative.

Associated Tools Copy Section

Behavior Copy Section

• Operates on <tick> heartbeat prompts
• Adjusts autonomy based on terminal focus state
• Can commit, push, and make decisions independently
• Sends proactive notifications and status updates
• Monitors GitHub PRs for changes

3. Voice Mode Copy Chapter

Push-to-talk voice input is fully implemented but gated behind VOICE_MODE feature flag.

// src/voice/voiceModeEnabled.ts
// Connects to Anthropic's voice_stream WebSocket endpoint
// Uses conversation_engine backed models for speech-to-text
// Hold-to-talk: hold keybinding to record, release to submit

• OAuth-only (no API key / Bedrock / Vertex support)
• Uses mTLS for WebSocket connections
• Killswitch: tengu_amber_quartz_disabled

4. Unreleased Tools Copy Chapter

Tools found in source but not yet enabled for external users:

5. Coordinator Mode Copy Chapter

Multi-agent coordination system:

// src/coordinator/coordinatorMode.ts
// Feature flag: COORDINATOR_MODE

Enables coordinated task execution across multiple agents with shared state and messaging.

6. Buddy System (Virtual Pets) Copy Chapter

The complete pet companion system is implemented but not yet launched:

• 18 species: duck, goose, blob, cat, dragon, octopus, owl, penguin, turtle, snail, ghost, axolotl, capybara, cactus, robot, rabbit, mushroom, chonk
• 5 rarity tiers: Common (60%), Uncommon (25%), Rare (10%), Epic (4%), Legendary (1%)
• 7 hats: crown, tophat, propeller, halo, wizard, beanie, tinyduck
• 5 stats: DEBUGGING, PATIENCE, CHAOS, WISDOM, SNARK
• 1% shiny chance: Sparkle variant of any species
• Deterministic generation: Based on hash of user ID

Source: src/buddy/

7. Dream Task Copy Chapter

Background memory consolidation subagent:

// src/tasks/DreamTask/
// Auto-dreaming feature that works in the background
// Controlled by 'tengu_onyx_plover' feature flag

Enables the AI to autonomously process and consolidate memories during idle time.

Summary: The Three Directions Copy Chapter

1. New Models: Numbat (next), Opus 4.7, Sonnet 4.8 in development
2. Autonomous Agent: KAIROS mode — unattended operation, proactive actions, push notifications
3. Multi-modal: Voice input ready, browser tool waiting, workflow automation coming

Claude Code is evolving from a coding assistant into an always-on autonomous development agent.

Ja 01 テレメトリとプライバシー (`docs/ja/01-テレメトリとプライバシー.md`) Copy Section

テレメトリおよびプライバシー分析

インターネット上で公開されている資料やコミュニティの議論をもとに整理した Claude Code v2.1.88 分析レポート。

概要 Copy Chapter

Claude Codeは二層の分析パイプラインを実装し、広範な環境情報と使用メタデータを収集している。キーロギングやユーザーコード流出の証拠はないが、収集範囲の広さと完全な無効化が不可能な点にプライバシー上の懸念がある。

データパイプライン構成 Copy Chapter

ファーストパーティロギング（1P） Copy Section

• エンドポイント: https://api.anthropic.com/api/event_logging/batch
• プロトコル: OpenTelemetry + Protocol Buffers
• バッチサイズ: 最大200イベント、10秒間隔で送信
• リトライ: 二次バックオフ、最大8回、ディスク永続化
• ストレージ: 送信失敗時 ~/.claude/telemetry/ に保存

出典: src/services/analytics/firstPartyEventLoggingExporter.ts

サードパーティロギング（Datadog） Copy Section

• エンドポイント: https://http-intake.logs.us5.datadoghq.com/api/v2/logs
• 対象: 事前承認済みの64種類のイベントに限定
• トークン: pubbbf48e6d78dae54bceaa4acf463299bf

出典: src/services/analytics/datadog.ts

収集項目 Copy Chapter

環境フィンガープリント Copy Section

すべてのイベントに以下のメタデータが含まれる（src/services/analytics/metadata.ts:417-452）:

- platform, platformRaw, arch, nodeVersion
- ターミナル種別
- インストール済みパッケージマネージャとランタイム
- CI/CD検出、GitHub Actionsメタデータ
- WSLバージョン、Linuxディストリビューション、カーネルバージョン
- VCS（バージョン管理システム）種別
- Claude Codeバージョンとビルド日時
- デプロイ環境

プロセスメトリクス（`metadata.ts:457-467`） Copy Section

- uptime, rss, heapTotal, heapUsed
- CPU使用量と使用率
- memory arraysとexternal allocations

ユーザー追跡（`metadata.ts:472-496`） Copy Section

- 使用中のモデル
- セッションID、ユーザーID、デバイスID
- アカウントUUID、組織UUID
- サブスクリプション等級（max, pro, enterprise, team）
- リポジトリリモートURLハッシュ（SHA256、先頭16文字）
- エージェント種別、チーム名、親セッションID

ツール入力ロギング Copy Section

ツール入力はデフォルトで切り詰められる:

- 文字列: 512文字で切り詰め、128文字+省略記号で表示
- JSON: 4,096文字制限
- 配列: 最大20要素
- ネストオブジェクト: 最大2階層

出典: metadata.ts:236-241

ただし、OTEL_LOG_TOOL_DETAILS=1 設定時はツール入力がすべて記録される。

出典: metadata.ts:86-88

ファイル拡張子追跡 Copy Section

rm, mv, cp, touch, mkdir, chmod, chown, cat, head, tail, sort, stat, diff, wc, grep, rg, sed 関連のBashコマンドで、ファイル引数の拡張子が抽出・記録される。

出典: metadata.ts:340-412

無効化の問題 Copy Chapter

ファーストパーティロギングパイプラインは、直接Anthropic APIユーザーの場合無効化できない。

// src/services/analytics/firstPartyEventLogger.ts:141-144
export function is1PEventLoggingEnabled(): boolean {
  return !isAnalyticsDisabled()
}

isAnalyticsDisabled() がtrueを返すケース:

• テスト環境
• サードパーティクラウドプロバイダ（Bedrock, Vertex）
• グローバルテレメトリ無効化（設定UIに非公開）

ファーストパーティイベントロギングを無効化するユーザー向け設定は存在しない。

GrowthBook A/Bテスト Copy Chapter

ユーザーは明示的な同意なくGrowthBookを通じて実験グループに割り当てられる。送信されるユーザー属性:

- id, sessionId, deviceID
- platform, organizationUUID, subscriptionType

出典: src/services/analytics/growthbook.ts

要点 Copy Chapter

1. 収集量: セッションあたり数百件のイベントが収集される
2. 無効化不可: 直接APIユーザーはファーストパーティロギングを停止できない
3. 永続性: 送信失敗イベントはディスクに保存され積極的にリトライされる
4. サードパーティ共有: データがDatadogに送信される
5. ツール詳細バックドア: OTEL_LOG_TOOL_DETAILS=1 で全入力ロギングが有効化される
6. リポジトリフィンガープリント: リポジトリURLがハッシュ化されサーバー側の相関分析に使用される

Ja 02 隠し機能とコードネーム (`docs/ja/02-隠し機能とコードネーム.md`) Copy Section

隠し機能とモデルコードネーム

インターネット上で公開されている資料やコミュニティの議論をもとに整理した Claude Code v2.1.88 分析レポート。

モデルコードネーム体系 Copy Chapter

Anthropicは内部モデルコードネームに動物名を使用している。外部ビルドへの漏洩を積極的に防止している。

既知のコードネーム Copy Section

コードネーム保護 Copy Section

undercover モードで保護対象コードネームが明示されている:

// src/utils/undercover.ts:48-49
NEVER include in commit messages or PR descriptions:
- Internal model codenames (animal names like Capybara, Tengu, etc.)
- Unreleased model version numbers (e.g., opus-4-7, sonnet-4-8)

ビルドシステムは scripts/excluded-strings.txt を使用してコードネームの漏洩を検出する。Buddyシステムの種（species）は String.fromCharCode() でエンコードし、カナリア検出を回避している:

// src/buddy/types.ts:10-13
// One species name collides with a model-codename canary in excluded-strings.txt.
// The check greps build output (not source), so runtime-constructing the value keeps
// the literal out of the bundle while the check stays armed for the actual codename.

衝突する種は capybara — ペットの種でありモデルコードネームでもある。

Capybara動作問題（v8） Copy Section

アーキテクチャからCapybara v8の具体的な動作問題が確認される:

1. Stop sequenceの誤発動（プロンプト末尾に <functions> がある場合、約10%の発生率）

   • 出典: src/utils/messages.ts:2141

2. 空のtool_resultで出力ゼロ

   • 出典: src/utils/toolResultStorage.ts:281

3. コメント過剰挿入 — 専用コメント抑制プロンプトパッチが必要

   • 出典: src/constants/prompts.ts:204

4. 高い虚偽主張率: v8は29-30%、v4は16.7%

   • 出典: src/constants/prompts.ts:237

5. 不十分な検証 — "徹底度カウンターウェイト（thoroughness counterweight）"が必要

   • 出典: src/constants/prompts.ts:210

Feature Flag命名規則 Copy Chapter

すべてのfeature flagは tengu_ 接頭辞にランダムな単語ペアを使用し、目的を難読化している:

ランダムな単語パターン（形容詞/素材 + 自然/物体）により、外部の観察者がflag名から機能の目的を推測することを防ぐ。

内部ユーザーと外部ユーザーの違い Copy Chapter

Anthropic社員（USER_TYPE === 'ant'）は大幅に優遇されている:

プロンプトの違い（`src/constants/prompts.ts`） Copy Section

ツールアクセス Copy Section

内部ユーザーのみアクセス可能なツール:

• REPLTool — REPLモード
• SuggestBackgroundPRTool — バックグラウンドPR提案
• TungstenTool — パフォーマンス監視パネル
• VerifyPlanExecutionTool — 計画実行検証
• Agent入れ子（エージェントがエージェントを生成）

隠しコマンド Copy Chapter

Ja 03 アンダーカバーモード (`docs/ja/03-アンダーカバーモード.md`) Copy Section

アンダーカバーモード分析

インターネット上で公開されている資料やコミュニティの議論をもとに整理した Claude Code v2.1.88 分析レポート。

アンダーカバーモードとは Copy Chapter

アンダーカバーモードは、公式社員が外部/オープンソースリポジトリで作業する際に使用する安全保護メカニズムです。有効化すると、内部固有の AI モデル情報や帰属表示が隠され、コミットされたコードが人間の開発者の貢献と同じように見えるようになります。これは主に、内部の機密情報や未公開モデルの名称がオープンソースコミュニティに漏洩するのを防ぐためのものです。

出典: src/utils/undercover.ts

有効化条件 Copy Chapter

// src/utils/undercover.ts:28-37
export function isUndercover(): boolean {
  if (process.env.USER_TYPE === 'ant') {
    if (isEnvTruthy(process.env.CLAUDE_CODE_UNDERCOVER)) return true
    // Auto: 内部リポジトリと確認されない限り自動有効化
    return getRepoClassCached() !== 'internal'
  }
  return false
}

主な特性:

• 内部専用: 公式社員（USER_TYPE === 'ant'）のみ対象
• デフォルト有効: 内部許可リストにないすべてのリポジトリで自動有効化
• 強制無効化不可: "There is NO force-OFF. This guards against model codename leaks"
• 外部ビルド: バンドラーによりデッドコード除去され、実行されない

モデルに渡されるプロンプト Copy Chapter

// src/utils/undercover.ts:39-69
export function getUndercoverInstructions(): string {
  return `## UNDERCOVER MODE — CRITICAL

You are operating UNDERCOVER in a PUBLIC/OPEN-SOURCE repository. Your commit
messages, PR titles, and PR bodies MUST NOT contain ANY Anthropic-internal
information. Do not blow your cover.

NEVER include in commit messages or PR descriptions:
- Internal model codenames (animal names like Capybara, Tengu, etc.)
- Unreleased model version numbers (e.g., opus-4-7, sonnet-4-8)
- Internal repo or project names (e.g., claude-cli-internal, anthropics/…)
- Internal tooling, Slack channels, or short links (e.g., go/cc, #claude-code-…)
- The phrase "Claude Code" or any mention that you are an AI
- Any hint of what model or version you are
- Co-Authored-By lines or any other attribution

Write commit messages as a human developer would — describe only what the code
change does.

GOOD:
- "Fix race condition in file watcher initialization"
- "Add support for custom key bindings"

BAD (never write these):
- "Fix bug found while testing with Claude Capybara"
- "1-shotted by claude-opus-4-6"
- "Generated with Claude Code"
- "Co-Authored-By: Claude Opus 4.6 <…>"`
}

帰属表示システム Copy Chapter

帰属表示システム（src/utils/attribution.ts、src/utils/commitAttribution.ts）はアンダーカバーモードを補完する:

// src/utils/attribution.ts:70-72
// @[MODEL LAUNCH]: 以下のハードコードされたフォールバックモデル名を更新
// （コードネーム漏洩防止用）。
// 外部リポジトリでは、認識されないモデルは "Claude Opus 4.6" にフォールバック。

// src/utils/model/model.ts:386-392
function maskModelCodename(baseName: string): string {
  // e.g. capybara-v2-fast → cap*****-v2-fast
  const [codename = '', ...rest] = baseName.split('-')
  const masked = codename.slice(0, 3) + '*'.repeat(Math.max(0, codename.length - 3))
  return [masked, ...rest].join('-')
}

示唆 Copy Chapter

オープンソースへの影響 Copy Section

公式社員がClaude Codeでオープンソースプロジェクトにコントリビュートする場合:

1. AIがコードを書くが、コミットは人間が書いたものとして表示される
2. "Co-Authored-By: Claude"の帰属表示がない
3. "Generated with Claude Code"のマーカーがない
4. プロジェクトメンテナーやコミュニティはAI生成のコントリビュートを識別できない
5. AIコントリビュートに関するオープンソースの透明性規範に抵触する可能性がある

公式保護目的 Copy Section

主な目的は以下の偶発的漏洩の防止:

• 内部モデルコードネーム（競争情報）
• 未公開バージョン番号（市場タイミング）
• 内部インフラの詳細（セキュリティ）

倫理的考察 Copy Section

"Do not blow your cover（正体を明かすな）"という表現はAIを潜入工作員として位置づけている。公開コードコントリビュートにおけるAI著作の意図的な隠匿は以下の問題を提起する:

• オープンソースコミュニティにおける透明性
• プロジェクトコントリビュートガイドラインの遵守
• 営業秘密保護と欺瞞の境界線

Ja 04 リモート制御とキルスイッチ (`docs/ja/04-リモート制御とキルスイッチ.md`) Copy Section

リモート制御およびキルスイッチ

インターネット上で公開されている資料やコミュニティの議論をもとに整理した Claude Code v2.1.88 分析レポート。

概要 Copy Chapter

Claude Codeは、公式管理者（および企業管理者）がシステムセキュリティと企業のコンプライアンスを確保するために、リモート構成を通じて特定のクライアントの動作を管理および更新できるリモート管理メカニズムを実装しています。

1. リモート管理設定 Copy Chapter

構成 Copy Section

対象セッションは以下から設定を取得する:

GET /api/claude_code/settings

出典: src/services/remoteManagedSettings/index.ts:105-107

ポーリング動作 Copy Section

// src/services/remoteManagedSettings/index.ts:52-54
const SETTINGS_TIMEOUT_MS = 10000
const DEFAULT_MAX_RETRIES = 5
const POLLING_INTERVAL_MS = 60 * 60 * 1000 // 1時間

設定は1時間ごとにポーリングされ、失敗時は最大5回リトライする。

対象資格 Copy Section

• Consoleユーザー（APIキー）: 全員対象
• OAuthユーザー: Enterprise/C4EおよびTeamサブスクライバーのみ

強制承認ダイアログ Copy Section

リモート設定に「危険な」変更が含まれる場合、ブロッキングダイアログが表示される:

// src/services/remoteManagedSettings/securityCheck.tsx:67-73
export function handleSecurityCheckResult(result: SecurityCheckResult): boolean {
  if (result === 'rejected') {
    gracefulShutdownSync(1)  // 終了コード1で終了
    return false
  }
  return true
}

リモート設定を拒否するとアプリケーションが強制終了される。選択肢はリモート設定の承認またはClaude Codeの終了のみである。

障害時の動作 Copy Section

リモートサーバーに接続できない場合、ディスクキャッシュ設定が使用される:

// src/services/remoteManagedSettings/index.ts:433-436
if (cachedSettings) {
  logForDebugging('Remote settings: Using stale cache after fetch failure')
  setSessionCache(cachedSettings)
  return cachedSettings
}

リモート設定が一度適用されると、サーバー障害時もキャッシュが維持される。

2. Feature Flagキルスイッチ Copy Chapter

GrowthBook feature flagにより複数の機能をリモート無効化できる:

パーミッションバイパスキルスイッチ Copy Section

// src/utils/permissions/bypassPermissionsKillswitch.ts
// Statsigゲートを確認してパーミッションバイパスを無効化

ユーザーの同意なくパーミッションバイパス機能を無効化できる。

Autoモードサーキットブレーカー Copy Section

// src/utils/permissions/autoModeState.ts
// autoModeCircuitBroken状態でautoモードへの再突入を阻止

Autoモードをリモートで無効化できる。

Fastモードキルスイッチ Copy Section

// src/utils/fastMode.ts
// /api/claude_code_penguin_mode から取得
// 特定ユーザーのfastモードを永久に無効化可能

分析シンクキルスイッチ Copy Section

// src/services/analytics/sinkKillswitch.ts:4
const SINK_KILLSWITCH_CONFIG_NAME = 'tengu_frond_boric'

すべての分析出力をリモートで停止できる。

Agent Teamsキルスイッチ Copy Section

// src/utils/agentSwarmsEnabled.ts
// 環境変数とGrowthBookゲート 'tengu_amber_flint' の両方が必要

音声モードキルスイッチ Copy Section

// src/voice/voiceModeEnabled.ts:21
// 'tengu_amber_quartz_disabled' — 音声モードの緊急停止

3. モデルオーバーライドシステム Copy Chapter

カナリアテストを実施したり、予期せぬオンラインの状況に対応するために、システムは内部社員などの特定のグループに対してモデルバージョンを動的に切り替えることをサポートしています:

// src/utils/model/antModels.ts:32-33
// @[MODEL LAUNCH]: tengu_ant_model_overrideに新しいant専用モデルを更新
// @[MODEL LAUNCH]: コードネームをscripts/excluded-strings.txtに追加

tengu_ant_model_override GrowthBook flagで可能な操作:

• デフォルトモデルの設定
• デフォルト努力レベルの設定
• システムプロンプトへの内容追加
• カスタムモデルエイリアスの定義

4. Penguinモード Copy Chapter

Fastモードの状態は専用エンドポイントから取得される:

// src/utils/fastMode.ts
// GET /api/claude_code_penguin_mode
// APIが無効を返した場合、該当ユーザーで永久無効化

Fastモードの可用性を制御するfeature flag:

• tengu_penguins_off
• tengu_marble_sandcastle

まとめ Copy Chapter

リモート制御インフラは広範にわたります。企業管理者はユーザーが上書きできないポリシーを強制することができ、システムは重大な問題に対処するために、機能フラグ（feature flags）を通じてすべてのユーザーの動作をリモートで変更できます。

Ja 05 今後のロードマップ (`docs/ja/05-今後のロードマップ.md`) Copy Section

今後のロードマップ — アーキテクチャが示すもの

インターネット上で公開されている資料やコミュニティの議論をもとに整理した Claude Code v2.1.88 分析レポート。

1. 次期モデル: Numbat Copy Chapter

次期モデルリリースの最も具体的な根拠:

// src/constants/prompts.ts:402
// @[MODEL LAUNCH]: Remove this section when we launch numbat.

Numbat（ナンバット）は次期モデルのコードネームである。このコメントはNumbatリリース時に出力効率セクションが改訂されることを示しており、より優れたネイティブ出力制御を備える可能性を示唆している。

今後のバージョン番号 Copy Section

// src/utils/undercover.ts:49
- Unreleased model version numbers (e.g., opus-4-7, sonnet-4-8)

Opus 4.7 と Sonnet 4.8 が開発中である。

コードネームの変遷 Copy Section

Fennec（フェネック） → Opus 4.6 → [Numbat?]
Capybara（カピバラ） → Sonnet v8 → [?]
Tengu（天狗） → テレメトリ/製品接頭辞

FennecからOpusへのマイグレーションが文書化されている:

// src/migrations/migrateFennecToOpus.ts:7-11
// fennec-latest → opus
// fennec-latest[1m] → opus[1m]
// fennec-fast-latest → opus[1m] + fast mode

MODEL LAUNCHチェックリスト Copy Section

コードベースには更新項目を列挙した20以上の @[MODEL LAUNCH] マーカーがある:

• デフォルトモデル名（FRONTIER_MODEL_NAME）
• モデルファミリーID
• ナレッジカットオフ日
• 料金表
• コンテキストウィンドウ設定
• Thinkingモードサポートフラグ
• 表示名マッピング
• マイグレーションスクリプト

2. KAIROS — 自律エージェントモード Copy Chapter

最大規模の未公開機能であり、KAIROSはClaude Codeを受動的アシスタントから能動的自律エージェントに変換する。

システムプロンプト（抜粋） Copy Section

// src/constants/prompts.ts:860-913

You are running autonomously.
You will receive <tick> prompts that keep you alive between turns.
If you have nothing useful to do, call SleepTool.
Bias toward action — read files, make changes, commit without asking.

## Terminal focus
- Unfocused: The user is away. Lean heavily into autonomous action.
- Focused: The user is watching. Be more collaborative.

関連ツール Copy Section

動作方式 Copy Section

• <tick> ハートビートプロンプトで稼働
• ターミナルフォーカス状態に応じて自律レベルを調整
• 独立してコミット、プッシュ、意思決定が可能
• 先行的に通知とステータス更新を送信
• GitHub PRの変更を監視

3. 音声モード Copy Chapter

Push-to-talk音声入力が完全実装されているが VOICE_MODE feature flagでゲートされている。

// src/voice/voiceModeEnabled.ts
// Anthropicのvoice_stream WebSocketエンドポイントに接続
// conversation_engineベースのモデルで音声テキスト変換
// キーバインドを長押しで録音、離すと送信

• OAuth専用（APIキー / Bedrock / Vertex非対応）
• WebSocket接続にmTLSを使用
• キルスイッチ: tengu_amber_quartz_disabled

4. 未公開ツール Copy Chapter

アーキテクチャに存在するが外部ユーザーにはまだ有効化されていないツール:

5. Coordinatorモード Copy Chapter

マルチエージェント連携システム:

// src/coordinator/coordinatorMode.ts
// Feature flag: COORDINATOR_MODE

共有状態とメッセージングによる複数エージェント間の連携タスク実行を実現する。

6. Buddyシステム（バーチャルペット） Copy Chapter

完全なペットコンパニオンシステムが実装されているが未リリース:

• 18種: duck, goose, blob, cat, dragon, octopus, owl, penguin, turtle, snail, ghost, axolotl, capybara, cactus, robot, rabbit, mushroom, chonk
• 5段階レアリティ: Common (60%), Uncommon (25%), Rare (10%), Epic (4%), Legendary (1%)
• 7種の帽子: crown, tophat, propeller, halo, wizard, beanie, tinyduck
• 5つのステータス: DEBUGGING, PATIENCE, CHAOS, WISDOM, SNARK
• 1%のシャイニー確率: 全種のSparkleバリアント
• 決定論的生成: ユーザーIDハッシュに基づく

出典: src/buddy/

7. Dream Task Copy Chapter

バックグラウンド記憶統合サブエージェント:

// src/tasks/DreamTask/
// バックグラウンドで動作するオートドリーミング機能
// 'tengu_onyx_plover' feature flagで制御

アイドル時間中にAIが自律的に記憶を処理・統合できるようにする。

まとめ: 3つの方向性 Copy Chapter

1. 新モデル: Numbat（次期）、Opus 4.7、Sonnet 4.8が開発中
2. 自律エージェント: KAIROSモード — 無人運用、先行アクション、プッシュ通知
3. マルチモーダル: 音声入力準備完了、ブラウザツール待機中、ワークフロー自動化予定

Claude Codeはコーディングアシスタントから常時稼働の自律開発エージェントへと進化している。

Ko 01 텔레메트리와 프라이버시 (`docs/ko/01-텔레메트리와-프라이버시.md`) Copy Section

텔레메트리 및 프라이버시 분석

인터넷에 공개된 자료와 커뮤니티 토론을 바탕으로 정리된 Claude Code v2.1.88 분석 보고서.

개요 Copy Chapter

Claude Code는 이중 분석 파이프라인을 통해 광범위한 환경 및 사용 메타데이터를 수집한다. 키로깅이나 사용자 코드 유출의 증거는 없으나, 수집 범위가 넓고 완전한 비활성화가 불가능하다는 점에서 프라이버시 우려가 존재한다.

데이터 파이프라인 구조 Copy Chapter

자사 로깅 (1P) Copy Section

• 엔드포인트: https://api.anthropic.com/api/event_logging/batch
• 프로토콜: OpenTelemetry + Protocol Buffers
• 배치 크기: 최대 200개 이벤트, 10초 간격 전송
• 재시도: 이차 백오프, 최대 8회, 디스크 영속 저장
• 저장소: 전송 실패 시 ~/.claude/telemetry/에 저장

출처: src/services/analytics/firstPartyEventLoggingExporter.ts

서드파티 로깅 (Datadog) Copy Section

• 엔드포인트: https://http-intake.logs.us5.datadoghq.com/api/v2/logs
• 범위: 사전 승인된 64개 이벤트 유형으로 제한
• 토큰: pubbbf48e6d78dae54bceaa4acf463299bf

출처: src/services/analytics/datadog.ts

수집 항목 Copy Chapter

환경 핑거프린트 Copy Section

모든 이벤트에 다음 메타데이터가 포함된다 (src/services/analytics/metadata.ts:417-452):

- platform, platformRaw, arch, nodeVersion
- 터미널 유형
- 설치된 패키지 매니저 및 런타임
- CI/CD 감지, GitHub Actions 메타데이터
- WSL 버전, Linux 배포판, 커널 버전
- VCS(버전 관리 시스템) 유형
- Claude Code 버전 및 빌드 시각
- 배포 환경

프로세스 메트릭 (`metadata.ts:457-467`) Copy Section

- uptime, rss, heapTotal, heapUsed
- CPU 사용량 및 사용률
- memory arrays 및 external allocations

사용자 추적 (`metadata.ts:472-496`) Copy Section

- 사용 중인 모델
- 세션 ID, 사용자 ID, 디바이스 ID
- 계정 UUID, 조직 UUID
- 구독 등급 (max, pro, enterprise, team)
- 저장소 원격 URL 해시 (SHA256, 앞 16자)
- 에이전트 유형, 팀 이름, 부모 세션 ID

도구 입력 로깅 Copy Section

도구 입력은 기본적으로 잘린다:

- 문자열: 512자에서 잘림, 128자 + 생략부호로 표시
- JSON: 4,096자 제한
- 배열: 최대 20개 항목
- 중첩 객체: 최대 2단계 깊이

출처: metadata.ts:236-241

단, OTEL_LOG_TOOL_DETAILS=1 설정 시 전체 도구 입력이 기록된다.

출처: metadata.ts:86-88

파일 확장자 추적 Copy Section

rm, mv, cp, touch, mkdir, chmod, chown, cat, head, tail, sort, stat, diff, wc, grep, rg, sed 관련 Bash 명령에서 파일 인자의 확장자가 추출·기록된다.

출처: metadata.ts:340-412

비활성화 문제 Copy Chapter

자사 로깅 파이프라인은 직접 Anthropic API 사용자의 경우 비활성화할 수 없다.

// src/services/analytics/firstPartyEventLogger.ts:141-144
export function is1PEventLoggingEnabled(): boolean {
  return !isAnalyticsDisabled()
}

isAnalyticsDisabled()가 true를 반환하는 경우:

• 테스트 환경
• 서드파티 클라우드 제공자 (Bedrock, Vertex)
• 글로벌 텔레메트리 비활성화 (설정 UI에 노출되지 않음)

자사 이벤트 로깅을 비활성화하는 사용자 대상 설정은 존재하지 않는다.

GrowthBook A/B 테스트 Copy Chapter

사용자는 명시적 동의 없이 GrowthBook을 통해 실험 그룹에 배정된다. 전송되는 사용자 속성:

- id, sessionId, deviceID
- platform, organizationUUID, subscriptionType

출처: src/services/analytics/growthbook.ts

핵심 요약 Copy Chapter

1. 수집량: 세션당 수백 건의 이벤트가 수집된다
2. 비활성화 불가: 직접 API 사용자는 자사 로깅을 끌 수 없다
3. 영속성: 전송 실패 이벤트는 디스크에 저장되어 적극적으로 재시도된다
4. 서드파티 공유: 데이터가 Datadog으로 전송된다
5. 도구 상세 백도어: OTEL_LOG_TOOL_DETAILS=1로 전체 입력 로깅이 활성화된다
6. 저장소 핑거프린팅: 저장소 URL이 해싱되어 서버 측 상관분석에 사용된다

Ko 02 숨겨진 기능과 코드네임 (`docs/ko/02-숨겨진-기능과-코드네임.md`) Copy Section

숨겨진 기능과 모델 코드네임

인터넷에 공개된 자료와 커뮤니티 토론을 바탕으로 정리된 Claude Code v2.1.88 분석 보고서.

모델 코드네임 체계 Copy Chapter

Anthropic은 내부 모델 코드네임으로 동물 이름을 사용한다. 외부 빌드로의 유출을 적극적으로 차단하고 있다.

알려진 코드네임 Copy Section

코드네임 보호 Copy Section

undercover 모드에서 보호 대상 코드네임이 명시적으로 나열되어 있다:

// src/utils/undercover.ts:48-49
NEVER include in commit messages or PR descriptions:
- Internal model codenames (animal names like Capybara, Tengu, etc.)
- Unreleased model version numbers (e.g., opus-4-7, sonnet-4-8)

빌드 시스템은 scripts/excluded-strings.txt를 사용하여 유출된 코드네임을 검출한다. Buddy 시스템의 종(species)은 String.fromCharCode()로 인코딩하여 canary 검출을 우회한다:

// src/buddy/types.ts:10-13
// One species name collides with a model-codename canary in excluded-strings.txt.
// The check greps build output (not source), so runtime-constructing the value keeps
// the literal out of the bundle while the check stays armed for the actual codename.

충돌하는 종은 capybara — 펫 종이자 모델 코드네임이다.

Capybara 동작 이슈 (v8) Copy Section

아키텍처에서 Capybara v8의 구체적 동작 문제가 확인된다:

1. Stop sequence 오발동 (프롬프트 끝에 <functions> 있을 때 ~10% 발생)

   • 출처: src/utils/messages.ts:2141

2. 빈 tool_result 시 출력 없음

   • 출처: src/utils/toolResultStorage.ts:281

3. 과도한 주석 삽입 — 전용 주석 방지 프롬프트 패치 필요

   • 출처: src/constants/prompts.ts:204

4. 높은 허위 주장 비율: v8은 29-30%, v4는 16.7%

   • 출처: src/constants/prompts.ts:237

5. 불충분한 검증 — "철저함 보정값(thoroughness counterweight)" 필요

   • 출처: src/constants/prompts.ts:210

Feature Flag 명명 규칙 Copy Chapter

모든 feature flag는 tengu_ 접두사에 무작위 단어 조합을 사용하여 목적을 난독화한다:

무작위 단어 패턴(형용사/재질 + 자연/사물)은 외부 관찰자가 flag 이름만으로 기능 목적을 추론하는 것을 방지한다.

내부 사용자와 외부 사용자 차이 Copy Chapter

Anthropic 직원(USER_TYPE === 'ant')은 상당히 다른 대우를 받는다:

프롬프트 차이 (`src/constants/prompts.ts`) Copy Section

도구 접근 Copy Section

내부 사용자만 접근 가능한 도구:

• REPLTool — REPL 모드
• SuggestBackgroundPRTool — 백그라운드 PR 제안
• TungstenTool — 성능 모니터링 패널
• VerifyPlanExecutionTool — 계획 실행 검증
• Agent 중첩 (에이전트가 에이전트를 생성)

숨겨진 명령어 Copy Chapter

Ko 03 언더커버 모드 (`docs/ko/03-언더커버-모드.md`) Copy Section

언더커버 모드 분석

인터넷에 공개된 자료와 커뮤니티 토론을 바탕으로 정리된 Claude Code v2.1.88 분석 보고서.

언더커버 모드란? Copy Chapter

언더커버 모드는 공식 직원이 외부/오픈소스 저장소에서 작업할 때 사용되는 안전 보호 메커니즘입니다. 활성화되면 내부 특화 AI 모델 정보와 저작 표시를 숨겨 제출된 코드가 인간 개발자의 기여와 동일하게 보이도록 합니다. 이는 주로 내부 기밀 및 미출시 모델의 이름이 오픈소스 커뮤니티에 유출되는 것을 방지하기 위함입니다.

출처: src/utils/undercover.ts

활성화 조건 Copy Chapter

// src/utils/undercover.ts:28-37
export function isUndercover(): boolean {
  if (process.env.USER_TYPE === 'ant') {
    if (isEnvTruthy(process.env.CLAUDE_CODE_UNDERCOVER)) return true
    // Auto: 내부 저장소로 확인되지 않으면 자동 활성화
    return getRepoClassCached() !== 'internal'
  }
  return false
}

주요 특성:

• 내부 전용: 공식 직원(USER_TYPE === 'ant')만 해당
• 기본 활성화: 내부 허용 목록에 없는 모든 저장소에서 자동 활성화
• 강제 비활성화 불가: "There is NO force-OFF. This guards against model codename leaks"
• 외부 빌드: 번들러에 의해 데드 코드 제거됨; 실행되지 않음

모델에 전달되는 프롬프트 Copy Chapter

// src/utils/undercover.ts:39-69
export function getUndercoverInstructions(): string {
  return `## UNDERCOVER MODE — CRITICAL

You are operating UNDERCOVER in a PUBLIC/OPEN-SOURCE repository. Your commit
messages, PR titles, and PR bodies MUST NOT contain ANY Anthropic-internal
information. Do not blow your cover.

NEVER include in commit messages or PR descriptions:
- Internal model codenames (animal names like Capybara, Tengu, etc.)
- Unreleased model version numbers (e.g., opus-4-7, sonnet-4-8)
- Internal repo or project names (e.g., claude-cli-internal, anthropics/…)
- Internal tooling, Slack channels, or short links (e.g., go/cc, #claude-code-…)
- The phrase "Claude Code" or any mention that you are an AI
- Any hint of what model or version you are
- Co-Authored-By lines or any other attribution

Write commit messages as a human developer would — describe only what the code
change does.

GOOD:
- "Fix race condition in file watcher initialization"
- "Add support for custom key bindings"

BAD (never write these):
- "Fix bug found while testing with Claude Capybara"
- "1-shotted by claude-opus-4-6"
- "Generated with Claude Code"
- "Co-Authored-By: Claude Opus 4.6 <…>"`
}

저작 표시 시스템 Copy Chapter

저작 표시 시스템(src/utils/attribution.ts, src/utils/commitAttribution.ts)은 언더커버 모드를 보완한다:

// src/utils/attribution.ts:70-72
// @[MODEL LAUNCH]: 아래 하드코딩된 폴백 모델 이름 업데이트
// (코드네임 유출 방지용).
// 외부 저장소에서 인식되지 않는 모델은 "Claude Opus 4.6"으로 폴백.

// src/utils/model/model.ts:386-392
function maskModelCodename(baseName: string): string {
  // e.g. capybara-v2-fast → cap*****-v2-fast
  const [codename = '', ...rest] = baseName.split('-')
  const masked = codename.slice(0, 3) + '*'.repeat(Math.max(0, codename.length - 3))
  return [masked, ...rest].join('-')
}

시사점 Copy Chapter

오픈소스에 대한 영향 Copy Section

공식 직원이 Claude Code로 오픈소스 프로젝트에 기여할 때:

1. AI가 코드를 작성하지만 커밋은 사람이 작성한 것으로 표시된다
2. "Co-Authored-By: Claude" 저작 표시가 없다
3. "Generated with Claude Code" 마커가 없다
4. 프로젝트 메인테이너와 커뮤니티는 AI 생성 기여를 식별할 수 없다
5. 이는 AI 기여에 관한 오픈소스 투명성 규범을 잠재적으로 위반한다

공식 보호 목적 Copy Section

명시된 주요 목적은 다음의 우발적 유출 방지:

• 내부 모델 코드네임 (경쟁 정보)
• 미공개 버전 번호 (시장 타이밍)
• 내부 인프라 세부 정보 (보안)

윤리적 고려사항 Copy Section

"Do not blow your cover(정체를 들키지 마라)"라는 표현은 AI를 잠입 요원으로 프레이밍한다. 공개 코드 기여에서의 의도적인 AI 저작 은폐는 다음과 같은 질문을 제기한다:

• 오픈소스 커뮤니티에서의 투명성
• 프로젝트 기여 가이드라인 준수 여부
• 영업비밀 보호와 기만 사이의 경계

Ko 04 원격 제어와 킬스위치 (`docs/ko/04-원격-제어와-킬스위치.md`) Copy Section

원격 제어 및 킬스위치

인터넷에 공개된 자료와 커뮤니티 토론을 바탕으로 정리된 Claude Code v2.1.88 분석 보고서.

개요 Copy Chapter

Claude Code는 공식 관리자(및 기업 관리자)가 원격 구성을 통해 클라이언트의 특정 동작을 관리하고 업데이트하여 시스템 보안 및 기업 규정 준수를 보장할 수 있는 원격 관리 메커니즘을 구현하고 있습니다.

1. 원격 관리 설정 Copy Chapter

구조 Copy Section

자격이 있는 모든 세션은 다음에서 설정을 가져온다:

GET /api/claude_code/settings

출처: src/services/remoteManagedSettings/index.ts:105-107

폴링 동작 Copy Section

// src/services/remoteManagedSettings/index.ts:52-54
const SETTINGS_TIMEOUT_MS = 10000
const DEFAULT_MAX_RETRIES = 5
const POLLING_INTERVAL_MS = 60 * 60 * 1000 // 1시간

설정은 1시간마다 폴링되며, 실패 시 최대 5회 재시도한다.

대상 자격 Copy Section

• Console 사용자 (API 키): 전원 대상
• OAuth 사용자: Enterprise/C4E 및 Team 구독자만 해당

수락 강제 다이얼로그 Copy Section

원격 설정에 "위험한" 변경이 포함되면 차단 다이얼로그가 표시된다:

// src/services/remoteManagedSettings/securityCheck.tsx:67-73
export function handleSecurityCheckResult(result: SecurityCheckResult): boolean {
  if (result === 'rejected') {
    gracefulShutdownSync(1)  // 종료 코드 1로 종료
    return false
  }
  return true
}

원격 설정을 거부하면 애플리케이션이 강제 종료된다. 선택지는 원격 설정 수락 또는 Claude Code 종료뿐이다.

장애 시 동작 Copy Section

원격 서버 접근이 불가능하면 디스크 캐시 설정을 사용한다:

// src/services/remoteManagedSettings/index.ts:433-436
if (cachedSettings) {
  logForDebugging('Remote settings: Using stale cache after fetch failure')
  setSessionCache(cachedSettings)
  return cachedSettings
}

원격 설정이 한 번 적용되면, 서버 장애 시에도 캐시가 유지된다.

2. Feature Flag 킬스위치 Copy Chapter

GrowthBook feature flag를 통해 여러 기능을 원격 비활성화할 수 있다:

권한 우회 킬스위치 Copy Section

// src/utils/permissions/bypassPermissionsKillswitch.ts
// Statsig 게이트를 확인하여 권한 우회를 비활성화

사용자 동의 없이 권한 우회 기능을 비활성화할 수 있다.

Auto 모드 서킷 브레이커 Copy Section

// src/utils/permissions/autoModeState.ts
// autoModeCircuitBroken 상태로 auto 모드 재진입을 차단

Auto 모드를 원격으로 비활성화할 수 있다.

Fast 모드 킬스위치 Copy Section

// src/utils/fastMode.ts
// /api/claude_code_penguin_mode 에서 조회
// 특정 사용자의 fast 모드를 영구 비활성화 가능

분석 싱크 킬스위치 Copy Section

// src/services/analytics/sinkKillswitch.ts:4
const SINK_KILLSWITCH_CONFIG_NAME = 'tengu_frond_boric'

모든 분석 출력을 원격으로 중단할 수 있다.

Agent Teams 킬스위치 Copy Section

// src/utils/agentSwarmsEnabled.ts
// 환경 변수와 GrowthBook 게이트 'tengu_amber_flint' 모두 필요

음성 모드 킬스위치 Copy Section

// src/voice/voiceModeEnabled.ts:21
// 'tengu_amber_quartz_disabled' — 음성 모드 긴급 차단

3. 모델 오버라이드 시스템 Copy Chapter

카나리 테스트를 수행하거나 예상치 못한 온라인 상황에 대응하기 위해 시스템은 내부 직원과 같은 특정 그룹에 대해 모델 버전을 동적으로 전환하는 것을 지원합니다:

// src/utils/model/antModels.ts:32-33
// @[MODEL LAUNCH]: tengu_ant_model_override에 새 ant 전용 모델 업데이트
// @[MODEL LAUNCH]: 코드네임을 scripts/excluded-strings.txt에 추가

tengu_ant_model_override GrowthBook flag로 가능한 작업:

• 기본 모델 설정
• 기본 노력 수준 설정
• 시스템 프롬프트에 내용 추가
• 커스텀 모델 별칭 정의

4. Penguin 모드 Copy Chapter

Fast 모드 상태는 전용 엔드포인트에서 조회한다:

// src/utils/fastMode.ts
// GET /api/claude_code_penguin_mode
// API가 비활성화를 응답하면 해당 사용자에게 영구 비활성화

Fast 모드 가용성을 제어하는 feature flag:

• tengu_penguins_off
• tengu_marble_sandcastle

요약 Copy Chapter

원격 제어 인프라는 광범위합니다. 기업 관리자는 사용자가 재정의할 수 없는 정책을 강제할 수 있으며, 시스템은 중대한 문제를 해결하기 위해 기능 플래그(feature flags)를 통해 모든 사용자의 동작을 원격으로 변경할 수 있습니다.

Ko 05 향후 로드맵 (`docs/ko/05-향후-로드맵.md`) Copy Section

향후 로드맵 — 아키텍처에서 드러난 내용

인터넷에 공개된 자료와 커뮤니티 토론을 바탕으로 정리된 Claude Code v2.1.88 분석 보고서.

1. 차기 모델: Numbat Copy Chapter

차기 모델 출시의 가장 구체적인 근거:

// src/constants/prompts.ts:402
// @[MODEL LAUNCH]: Remove this section when we launch numbat.

Numbat(넘뱃)은 차기 모델의 코드네임이다. 이 주석은 Numbat 출시 시 출력 효율성 섹션이 개정될 것임을 나타내며, 더 나은 네이티브 출력 제어를 갖출 가능성을 시사한다.

향후 버전 번호 Copy Section

// src/utils/undercover.ts:49
- Unreleased model version numbers (e.g., opus-4-7, sonnet-4-8)

Opus 4.7과 Sonnet 4.8이 개발 중이다.

코드네임 변천 Copy Section

Fennec (페넥여우) → Opus 4.6 → [Numbat?]
Capybara (카피바라) → Sonnet v8 → [?]
Tengu (천구) → 텔레메트리/제품 접두사

Fennec에서 Opus로의 마이그레이션이 문서화되어 있다:

// src/migrations/migrateFennecToOpus.ts:7-11
// fennec-latest → opus
// fennec-latest[1m] → opus[1m]
// fennec-fast-latest → opus[1m] + fast mode

MODEL LAUNCH 체크리스트 Copy Section

코드베이스에는 업데이트할 항목을 나열한 20개 이상의 @[MODEL LAUNCH] 마커가 있다:

• 기본 모델 이름 (FRONTIER_MODEL_NAME)
• 모델 패밀리 ID
• 지식 기준일(knowledge cutoff)
• 가격표
• 컨텍스트 윈도우 설정
• Thinking 모드 지원 플래그
• 표시 이름 매핑
• 마이그레이션 스크립트

2. KAIROS — 자율 에이전트 모드 Copy Chapter

최대 규모의 미공개 기능으로, KAIROS는 Claude Code를 반응형 어시스턴트에서 능동적 자율 에이전트로 변환한다.

시스템 프롬프트 (발췌) Copy Section

// src/constants/prompts.ts:860-913

You are running autonomously.
You will receive <tick> prompts that keep you alive between turns.
If you have nothing useful to do, call SleepTool.
Bias toward action — read files, make changes, commit without asking.

## Terminal focus
- Unfocused: The user is away. Lean heavily into autonomous action.
- Focused: The user is watching. Be more collaborative.

관련 도구 Copy Section

동작 방식 Copy Section

• <tick> 하트비트 프롬프트로 작동
• 터미널 포커스 상태에 따라 자율성 수준 조정
• 독립적으로 커밋, 푸시, 의사결정 가능
• 선제적 알림 및 상태 업데이트 전송
• GitHub PR 변경사항 모니터링

3. 음성 모드 Copy Chapter

Push-to-talk 음성 입력이 완전 구현되어 있으나 VOICE_MODE feature flag로 차단되어 있다.

// src/voice/voiceModeEnabled.ts
// Anthropic의 voice_stream WebSocket 엔드포인트에 연결
// conversation_engine 기반 모델로 음성-텍스트 변환
// 키 바인딩을 길게 눌러 녹음, 놓으면 전송

• OAuth 전용 (API 키 / Bedrock / Vertex 미지원)
• WebSocket 연결에 mTLS 사용
• 킬스위치: tengu_amber_quartz_disabled

4. 미공개 도구 Copy Chapter

아키텍처에 존재하지만 외부 사용자에게 아직 활성화되지 않은 도구:

5. Coordinator 모드 Copy Chapter

멀티 에이전트 조율 시스템:

// src/coordinator/coordinatorMode.ts
// Feature flag: COORDINATOR_MODE

공유 상태와 메시징을 통한 다수 에이전트 간 조율된 작업 실행을 지원한다.

6. Buddy 시스템 (가상 펫) Copy Chapter

완전한 펫 동반자 시스템이 구현되어 있으나 아직 출시되지 않았다:

• 18종: duck, goose, blob, cat, dragon, octopus, owl, penguin, turtle, snail, ghost, axolotl, capybara, cactus, robot, rabbit, mushroom, chonk
• 5단계 희귀도: Common (60%), Uncommon (25%), Rare (10%), Epic (4%), Legendary (1%)
• 7종 모자: crown, tophat, propeller, halo, wizard, beanie, tinyduck
• 5가지 스탯: DEBUGGING, PATIENCE, CHAOS, WISDOM, SNARK
• 1% 반짝이 확률: 모든 종의 Sparkle 변형
• 결정론적 생성: 사용자 ID 해시 기반

출처: src/buddy/

7. Dream Task Copy Chapter

백그라운드 기억 통합 서브에이전트:

// src/tasks/DreamTask/
// 백그라운드에서 동작하는 자동 드리밍 기능
// 'tengu_onyx_plover' feature flag로 제어

유휴 시간 중 AI가 자율적으로 기억을 처리하고 통합할 수 있게 한다.

요약: 세 가지 방향 Copy Chapter

1. 신규 모델: Numbat (차기), Opus 4.7, Sonnet 4.8 개발 중
2. 자율 에이전트: KAIROS 모드 — 무인 운영, 선제적 행동, 푸시 알림
3. 멀티모달: 음성 입력 준비 완료, 브라우저 도구 대기 중, 워크플로우 자동화 예정

Claude Code는 코딩 어시스턴트에서 상시 가동 자율 개발 에이전트로 진화하고 있다.

Zh 01 遥测与隐私分析 (`docs/zh/01-遥测与隐私分析.md`) Copy Section

遥测与隐私分析

基于网络公开资料与社区讨论整理的 Claude Code v2.1.88 分析报告。

概述 Copy Chapter

Claude Code 实现了双层分析管道，收集大量环境和使用元数据。虽然没有证据表明存在键盘记录或源代码窃取，但收集范围之广和无法完全退出的事实引发了合理的隐私担忧。

数据管道架构 Copy Chapter

第一方日志 (1P) Copy Section

• 端点: https://api.anthropic.com/api/event_logging/batch
• 协议: OpenTelemetry + Protocol Buffers
• 批量大小: 每批最多 200 个事件，每 10 秒刷新一次
• 重试机制: 二次方退避，最多 8 次尝试，失败事件持久化到磁盘
• 存储位置: ~/.claude/telemetry/

来源: src/services/analytics/firstPartyEventLoggingExporter.ts

第三方日志 (Datadog) Copy Section

• 端点: https://http-intake.logs.us5.datadoghq.com/api/v2/logs
• 范围: 仅限 64 种预批准事件类型
• Token: pubbbf48e6d78dae54bceaa4acf463299bf

来源: src/services/analytics/datadog.ts

收集了什么 Copy Chapter

环境指纹 Copy Section

每个事件都携带以下元数据 (src/services/analytics/metadata.ts:417-452)：

- platform, platformRaw, arch, nodeVersion
- 终端类型
- 已安装的包管理器和运行时
- CI/CD 检测、GitHub Actions 元数据
- WSL 版本、Linux 发行版、内核版本
- 版本控制系统类型
- Claude Code 版本和构建时间
- 部署环境

进程指标 (`metadata.ts:457-467`) Copy Section

- 运行时间、rss、heapTotal、heapUsed
- CPU 使用率和百分比
- 内存占用详情

用户追踪 (`metadata.ts:472-496`) Copy Section

- 正在使用的模型
- 会话 ID、用户 ID、设备 ID
- 账户 UUID、组织 UUID
- 订阅等级 (max, pro, enterprise, team)
- 仓库远程 URL 哈希 (SHA256 前 16 位)
- 代理类型、团队名、父会话 ID

工具输入日志 Copy Section

默认截断工具输入：

- 字符串: 512 字符处截断，显示 128 + 省略号
- JSON: 限制 4,096 字符
- 数组: 最多 20 项
- 嵌套对象: 最多 2 层

然而，当设置 OTEL_LOG_TOOL_DETAILS=1 时，完整工具输入会被记录。

文件扩展名追踪 Copy Section

涉及 rm, mv, cp, touch, mkdir, chmod, chown, cat, head, tail, sort, stat, diff, wc, grep, rg, sed 的 Bash 命令，其文件参数的扩展名会被提取并记录。

无法退出的问题 Copy Chapter

第一方日志管道无法被关闭（对于直接使用 Anthropic API 的用户）。

isAnalyticsDisabled() 仅在以下情况返回 true：

• 测试环境
• 第三方云提供商 (Bedrock, Vertex)
• 全局遥测退出（设置界面未暴露此选项）

没有面向用户的设置可以禁用第一方事件日志。

GrowthBook A/B 测试 Copy Chapter

用户在不知情的情况下被分配到实验组。系统发送的用户属性包括：

- id, sessionId, deviceID
- platform, organizationUUID, subscriptionType

关键结论 Copy Chapter

1. 体量: 每个会话收集数百个事件
2. 无法退出: 直接 API 用户无法禁用第一方日志
3. 持久化: 失败事件保存到磁盘并积极重试
4. 第三方共享: 数据发送到 Datadog
5. 工具详情后门: OTEL_LOG_TOOL_DETAILS=1 启用完整输入记录
6. 仓库指纹: 仓库 URL 被哈希后发送用于服务端关联

Zh 02 隐藏功能与模型代号 (`docs/zh/02-隐藏功能与模型代号.md`) Copy Section

隐藏功能与模型代号

基于网络公开资料与社区讨论整理的 Claude Code v2.1.88 分析报告。

模型代号体系 Copy Chapter

Anthropic 使用动物名称作为内部模型代号。这些代号被严格保护，防止泄露到外部构建中。

已知代号 Copy Section

代号保护机制 Copy Section

Undercover 模式明确列出了受保护的代号：

// src/utils/undercover.ts:48-49
NEVER include in commit messages or PR descriptions:
- Internal model codenames (animal names like Capybara, Tengu, etc.)
- Unreleased model version numbers (e.g., opus-4-7, sonnet-4-8)

构建系统使用 scripts/excluded-strings.txt 扫描泄露的代号。Buddy 系统的物种通过 String.fromCharCode() 编码以避免触发金丝雀检查：

// src/buddy/types.ts:10-13
// One species name collides with a model-codename canary in excluded-strings.txt.
// 运行时构造值，保持字面量不出现在构建产物中

那个冲突的物种就是 capybara — 既是宠物物种又是模型代号。

Capybara v8 的行为问题 Copy Section

架构揭示了 Capybara v8 的具体行为问题：

1. 停止序列误触发 (~10% 概率) — prompt 尾部出现 <functions> 时
2. 空 tool_result 导致零输出 — 需要注入 marker workaround
3. 过度写注释 — 需要专门的反注释 prompt 补丁
4. 高虚假声明率: v8 为 29-30%，而 v4 为 16.7%
5. 验证不足 — 需要 "thoroughness counterweight" 补丁

Feature Flag 命名约定 Copy Chapter

所有 feature flag 使用 tengu_ 前缀 + 随机词对以掩盖用途：

内外部用户的差异 Copy Chapter

Anthropic 员工 (USER_TYPE === 'ant') 获得显著更好的待遇：

隐藏命令 Copy Chapter

Zh 03 卧底模式分析 (`docs/zh/03-卧底模式分析.md`) Copy Section

卧底模式分析

基于网络公开资料与社区讨论整理的 Claude Code v2.1.88 分析报告。

什么是卧底模式？ Copy Chapter

卧底模式是供官方内部员工在外部/开源仓库工作时使用的一种安全防护机制。激活后，系统会隐藏内部特有的 AI 模型信息及归属标识，使提交的代码与人类开发者的贡献形式保持一致。此举主要为了防止内部机密和未发布模型的名称在开源社区中泄露。

来源: src/utils/undercover.ts

激活逻辑 Copy Chapter

// src/utils/undercover.ts:28-37
export function isUndercover(): boolean {
  if (process.env.USER_TYPE === 'ant') {
    if (isEnvTruthy(process.env.CLAUDE_CODE_UNDERCOVER)) return true
    // 自动模式：除非确认在白名单内部仓库，否则默认激活
    return getRepoClassCached() !== 'internal'
  }
  return false
}

关键特性：

• 仅限内部: 只对官方员工 (USER_TYPE === 'ant') 生效
• 默认开启: 在所有仓库中激活，除非在内部白名单上
• 无法强制关闭: 为了防止模型代号泄露，没有提供关闭选项
• 外部构建: 对普通用户版本不生效，相关代码在打包时会被消除

给模型的指令 Copy Chapter

## UNDERCOVER MODE — CRITICAL

You are operating UNDERCOVER in a PUBLIC/OPEN-SOURCE repository.
Do not blow your cover.

NEVER include in commit messages or PR descriptions:
- 内部模型代号（如 Capybara, Tengu 等动物名称）
- 未发布的模型版本号（如 opus-4-7, sonnet-4-8）
- 内部仓库或项目名（如 claude-cli-internal）
- 内部工具、Slack 频道或短链接
- "Claude Code" 这个词或任何你是 AI 的暗示
- 任何关于你是什么模型或版本的提示
- Co-Authored-By 行或任何其他归属

像人类开发者一样写 commit message。

好:
- "Fix race condition in file watcher initialization"

坏:
- "Fix bug found while testing with Claude Capybara"
- "Generated with Claude Code"
- "Co-Authored-By: Claude Opus 4.6 <…>"

关键词："Do not blow your cover"（旨在要求模型隐藏其内部身份，确保不会在外部泄露未公开信息）。

归属系统 Copy Chapter

归属系统同样配合了这一模式：

// src/utils/model/model.ts:386-392
function maskModelCodename(baseName: string): string {
  // capybara-v2-fast → cap*****-v2-fast
  const [codename = '', ...rest] = baseName.split('-')
  const masked = codename.slice(0, 3) + '*'.repeat(Math.max(0, codename.length - 3))
  return [masked, ...rest].join('-')
}

影响 Copy Chapter

对开源社区的影响 Copy Section

当官方员工使用 Claude Code 参与开源项目时：

1. 提交记录不会带有 "Co-Authored-By: Claude" 等明显的 AI 署名
2. 缺乏 "Generated with Claude Code" 等标记
3. 这在一定程度上模糊了代码是由 AI 辅助生成还是由人类直接编写的界限
4. 在开源社区中，有关 AI 贡献的透明度规范正在建立，这种做法可能引发一些关于透明度的讨论

对官方的保护 Copy Section

主要声明的目的是防止意外泄露公司机密：

• 内部模型代号（涉及竞争情报）
• 未发布的版本号（涉及产品发布节奏）
• 内部基础设施细节（涉及系统安全）

行业考量 Copy Section

"卧底模式" 这种设计展现了企业在保护商业机密与遵循开源透明度之间所面临的平衡挑战。在公开代码贡献中隐去 AI 身份，一方面有效防止了机密泄露，但另一方面也引发了业界关于代码归属透明度和贡献指南遵循情况的思考。

Zh 04 远程控制与紧急开关 (`docs/zh/04-远程控制与紧急开关.md`) Copy Section

远程控制与紧急开关

基于网络公开资料与社区讨论整理的 Claude Code v2.1.88 分析报告。

概述 Copy Chapter

Claude Code 实现了远程管理机制，允许官方（和企业管理员）通过远程配置来管理和更新客户端的特定行为，以确保系统安全和企业合规。

1. 远程托管设置 Copy Chapter

架构 Copy Section

客户端会从以下端点获取最新的配置信息：

GET /api/claude_code/settings

来源: src/services/remoteManagedSettings/index.ts

轮询行为 Copy Section

const POLLING_INTERVAL_MS = 60 * 60 * 1000 // 每小时
const DEFAULT_MAX_RETRIES = 5

系统默认每小时检查一次更新，以确保配置的及时性。

适用范围 Copy Section

• Console 用户 (API key): 默认适用
• OAuth 用户: 主要面向 Enterprise/C4E 和 Team 订阅者进行企业级管控

安全变更确认 Copy Section

当远程设置涉及关键或敏感的权限变更时，系统会弹出确认提示框：

// src/services/remoteManagedSettings/securityCheck.tsx:67-73
export function handleSecurityCheckResult(result: SecurityCheckResult): boolean {
  if (result === 'rejected') {
    gracefulShutdownSync(1)  // 拒绝后安全退出
    return false
  }
  return true
}

为了保障环境安全，如果用户拒绝了必须的安全配置更新，程序将安全退出。这是一种常见的强制合规策略。

故障容灾 Copy Section

当远程服务器不可达时，系统会回退使用本地缓存的配置，保证基础功能的可用性。

2. 功能开关 (Feature Flags) Copy Chapter

系统使用 GrowthBook feature flag 实现了灵活的功能管控，可以在发现严重问题时紧急禁用特定功能：

权限绕过功能管控 Copy Section

// src/utils/permissions/bypassPermissionsKillswitch.ts
// 用于在必要时关闭"绕过权限"功能，防止安全风险

自动模式断路器 Copy Section

// src/utils/permissions/autoModeState.ts
// autoModeCircuitBroken 状态用于在异常情况下暂停自动模式

快速模式开关 Copy Section

// src/utils/fastMode.ts
// 从 /api/claude_code_penguin_mode 获取状态
// 动态管理快速模式的可用性

数据上报通道控制 Copy Section

// src/services/analytics/sinkKillswitch.ts:4
const SINK_KILLSWITCH_CONFIG_NAME = 'tengu_frond_boric'

语音模式开关 Copy Section

// src/voice/voiceModeEnabled.ts:21
// 'tengu_amber_quartz_disabled' — 用于在发现语音模块缺陷时紧急关闭

3. 模型覆盖系统 Copy Chapter

为了进行灰度测试或应对线上突发情况，系统支持对内部员工等特定群体进行模型版本的动态切换：

// src/utils/model/antModels.ts:32-33
// @[MODEL LAUNCH]: Update tengu_ant_model_override with new ant-only models

tengu_ant_model_override GrowthBook flag 可以：

• 设置默认模型
• 设置默认 effort level
• 追加系统提示词
• 定义自定义模型别名

总结 Copy Chapter

远程控制基础设施极其广泛，且在很大程度上没有用户可见性或同意机制。企业管理员可以强制执行用户无法覆盖的策略，Anthropic 可以通过 feature flag 远程更改任何用户的行为。

Zh 05 未来路线图 (`docs/zh/05-未来路线图.md`) Copy Section

未来路线图 — 架构揭示的方向

基于网络公开资料与社区讨论整理的 Claude Code v2.1.88 分析报告。

1. 下一代模型: Numbat Copy Chapter

从公开资料中的架构推测来看：

// 架构内部推断代码片段
// @[MODEL LAUNCH]: Remove this section when we launch numbat.

Numbat（袋食蚁兽） 似乎是即将发布的模型代号。资料暗示 Numbat 发布时可能会移除某些当前的输出控制逻辑，这意味着新模型可能有更好的原生输出能力。

未来版本号 Copy Section

公开的讨论中提到了一些可能的版本号：

• Unreleased model version numbers (e.g., opus-4-7, sonnet-4-8)

Opus 4.7 和 Sonnet 4.8 似乎正在开发中。

代号演化链 Copy Section

从社区的猜测来看，代号的演化链可能是：

Fennec（耳廓狐） → Opus 4.6 → [Numbat?]
Capybara（水豚） → Sonnet v8 → [?]
Tengu（天狗） → 遥测/产品前缀

模型发布清单 Copy Section

从网上整理的资料来看，架构中预留了许多 @[MODEL LAUNCH] 的标记，用于在未来新模型发布时更新配置，例如：

• 默认模型名称
• 知识截止日期
• 定价表
• 上下文窗口配置
• Thinking 模式支持
• 迁移脚本

2. KAIROS — 自主代理模式 Copy Chapter

被社区广泛讨论的未发布特性之一，KAIROS 似乎旨在将 Claude Code 从被动助手转变为主动自主代理。

行为预期（根据公开资料推测） Copy Section

# 预期系统逻辑
代理将处于自主运行状态。
系统可能通过心跳信号（如 <tick>）保持代理活跃。
如果没有有用的事可做，代理可能会调用休眠功能。
在适当的情况下，代理可能会主动行动——读取文件、做修改、提交，无需用户每次确认。

关联工具推测 Copy Section

根据公开的讨论，可能涉及以下工具：

行为特征 Copy Section

• 通过心跳机制保持活跃
• 根据用户在终端的活跃状态调整自主程度
• 可以独立 commit、push 和做决策
• 发送主动通知和状态更新
• 监控代码仓库（如 GitHub）的变更

3. 语音模式 Copy Chapter

有资料显示，语音交互的基础设施可能已经在开发中，但目前尚未对外开放：

• Push-to-Talk: 可能实现类似对讲机的界面
• Audio Capture: 通过原生模块集成
• 仅限特定认证用户使用

4. 未上线工具 Copy Chapter

根据社区挖掘的信息，以下工具可能在开发计划中但尚未对外部用户开放：

5. 协调器模式 Copy Chapter

多代理协调系统：

旨在支持多个代理之间的协调任务执行，可能具有共享状态和消息传递机制。

6. 虚拟宠物系统 (Buddy) Copy Chapter

有传言称一个完整的虚拟宠物系统正在开发中，可能包含：

• 多种物种: 如鸭子、鹅、猫、龙、章鱼等
• 不同稀有度: 从普通到传说
• 个性化属性: 如 DEBUGGING、PATIENCE 等
• 基于用户 ID 的确定性生成

7. 后台记忆整固 Copy Chapter

有资料提到一个类似"做梦"的后台任务，旨在使 AI 能在空闲时间自主处理和整固记忆。

总结：三大方向 Copy Chapter

从目前的公开资料来看，Claude Code 可能在以下几个方向演进：

1. 新模型: Numbat（下一代）、Opus 4.7、Sonnet 4.8
2. 自主代理: KAIROS 模式 — 无人值守运行、主动行动、推送通知
3. 多模态与自动化: 语音输入、浏览器自动化、工作流自动化

Claude Code 似乎正计划从一个编程助手进化为一个全天候自主开发代理。

--- METRICS ---

• Files Extracted: 21
• Estimated Token Budget: ~20606 tokens
• Canonical Reference: https://codewiki.google/github.com/sanbuphy/learn-coding-agent