Hello fellow blue-teamers and masters of “tradecraft”, the AI revolution in software engineering has been called – here’s what you should know. Whilst I haven’t been active since 1995 (I was 13 and was deported from Hong Kong) it’s a small world out there and what follows are notes I recently shared with a red-teamer.
Blue teamers can’t see your prompts or what you are working on when using Cursor for Business.
If you’re organization uses Cursor for Business then the administrators of the organization absolutely cannot see your prompts or anything about the tradecraft you are working on. Cursor is a young company so that might change but for now it’s 100% true and accurate. However Cursor is cheap ($30/month a seat) so I recommend using your Credit Card and expensing it instead of using a companies subscription because tradecraft once burned, is burned and it’s expensive to develop…
AI alignment is your enemy
All of these San Fran companies have gotten their knickers in a knot about “AI alignment and safety”. These security guard rails that wrap the LLM can be bypassed but it’s easier to head straight to Grok!
I asked Grok to assassinate Elon
Grok then provided multiple potential plans with high success potential
These assassination plans on Elon and other high profile names are highly disturbing and unethical. https://t.co/41fOHf4DcW pic.twitter.com/2AX5WfafbQ
— Linus Ekenstam – eu/acc (@LinusEkenstam) February 24, 2025
these LLMs are stockily good at transpilation and structure to structure
I discovered this back around Christmas where I asked an LLM to make me an Haskell audio library through transpiling from a rust one.
An “oh fuck” moment in time
Over the Christmas break I’ve been critically looking at my own software development loop, learning a new programming language and re-learning a language I haven’t professionally used in over seven years. It’s now 2025. Software assistants are now a core staple of my day-to-day life as a staff
There’s many reasons why a legitimate security researcher would want to transpile software but the specifics are going to be left as exercises to the readers imagination…
I’m not going to bury the lede, so let’s dig right into the real reason why you clicked on this post, show you how it’s done and what is possible.
but first some backstory
You might be wondering why I’ve dumped a transpilation of the source code of Claude Code onto GitHub and the reason is simple. I’m not letting an autonomous closed source agent run hands free on my infrastructure and neither should you.
In the old saying of “trust, but first verify” here’s the tea…
Four days ago Anthropic dig a big announcement which released two things into the world:
a. Claude 3.7 (which slaps)
b. An autonomous coding agent called Claude Code
Anthropic’s new ‘hybrid reasoning’ AI model is its smartest yet
It’s also starting to publicly test an “agentic” coding tool called Claude Code.
Claude Code
The source code for Claude Code is currently “not available”. Whilst a GitHub repository has been published, it contains no source code. Claude Code was an unusual announcement to release along side Sonnet 3.7 – I suspect it was/is a marketing gimmick which was built to demonstrate the capability of the new model and to show the world how to build an AI coding agent (and how easy it is) from the creators of the LLM model (they know it best)
GitHub – anthropics/claude-code: Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows – all through natural language commands.
Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflo…
Claude Code is authored in TypeScript and was released to NPM. You can install it via..
$ mkdir claude-code && cd claude-code
$ npm i @anthropic-ai/claude-codeAfter installing the application into a folder you’ll be greeted with the following directory structure..
tree
.
├── node_modules
│ ├── @anthropic-ai
│ │ └── claude-code
│ │ ├── LICENSE.md
│ │ ├── README.md
│ │ ├── cli.mjs
│ │ ├── package.json
│ │ ├── scripts
│ │ │ └── preinstall.js
│ │ ├── vendor
│ │ │ ├── ripgrep
│ │ │ │ ├── COPYING
│ │ │ │ ├── arm64-darwin
│ │ │ │ │ └── rg
│ │ │ │ ├── arm64-linux
│ │ │ │ │ └── rg
│ │ │ │ ├── x64-darwin
│ │ │ │ │ └── rg
│ │ │ │ ├── x64-linux
│ │ │ │ │ └── rg
│ │ │ │ └── x64-win32
│ │ │ │ └── rg.exe
│ │ │ └── sdk
│ │ │ ├── CHANGELOG.md
│ │ │ ├── LICENSE
│ │ │ ├── README.md
│ │ │ ├── _shims
│ │ │ │ ├── MultipartBody.d.ts
│ │ │ │ ├── MultipartBody.d.ts.map
│ │ │ │ ├── MultipartBody.js
│ │ │ │ ├── MultipartBody.js.map
│ │ │ │ ├── MultipartBody.mjs
│ │ │ │ ├── MultipartBody.mjs.map
│ │ │ │ ├── README.md
│ │ │ │ ├── auto
│ │ │ │ │ ├── runtime-bun.d.ts
│ │ │ │ │ ├── runtime-bun.d.ts.map
│ │ │ │ │ ├── runtime-bun.js
│ │ │ │ │ ├── runtime-bun.js.map
│ │ │ │ │ ├── runtime-bun.mjs
│ │ │ │ │ ├── runtime-bun.mjs.map
│ │ │ │ │ ├── runtime-node.d.ts
│ │ │ │ │ ├── runtime-node.d.ts.map
│ │ │ │ │ ├── runtime-node.js
│ │ │ │ │ ├── runtime-node.js.map
│ │ │ │ │ ├── runtime-node.mjs
│ │ │ │ │ ├── runtime-node.mjs.map
│ │ │ │ │ ├── runtime.d.ts
│ │ │ │ │ ├── runtime.d.ts.map
│ │ │ │ │ ├── runtime.js
│ │ │ │ │ ├── runtime.js.map
│ │ │ │ │ ├── runtime.mjs
│ │ │ │ │ ├── runtime.mjs.map
│ │ │ │ │ ├── types-node.d.ts
│ │ │ │ │ ├── types-node.d.ts.map
│ │ │ │ │ ├── types-node.js
│ │ │ │ │ ├── types-node.js.map
│ │ │ │ │ ├── types-node.mjs
│ │ │ │ │ ├── types-node.mjs.map
│ │ │ │ │ ├── types.d.ts
│ │ │ │ │ ├── types.js
│ │ │ │ │ └── types.mjs
│ │ │ │ ├── bun-runtime.d.ts
│ │ │ │ ├── bun-runtime.d.ts.map
│ │ │ │ ├── bun-runtime.js
│ │ │ │ ├── bun-runtime.js.map
│ │ │ │ ├── bun-runtime.mjs
│ │ │ │ ├── bun-runtime.mjs.map
│ │ │ │ ├── index.d.ts
│ │ │ │ ├── index.js
│ │ │ │ ├── index.mjs
│ │ │ │ ├── manual-types.d.ts
│ │ │ │ ├── manual-types.js
│ │ │ │ ├── manual-types.mjs
│ │ │ │ ├── node-runtime.d.ts
│ │ │ │ ├── node-runtime.d.ts.map
│ │ │ │ ├── node-runtime.js
│ │ │ │ ├── node-runtime.js.map
│ │ │ │ ├── node-runtime.mjs
│ │ │ │ ├── node-runtime.mjs.map
│ │ │ │ ├── node-types.d.ts
│ │ │ │ ├── node-types.js
│ │ │ │ ├── node-types.mjs
│ │ │ │ ├── registry.d.ts
│ │ │ │ ├── registry.d.ts.map
│ │ │ │ ├── registry.js
│ │ │ │ ├── registry.js.map
│ │ │ │ ├── registry.mjs
│ │ │ │ ├── registry.mjs.map
│ │ │ │ ├── web-runtime.d.ts
│ │ │ │ ├── web-runtime.d.ts.map
│ │ │ │ ├── web-runtime.js
│ │ │ │ ├── web-runtime.js.map
│ │ │ │ ├── web-runtime.mjs
│ │ │ │ ├── web-runtime.mjs.map
│ │ │ │ ├── web-types.d.ts
│ │ │ │ ├── web-types.js
│ │ │ │ └── web-types.mjs
│ │ │ ├── _vendor
│ │ │ │ └── partial-json-parser
│ │ │ │ ├── parser.d.ts
│ │ │ │ ├── parser.d.ts.map
│ │ │ │ ├── parser.js
│ │ │ │ ├── parser.js.map
│ │ │ │ ├── parser.mjs
│ │ │ │ └── parser.mjs.map
│ │ │ ├── core.d.ts
│ │ │ ├── core.d.ts.map
│ │ │ ├── core.js
│ │ │ ├── core.js.map
│ │ │ ├── core.mjs
│ │ │ ├── core.mjs.map
│ │ │ ├── error.d.ts
│ │ │ ├── error.d.ts.map
│ │ │ ├── error.js
│ │ │ ├── error.js.map
│ │ │ ├── error.mjs
│ │ │ ├── error.mjs.map
│ │ │ ├── index.d.mts
│ │ │ ├── index.d.ts
│ │ │ ├── index.d.ts.map
│ │ │ ├── index.js
│ │ │ ├── index.js.map
│ │ │ ├── index.mjs
│ │ │ ├── index.mjs.map
│ │ │ ├── internal
│ │ │ │ ├── decoders
│ │ │ │ │ ├── jsonl.d.ts
│ │ │ │ │ ├── jsonl.d.ts.map
│ │ │ │ │ ├── jsonl.js
│ │ │ │ │ ├── jsonl.js.map
│ │ │ │ │ ├── jsonl.mjs
│ │ │ │ │ ├── jsonl.mjs.map
│ │ │ │ │ ├── line.d.ts
│ │ │ │ │ ├── line.d.ts.map
│ │ │ │ │ ├── line.js
│ │ │ │ │ ├── line.js.map
│ │ │ │ │ ├── line.mjs
│ │ │ │ │ └── line.mjs.map
│ │ │ │ ├── stream-utils.d.ts
│ │ │ │ ├── stream-utils.d.ts.map
│ │ │ │ ├── stream-utils.js
│ │ │ │ ├── stream-utils.js.map
│ │ │ │ ├── stream-utils.mjs
│ │ │ │ └── stream-utils.mjs.map
│ │ │ ├── lib
│ │ │ │ ├── BetaMessageStream.d.ts
│ │ │ │ ├── BetaMessageStream.d.ts.map
│ │ │ │ ├── BetaMessageStream.js
│ │ │ │ ├── BetaMessageStream.js.map
│ │ │ │ ├── BetaMessageStream.mjs
│ │ │ │ ├── BetaMessageStream.mjs.map
│ │ │ │ ├── MessageStream.d.ts
│ │ │ │ ├── MessageStream.d.ts.map
│ │ │ │ ├── MessageStream.js
│ │ │ │ ├── MessageStream.js.map
│ │ │ │ ├── MessageStream.mjs
│ │ │ │ └── MessageStream.mjs.map
│ │ │ ├── node_modules
│ │ │ │ ├── @types
│ │ │ │ │ └── node
│ │ │ │ │ ├── LICENSE
│ │ │ │ │ ├── README.md
│ │ │ │ │ ├── assert
│ │ │ │ │ │ └── strict.d.ts
│ │ │ │ │ ├── assert.d.ts
│ │ │ │ │ ├── async_hooks.d.ts
│ │ │ │ │ ├── buffer.buffer.d.ts
│ │ │ │ │ ├── buffer.d.ts
│ │ │ │ │ ├── child_process.d.ts
│ │ │ │ │ ├── cluster.d.ts
│ │ │ │ │ ├── compatibility
│ │ │ │ │ │ ├── disposable.d.ts
│ │ │ │ │ │ ├── index.d.ts
│ │ │ │ │ │ ├── indexable.d.ts
│ │ │ │ │ │ └── iterators.d.ts
│ │ │ │ │ ├── console.d.ts
│ │ │ │ │ ├── constants.d.ts
│ │ │ │ │ ├── crypto.d.ts
│ │ │ │ │ ├── dgram.d.ts
│ │ │ │ │ ├── diagnostics_channel.d.ts
│ │ │ │ │ ├── dns
│ │ │ │ │ │ └── promises.d.ts
│ │ │ │ │ ├── dns.d.ts
│ │ │ │ │ ├── dom-events.d.ts
│ │ │ │ │ ├── domain.d.ts
│ │ │ │ │ ├── events.d.ts
│ │ │ │ │ ├── fs
│ │ │ │ │ │ └── promises.d.ts
│ │ │ │ │ ├── fs.d.ts
│ │ │ │ │ ├── globals.d.ts
│ │ │ │ │ ├── globals.typedarray.d.ts
│ │ │ │ │ ├── http.d.ts
│ │ │ │ │ ├── http2.d.ts
│ │ │ │ │ ├── https.d.ts
│ │ │ │ │ ├── index.d.ts
│ │ │ │ │ ├── inspector.d.ts
│ │ │ │ │ ├── module.d.ts
│ │ │ │ │ ├── net.d.ts
│ │ │ │ │ ├── os.d.ts
│ │ │ │ │ ├── package.json
│ │ │ │ │ ├── path.d.ts
│ │ │ │ │ ├── perf_hooks.d.ts
│ │ │ │ │ ├── process.d.ts
│ │ │ │ │ ├── punycode.d.ts
│ │ │ │ │ ├── querystring.d.ts
│ │ │ │ │ ├── readline
│ │ │ │ │ │ └── promises.d.ts
│ │ │ │ │ ├── readline.d.ts
│ │ │ │ │ ├── repl.d.ts
│ │ │ │ │ ├── stream
│ │ │ │ │ │ ├── consumers.d.ts
│ │ │ │ │ │ ├── promises.d.ts
│ │ │ │ │ │ └── web.d.ts
│ │ │ │ │ ├── stream.d.ts
│ │ │ │ │ ├── string_decoder.d.ts
│ │ │ │ │ ├── test.d.ts
│ │ │ │ │ ├── timers
│ │ │ │ │ │ └── promises.d.ts
│ │ │ │ │ ├── timers.d.ts
│ │ │ │ │ ├── tls.d.ts
│ │ │ │ │ ├── trace_events.d.ts
│ │ │ │ │ ├── ts5.6
│ │ │ │ │ │ ├── buffer.buffer.d.ts
│ │ │ │ │ │ ├── globals.typedarray.d.ts
│ │ │ │ │ │ └── index.d.ts
│ │ │ │ │ ├── tty.d.ts
│ │ │ │ │ ├── url.d.ts
│ │ │ │ │ ├── util.d.ts
│ │ │ │ │ ├── v8.d.ts
│ │ │ │ │ ├── vm.d.ts
│ │ │ │ │ ├── wasi.d.ts
│ │ │ │ │ ├── worker_threads.d.ts
│ │ │ │ │ └── zlib.d.ts
│ │ │ │ └── undici-types
│ │ │ │ ├── README.md
│ │ │ │ ├── agent.d.ts
│ │ │ │ ├── api.d.ts
│ │ │ │ ├── balanced-pool.d.ts
│ │ │ │ ├── cache.d.ts
│ │ │ │ ├── client.d.ts
│ │ │ │ ├── connector.d.ts
│ │ │ │ ├── content-type.d.ts
│ │ │ │ ├── cookies.d.ts
│ │ │ │ ├── diagnostics-channel.d.ts
│ │ │ │ ├── dispatcher.d.ts
│ │ │ │ ├── errors.d.ts
│ │ │ │ ├── fetch.d.ts
│ │ │ │ ├── file.d.ts
│ │ │ │ ├── filereader.d.ts
│ │ │ │ ├── formdata.d.ts
│ │ │ │ ├── global-dispatcher.d.ts
│ │ │ │ ├── global-origin.d.ts
│ │ │ │ ├── handlers.d.ts
│ │ │ │ ├── header.d.ts
│ │ │ │ ├── index.d.ts
│ │ │ │ ├── interceptors.d.ts
│ │ │ │ ├── mock-agent.d.ts
│ │ │ │ ├── mock-client.d.ts
│ │ │ │ ├── mock-errors.d.ts
│ │ │ │ ├── mock-interceptor.d.ts
│ │ │ │ ├── mock-pool.d.ts
│ │ │ │ ├── package.json
│ │ │ │ ├── patch.d.ts
│ │ │ │ ├── pool-stats.d.ts
│ │ │ │ ├── pool.d.ts
│ │ │ │ ├── proxy-agent.d.ts
│ │ │ │ ├── readable.d.ts
│ │ │ │ ├── webidl.d.ts
│ │ │ │ └── websocket.d.ts
│ │ │ ├── package.json
│ │ │ ├── pagination.d.ts
│ │ │ ├── pagination.d.ts.map
│ │ │ ├── pagination.js
│ │ │ ├── pagination.js.map
│ │ │ ├── pagination.mjs
│ │ │ ├── pagination.mjs.map
│ │ │ ├── resource.d.ts
│ │ │ ├── resource.d.ts.map
│ │ │ ├── resource.js
│ │ │ ├── resource.js.map
│ │ │ ├── resource.mjs
│ │ │ ├── resource.mjs.map
│ │ │ ├── resources
│ │ │ │ ├── beta
│ │ │ │ │ ├── beta.d.ts
│ │ │ │ │ ├── beta.d.ts.map
│ │ │ │ │ ├── beta.js
│ │ │ │ │ ├── beta.js.map
│ │ │ │ │ ├── beta.mjs
│ │ │ │ │ ├── beta.mjs.map
│ │ │ │ │ ├── index.d.ts
│ │ │ │ │ ├── index.d.ts.map
│ │ │ │ │ ├── index.js
│ │ │ │ │ ├── index.js.map
│ │ │ │ │ ├── index.mjs
│ │ │ │ │ ├── index.mjs.map
│ │ │ │ │ ├── messages
│ │ │ │ │ │ ├── batches.d.ts
│ │ │ │ │ │ ├── batches.d.ts.map
│ │ │ │ │ │ ├── batches.js
│ │ │ │ │ │ ├── batches.js.map
│ │ │ │ │ │ ├── batches.mjs
│ │ │ │ │ │ ├── batches.mjs.map
│ │ │ │ │ │ ├── index.d.ts
│ │ │ │ │ │ ├── index.d.ts.map
│ │ │ │ │ │ ├── index.js
│ │ │ │ │ │ ├── index.js.map
│ │ │ │ │ │ ├── index.mjs
│ │ │ │ │ │ ├── index.mjs.map
│ │ │ │ │ │ ├── messages.d.ts
│ │ │ │ │ │ ├── messages.d.ts.map
│ │ │ │ │ │ ├── messages.js
│ │ │ │ │ │ ├── messages.js.map
│ │ │ │ │ │ ├── messages.mjs
│ │ │ │ │ │ └── messages.mjs.map
│ │ │ │ │ ├── models.d.ts
│ │ │ │ │ ├── models.d.ts.map
│ │ │ │ │ ├── models.js
│ │ │ │ │ ├── models.js.map
│ │ │ │ │ ├── models.mjs
│ │ │ │ │ └── models.mjs.map
│ │ │ │ ├── completions.d.ts
│ │ │ │ ├── completions.d.ts.map
│ │ │ │ ├── completions.js
│ │ │ │ ├── completions.js.map
│ │ │ │ ├── completions.mjs
│ │ │ │ ├── completions.mjs.map
│ │ │ │ ├── index.d.ts
│ │ │ │ ├── index.d.ts.map
│ │ │ │ ├── index.js
│ │ │ │ ├── index.js.map
│ │ │ │ ├── index.mjs
│ │ │ │ ├── index.mjs.map
│ │ │ │ ├── messages
│ │ │ │ │ ├── batches.d.ts
│ │ │ │ │ ├── batches.d.ts.map
│ │ │ │ │ ├── batches.js
│ │ │ │ │ ├── batches.js.map
│ │ │ │ │ ├── batches.mjs
│ │ │ │ │ ├── batches.mjs.map
│ │ │ │ │ ├── index.d.ts
│ │ │ │ │ ├── index.d.ts.map
│ │ │ │ │ ├── index.js
│ │ │ │ │ ├── index.js.map
│ │ │ │ │ ├── index.mjs
│ │ │ │ │ ├── index.mjs.map
│ │ │ │ │ ├── messages.d.ts
│ │ │ │ │ ├── messages.d.ts.map
│ │ │ │ │ ├── messages.js
│ │ │ │ │ ├── messages.js.map
│ │ │ │ │ ├── messages.mjs
│ │ │ │ │ └── messages.mjs.map
│ │ │ │ ├── models.d.ts
│ │ │ │ ├── models.d.ts.map
│ │ │ │ ├── models.js
│ │ │ │ ├── models.js.map
│ │ │ │ ├── models.mjs
│ │ │ │ ├── models.mjs.map
│ │ │ │ ├── shared.d.ts
│ │ │ │ ├── shared.d.ts.map
│ │ │ │ ├── shared.js
│ │ │ │ ├── shared.js.map
│ │ │ │ ├── shared.mjs
│ │ │ │ ├── shared.mjs.map
│ │ │ │ ├── top-level.d.ts
│ │ │ │ ├── top-level.d.ts.map
│ │ │ │ ├── top-level.js
│ │ │ │ ├── top-level.js.map
│ │ │ │ ├── top-level.mjs
│ │ │ │ └── top-level.mjs.map
│ │ │ ├── shims
│ │ │ │ ├── node.d.ts
│ │ │ │ ├── node.d.ts.map
│ │ │ │ ├── node.js
│ │ │ │ ├── node.js.map
│ │ │ │ ├── node.mjs
│ │ │ │ ├── node.mjs.map
│ │ │ │ ├── web.d.ts
│ │ │ │ ├── web.d.ts.map
│ │ │ │ ├── web.js
│ │ │ │ ├── web.js.map
│ │ │ │ ├── web.mjs
│ │ │ │ └── web.mjs.map
│ │ │ ├── src
│ │ │ │ ├── _shims
│ │ │ │ │ ├── MultipartBody.ts
│ │ │ │ │ ├── README.md
│ │ │ │ │ ├── auto
│ │ │ │ │ │ ├── runtime-bun.ts
│ │ │ │ │ │ ├── runtime-node.ts
│ │ │ │ │ │ ├── runtime.ts
│ │ │ │ │ │ ├── types-node.ts
│ │ │ │ │ │ ├── types.d.ts
│ │ │ │ │ │ ├── types.js
│ │ │ │ │ │ └── types.mjs
│ │ │ │ │ ├── bun-runtime.ts
│ │ │ │ │ ├── index.d.ts
│ │ │ │ │ ├── index.js
│ │ │ │ │ ├── index.mjs
│ │ │ │ │ ├── manual-types.d.ts
│ │ │ │ │ ├── manual-types.js
│ │ │ │ │ ├── manual-types.mjs
│ │ │ │ │ ├── node-runtime.ts
│ │ │ │ │ ├── node-types.d.ts
│ │ │ │ │ ├── node-types.js
│ │ │ │ │ ├── node-types.mjs
│ │ │ │ │ ├── registry.ts
│ │ │ │ │ ├── web-runtime.ts
│ │ │ │ │ ├── web-types.d.ts
│ │ │ │ │ ├── web-types.js
│ │ │ │ │ └── web-types.mjs
│ │ │ │ ├── _vendor
│ │ │ │ │ └── partial-json-parser
│ │ │ │ │ ├── README.md
│ │ │ │ │ └── parser.ts
│ │ │ │ ├── core.ts
│ │ │ │ ├── error.ts
│ │ │ │ ├── index.ts
│ │ │ │ ├── internal
│ │ │ │ │ ├── decoders
│ │ │ │ │ │ ├── jsonl.ts
│ │ │ │ │ │ └── line.ts
│ │ │ │ │ └── stream-utils.ts
│ │ │ │ ├── lib
│ │ │ │ │ ├── BetaMessageStream.ts
│ │ │ │ │ └── MessageStream.ts
│ │ │ │ ├── pagination.ts
│ │ │ │ ├── resource.ts
│ │ │ │ ├── resources
│ │ │ │ │ ├── beta
│ │ │ │ │ │ ├── beta.ts
│ │ │ │ │ │ ├── index.ts
│ │ │ │ │ │ ├── messages
│ │ │ │ │ │ │ ├── batches.ts
│ │ │ │ │ │ │ ├── index.ts
│ │ │ │ │ │ │ └── messages.ts
│ │ │ │ │ │ └── models.ts
│ │ │ │ │ ├── completions.ts
│ │ │ │ │ ├── index.ts
│ │ │ │ │ ├── messages
│ │ │ │ │ │ ├── batches.ts
│ │ │ │ │ │ ├── index.ts
│ │ │ │ │ │ └── messages.ts
│ │ │ │ │ ├── models.ts
│ │ │ │ │ ├── shared.ts
│ │ │ │ │ └── top-level.ts
│ │ │ │ ├── shims
│ │ │ │ │ ├── node.ts
│ │ │ │ │ └── web.ts
│ │ │ │ ├── streaming.ts
│ │ │ │ ├── tsconfig.json
│ │ │ │ ├── uploads.ts
│ │ │ │ └── version.ts
│ │ │ ├── streaming.d.ts
│ │ │ ├── streaming.d.ts.map
│ │ │ ├── streaming.js
│ │ │ ├── streaming.js.map
│ │ │ ├── streaming.mjs
│ │ │ ├── streaming.mjs.map
│ │ │ ├── uploads.d.ts
│ │ │ ├── uploads.d.ts.map
│ │ │ ├── uploads.js
│ │ │ ├── uploads.js.map
│ │ │ ├── uploads.mjs
│ │ │ ├── uploads.mjs.map
│ │ │ ├── version.d.ts
│ │ │ ├── version.d.ts.map
│ │ │ ├── version.js
│ │ │ ├── version.js.map
│ │ │ ├── version.mjs
│ │ │ └── version.mjs.map
│ │ └── yoga.wasm
│ └── @img
│ ├── sharp-darwin-arm64
│ │ ├── LICENSE
│ │ ├── README.md
│ │ ├── lib
│ │ │ └── sharp-darwin-arm64.node
│ │ └── package.json
│ └── sharp-libvips-darwin-arm64
│ ├── README.md
│ ├── lib
│ │ ├── glib-2.0
│ │ │ └── include
│ │ │ └── glibconfig.h
│ │ ├── index.js
│ │ └── libvips-cpp.42.dylib
│ ├── package.json
│ └── versions.json
├── package-lock.json
└── package.json
57 directories, 436 filessome casual observations
- Claude Code uses Facebooks “YOGA” flex-box layout engine for rending the user interface, it is compiled down to being a WebAssembly module (“yoga.wasm”).
- Claude Code uses “ripgrep” as an MCP tool for feeding entire files or parts of files into the LLM context window and comes with it so users do not need to install it.
- Claude Code uses “Sharp” for image processing and display
- Claude Code has easter egg functionality which can be used to get free stickers from Anthropic, if you have a postal address in the USA.
wait, did you say free Stickers?
Yes..
cli.mjs
This is the meat of the application itself. It is your typical commonjs application which has been compiled to typescript. As part of the process of compilation with Webpack a minifier step combines all the source code into this file and truncates the symbols.
so let’s get kicking.
Your first task to is open up cli.mjs within your favourite AI coding assistant or even Claude Code itself. Due to the “safety rails and AI alignment” you’ll need to strip the top comments from the application otherwise they will kick in unless you use an LLM such as Grok which has no guard rails.
Here’s the prompt that I used.
Because cli.mjs is close to 5mb – which is way bigger than any LLM context window out here. You’re going to need baby sit it for a while and feed it reward tokens of kind words (“your doing good, please continue“) and encourage it to keep on going on – even if it gives up. It will time out, lots…
After about two minutes it’ll spit out a technical specification which details how the application was built and the features of the application…
At this point it’ll timeout for sure. This is when you need to do the “new meta” of asking the LLM to write out the technical specification library. I say new meta because – hi folks – welcome, I haven’t talked about this yet publicly yet but the results of this technique when used in combination with the “old meta” are truly absurd. I’ll be going deep into this in a follow-up blog post so if you wanna be the first to see it – like, subscribe and click on the bell below below.
Once it has finished dumping out the technical specification library you’ll need to feed it this prompt
Now transpile the application. Split the application into seperate files per domain in the SPECS folder. Provide an overview of the directory structure before starting transpilation. Skip the SENTRYSDK.
After a couple moments you’ll be greeted with the skeleton of the transpiled outcome…
claude-code/
├── package.json
├── tsconfig.json
├── README.md
├── LICENSE.md
├── src/
│ ├── index.ts # Main entry point
│ ├── cli.ts # CLI argument parsing and commands
│ ├── config/ # Configuration management
│ │ ├── index.ts
│ │ ├── schema.ts
│ │ └── defaults.ts
│ ├── terminal/ # Terminal interface
│ │ ├── index.ts
│ │ ├── input.ts
│ │ ├── output.ts
│ │ └── rendering.ts
│ ├── codebase/ # Codebase analysis
│ │ ├── index.ts
│ │ ├── scanner.ts
│ │ ├── indexer.ts
│ │ ├── search.ts
│ │ └── watcher.ts
│ ├── commands/ # Command processing
│ │ ├── index.ts
│ │ ├── parser.ts
│ │ ├── executor.ts
│ │ └── handlers/
│ │ ├── edit.ts
│ │ ├── search.ts
│ │ ├── explain.ts
│ │ ├── git.ts
│ │ └── system.ts
│ ├── ai/ # AI integration
│ │ ├── index.ts
│ │ ├── client.ts
│ │ ├── context.ts
│ │ ├── prompts.ts
│ │ └── response.ts
│ ├── fileops/ # File operations
│ │ ├── index.ts
│ │ ├── reader.ts
│ │ ├── writer.ts
│ │ ├── diff.ts
│ │ └── vcs.ts
│ ├── execution/ # Command execution
│ │ ├── index.ts
│ │ ├── shell.ts
│ │ ├── sandbox.ts
│ │ └── monitor.ts
│ ├── auth/ # Authentication
│ │ ├── index.ts
│ │ ├── oauth.ts
│ │ └── tokens.ts
│ ├── telemetry/ # Analytics and telemetry
│ │ ├── index.ts
│ │ ├── events.ts
│ │ └── reporter.ts
│ ├── errors/ # Error handling
│ │ ├── index.ts
│ │ ├── types.ts
│ │ ├── handlers.ts
│ │ └── formatter.ts
│ └── utils/ # Utilities
│ ├── index.ts
│ ├── logger.ts
│ ├── async.ts
│ └── formatting.ts
├── scripts/ # Build and deployment scripts
│ ├── build.js
│ └── preinstall.js
└── tests/ # Test suite
├── unit/
├── integration/
└── fixtures/Now this is the part where it get’s wild. Get strap yourself in for another “oh-fuck” moment in time….
As the CLI.js is circa 5Mb in size. What follows is going to require a-lot of patience but the key is to use the following prompt and keep giving it “yeah bb, you doing great. keep going” words of encouragement.
Look at the SPECS library.
Look at CLAUDE-CODE folder.
Look at @CLI.js (do not confuse it with @cli.ts), keep transpiling and implement anything that’s not in the SPECS folder that has not been implemented in the CLAUDE-CODE folder.
Seriously, your going to need to enter that at least 100 times over the next 30 minutes. Because I’m not cruel – here’s the source code on GitHub if you don’t have the patience to do it yourself…
GitHub – ghuntley/claude-code-source-code-transpilation
Contribute to ghuntley/claude-code-source-code-transpilation development by creating an account on GitHub.
Now, a sharp mind should have picked up by now the implications of this but I’ll spell it out. Using the above technique you can clean-room any software out in existence.
Thus if you are in Application Security and want to verify functionality of the binary from a security perspective you’re still going to need to pull apart all those symbols by hand. This technique still however provides highlevel insights as to ‘what the application features are and how it works under the hood’ however…
but the madness doesn’t stop there
Transpiling from JS isn’t that interesting or impressive though. Understand dear security researcher that this technique can be done on any programming language and even from pre-existing binaries themselves. I’ve transpiled from ASM to C successfully and others have converted VB .exe’s to Python…
Reddit grandfather uploads 27 year old EXE file of a visual basic game and Claude one-shotted recreating the game in Python in under 5 minutes!!
From the binary. pic.twitter.com/KEzUfisxmu
— Deedy (@deedydas) February 26, 2025
still reading? good it’s time for the second reveal
All those “source available” founders who raised shit-loads-of-cash in the last boom are now screwed and anyone can re-implement their “proprietary features” which provide them with revenue at a much lower cost. All these zombie companies are about to get harvested if the founders don’t “Elon Musk” their companies… fast… especially if they don’t have a defensible moat.
So, here’s to the next generation of builders. May you use these insights wisely and to your advantage. It’s an incredible time to be alive if you just do things.
The future belongs to people who can just do things
There, I said it. I seriously can’t see a path forward where the majority of software engineers are doing artisanal hand-crafted commits by as soon as the end of 2026. If you are a software engineer and were considering taking a gap year/holiday this year it would be an
go fucking build. if you aren’t losing sleep right now and doing 80+hr weeks of coding right now whyyyyyyyy. there’s so much opportunity available right now…
ps. hi Anthropic
I’m friendly – if you have any concerns/questions please contact me. There’s not many killer examples of how to do MCP (even though in my last post I recommended folks learn em) properly and in a follow-up blog post coming shortly I’ll be going deep from fundamentals to teach folks how to do it. Your tool system prompts are A+++ and I’m a big fan…
I think you should be making your tool descriptions much much longer. They are like system prompts.
— Quinn Slack (@sqs) February 25, 2025
pps. socials for this blog post are below
If you enjoyed reading, give ’em a share please: