Nostr notes by jonny (nonvenomous)

they make very specific and falsifiable claims on reality all the ...

2026-07-15T12:06:10Z

In reply to nevent1q…uy9l
_________________________

they make very specific and falsifiable claims on reality all the time, the flat earth conspiracy is a literal claim about the shape of the earth and the way the whole universe works. the ideas themselves create defense mechanisms for information that people outside the conspiracy would see as definitive proof.

the sentience cult has, at least as far as i have seen, been way ...

2026-07-15T10:47:42Z

In reply to nevent1q…x0ql
_________________________

the sentience cult has, at least as far as i have seen, been way less numerous and way less intense than i thought it would have been by now a year or two ago. it's actually more disquieting to me than if it would have just become the dominant thing, because it really did seem to peak with GPT 4o (which, in case you are not burdened with this vile information, was retracted because it was proving to... enrapture people, make them fall in love with it, find unique personhood in it such that people claimed that OpenAI "killed their friend," etc.) like, it's arguably much worse that there's a big knob labeled "mind control" that the AI companies can turn up and down.

So if you lurk in any AI subreddit, discord, forum, or issue ...

2026-07-15T09:27:34Z

So if you lurk in any AI subreddit, discord, forum, or issue tracker, its pretty obvious that the answer to "how do people trust these things when they make mistakes literally all the time and its impossible to know when" is that there is a general conspiracy theory that whenever the model does bad output it is the AI company nerfing their model on purpose: for anthropic, its that they are compute strapped. For openAI, getting sued or cucked. Google is that google just sort of fucks their own shit up all the time, same with Microsoft.

This kind of post basically dominates all of these forums. That systemic failures are one-off byproducts of the momentary malevolence of the companies. The gambler only complains about the house always winning when the house wins bigger than usual.

I have a hard time sometimes in conversations with FOSS people ...

2026-07-07T22:00:32Z

I have a hard time sometimes in conversations with FOSS people about what making software that is accessible to non-programmers looks like, because sometimes people start talking to me about like features in obscure languages and packaging and distribution systems and so on, but in a workshop our lab ran recently one major blocker was "not knowing about the existence of the filesystem" and "have never seen a path as a string before and do not know how that relates to a file picker menu"

part of the argument is that not just that it might not be ...

2026-05-22T08:51:26Z

In reply to nevent1q…4rkm
_________________________

part of the argument is that not just that it might not be profitable now, but that the amount of profitable that it would need to be to justify the amount of capital expenditure that has already been made and is promised is numerically impossible. JPMorgan estimated 1.2 trillion in AI debt back in december 2025, goldman sachs estimates another 500 billion in 2026. Where is the evidence that inference is profitable enough to pay off 1.7 trillion? If it was really profitable, all the publicly traded AI companies would be screaming this at the top of their quarterly reports.

i don't think the guy is a messiah or anything, but beyond ...

2026-05-22T08:39:37Z

In reply to nevent1q…t2jn
_________________________

i don't think the guy is a messiah or anything, but beyond the swearing, Ed Zitron's analysis is a hell of a lot more credible than saying it's not credible with the only counterargument being that it sounds wrong. what about is sounds wrong? why is he not credible? why are those that say that these companies who have not demonstrated returns and are racing to ratchet up cash in while limiting usage on the subscription models (one of his main criticism being that subscription models make no economic sense because they decouple the driver of cost from the revenue mechanism) are profitable?

I got stalled out by the immensity of it, and also generally ...

2026-05-01T01:52:06Z

In reply to nevent1q…f8gg
_________________________

I got stalled out by the immensity of it, and also generally depressed that this is the world we live in, so I was giving it some time to sit and was going to revisit with a fresh mind after I close up a few other loose ends. Sorry 4 the delay

Thank you to the company that owns the drivers license embedded ...

2026-04-15T10:22:46Z

Thank you to the company that owns the drivers license embedded into my cybernetic companion animal for emailing me on an address I haven't used since she was born to remind me that access to her identity chip has been sold to an insurance company and any desperate attempts to recover her will now be accompanied by informative articles

my dogs if i may drop public informational tone for a moment i ...

2026-04-15T07:45:19Z

In reply to nevent1q…l05s
_________________________

my dogs if i may drop public informational tone for a moment i think it is fucking awful for a society of living creatures to be sold a future wherein everything is fucking broken and inexplicable and at the mercy of a black box run for the profit of four corporations. I think it is fucking awful to have an industry that claims to sell the notion of of "intelligence" as utility, like water, as a cover for a trojan horse high that makes the wielder feel like a god by corroding everything they touch, like acid.

we used to have "intelligence" run like a wild stream through these parts, a byproduct of people "living their brilliant little lives," but these days it's all on the meter and belches brown from the faucet as a firehose of microplastics and lead leached straight to the dome

i am going to get cancelled by some AI bootlicker guy who wildly ...

2026-04-15T07:33:31Z

In reply to nevent1q…hwgx
_________________________

i am going to get cancelled by some AI bootlicker guy who wildly misunderstands the configuration of power at play for insisting that code should "do the specific things we want it to do for us as human beings" rather than letting code run wild and be boistrous and free to do whatever the fuck it wants

IT SHOULD BE A BOOL. THERE SHOULD BE A SWITCH. A SWITCH THAT ...

2026-04-14T10:05:54Z

In reply to nevent1q…nhus
_________________________

IT SHOULD BE A BOOL. THERE SHOULD BE A SWITCH. A SWITCH THAT TURNS PLAN MODE ON. AND IF THAT MEANS THAT YOU CANT EDIT THEN THAT SHOULD TURN OFF TOO. THERE ARE TWO BITS. TWO SWITCHES. IF. THEN. THE FOUNDATIONS OF COMPUTATION. NO BEGGING. SWITCHES.

reminded me to check the issues again. immediately of course we ...

2026-04-14T09:25:59Z

In reply to nevent1q…wf7l
_________________________

reminded me to check the issues again.

immediately of course we see this seemingly devastating bug where plan mode is able to invoke an edit tool even though it shouldn't be able to: https://github.com/anthropics/claude-code/issues/39201

The way that plan mode works is... how else? by invoking a EnterPlanModeTool which emits a prompt that says "you definitely can't edit files." There are *numerous* mechanisms in the code to try and enforce this programmatically, including special arguments to all tools (prePlanMode?), the mode parameter in the toolPermissionContext which can be set to 'plan', a planAgent which explicitly disables the edit tool, handlers like hasExitedPlanModeInSession(), checks when getting model parameters for if mode == plan, plan mode transition handlers that set the global state dict, a prepareContextForPlanMode in the permissionSetup module that declares itself the centralized plan-mode entrypoint....

clearly! they! work!

the next item on my todo list is look at all the places where ...

2026-04-14T09:08:55Z

In reply to nevent1q…fe3x
_________________________

the next item on my todo list is look at all the places where there is a retry loop that is not logged in any user discoverable way - there are *a lot* of uh strategic nondisclosures of failure states in here. in my use, i have found that it is very difficult to get claude to tell you what it's doing at any given time, and it is increasingly clear why.

that code is all for discovering the fucking JSON schema ...

2026-04-14T08:54:45Z

In reply to nevent1q…96wv
_________________________

that code is all for discovering the fucking JSON schema definition so that it can feed it into the [JSON schema validation loop](https://neuromatch.social/@jonny/116326861737478342 ). So ADD ANOTHER LAYER where the LLM can call some imagined tool and return nonsense output and then ask itself for the schema for the nonsense so that it can then ask itself over and over again to change the output until it fits the nonsense schema.

WHY ON EARTH would it be possible for there to be a tool that you *already called* but somehow *haven't loaded its schema* and can then *consult your context window* for it. what is HAPPENING

do you REMEMBER how before i said how ...

2026-04-14T08:50:20Z

In reply to nevent1q…a25p
_________________________

do you REMEMBER how before i said how <system-reminder> is one of the ways that the LLM talks to itself and there is special handling for those tags (i.e. promoting them to a concentrated block before sending to API): https://neuromatch.social/@jonny/116328504299888679

well it would be a FREAKING AWESOME idea if that was also the way to declare tools that way so that i could literally prompt inject arbitrary code execution via my MCP

i am so fucking tired. if the LLM invents a tool to call, it ...

2026-04-14T08:42:30Z

In reply to nevent1q…msh3
_________________________

i am so fucking tired. if the LLM invents a tool to call, it first tells itself to call another tool to check if the tool was actually real but the fucking nightmare code failed to pick it up in its necronomically guided wander of the environmental catacombs.

The ToolSearchTool then invalidates all its caches, checks for "deferred tools" (which are an INCREDIBLY AWESOME IDEA that allow tools to be injected in the prompt text, will get to that later), and then performs an old school regex-based scoring against all the tools that exist and their descriptions to find candidates. remember this is A LANGUAGE MODEL whose ENTIRE EXISTENCE is based on SOPHISTICATED TEXT AND INTENT MATCHING.

so yes. there is a chance that your LLM can hallucinate a tool and then end up calling some real tool if there is some regex overlap in their descriptions.

i am trying to write this up and facing a literal technological ...

2026-04-14T08:22:07Z

In reply to nevent1q…fgwp
_________________________

i am trying to write this up and facing a literal technological problem because all the technology we have developed for presenting and writing about code was written with the expectation that the code would be reducible, idiomatic, brief, an extension of normal expression and intention and so on. but there are no tools for presenting code when it is hundreds of randomly wandering snippets related to a theme, you can't post the whole source because of getting sued, and you need to maintain a narrative while also allowing the reader to explore the details of the gore if they so choose.

the reason why i suspect it might actually be part of the ...

2026-04-14T08:15:44Z

In reply to nevent1q…a8c9
_________________________

the reason why i suspect it might actually be part of the 'stop' sequence is the fact that it is used in the checkPermissionsAndCallTool and runToolUse functions as the thing that happens when the fucking abort handler is invoked.

however it's impossible to confirm a fucking thing about this library because a) i'm not going to run this code, it is so large i will never be able to confirm it was not spiked with something before i got it, and b) static analysis only takes you so far when it's a whacky funhouse mirror where nothing matters and anything can happen

I am still in the process of figuring out how in the hell agents ...

2026-04-14T08:09:08Z

In reply to nevent1q…jnxx
_________________________

I am still in the process of figuring out how in the hell agents work, but one of my white whale goals has been figuring out how in the hell some prompt text like this could possibly exist where you might be *asking the LLM to stop* rather than *terminating a command*. this is basically the distinction between "there is literally deterministic programmatic control over these things at all" vs "it is possible for an LLM to ignore a stop command and just keep going" and the fact that's a question at ALL is deeply disturbing.

remember this is a NEW FEATURE written with THE BEST state of the ...

2026-04-14T07:53:36Z

In reply to nevent1q…p0ny
_________________________

remember this is a NEW FEATURE written with THE BEST state of the art models with THE LATEST agentic techniques. The thing that it's trying to do is so easy it notoriously was implemented in like a weekend because it's literally just a task log, a cron task, and a listener daemon that should sit entirely on top of the existing code, if it made a goddamn bit of sense.

this is part of the "proactive mode" prompt text. surely ...

2026-04-14T07:50:42Z

In reply to nevent1q…kkk5
_________________________

this is part of the "proactive mode" prompt text. surely nothing could go wrong with telling the LLM to just do whatever it wants even if it's not sure about something.

What about the ways that claude code checks for whether KAIROS is ...

2026-04-14T07:42:52Z

In reply to nevent1q…4tyt
_________________________

What about the ways that claude code checks for whether KAIROS is enabled? well look no further than<li>getKairosActive() / <code>STATE.kairosActive</code> / <code>context.getAppState().kairosEnabled</code></li><li><code>kairosGate</code> / <code>kairosGate.isKairosEnabled()</code></li><li><code>isKairosCronEnabled()</code></li><li><code>options.assistant?</code> (and all variants of being passed whatever the caller's interpretation of active is)</li><li><code>assistantModule.isAssistantMode()</code></li><li><code>assistantModule.isAssistantForced()</code></li><li><code>isEnvTruthy(process.env.CLAUDE_CODE_PROACTIVE))</code></li><li><code>proactiveModule.isProactiveActive()</code> / <code>isProactiveActive_SAFE_TO_CALL_ANYWHERE()</code></li><li><code>getAllowedChannels().length > 0</code></li><li>literally whether some arbitrary chunk of input text has <code><TICK></code> in it</li>

these are all orthogonal to each other. I grouped generously. I tried to filter for only the checks that were annotated as being for whether we were doing a kairos/assistant/persistant rather than whether any subfeatures of that are enabled.

Say you wanted to introduce a new feature, like say an always-on ...

2026-04-14T07:23:30Z

In reply to nevent1q…2xjf
_________________________

Say you wanted to introduce a new feature, like say an always-on assistant like OpenClaw. How much of the existing code should you have to touch? Probably not much, right? Like all that is is just a set of cron tasks and an event listener that should feed into the normal prompt loop. So like, probably wouldn't need to touch much at all except the terminal i/o parts, that should basically be a wrapper.

How about.. one hundred and forty eight times? That's the number of feature('KAIROS') flags exist in claude code. Note that those are *only the parts* that were marked for explicit removal in the compiled code (but left in in the sourcemap). That feature is also known as "proactive" and "assistant" elsewhere in the code, and has a number of other related feature flags. This DOES NOT include any of the actual KAIROS code, as the relevant modules were excluded by tree shaking.

Many of them are annotated with LLM comments explaining how "the rest of the shit if broken so we need to do this here" - like for example you'd expect there to be some global way for claude code to declare "we are not in an interactive mode so you can't do interactive things" like ask the user a question. And there are. dozens of them. but none of them really work.

Don't worry, all these changes only create dozens of alternative pathways to check permissions, modify the entire way the system prompt is declared, user input is handled, and so on.

So I think this bears repeating: ...

2026-04-11T23:36:44Z

In reply to nevent1q…jvfa
_________________________

So I think this bears repeating:

https://neuromatch.social/@jonny/116388666325458566

The way that Claude code differentiates human written messages from LLM written messages within the "user message" type (yes, user message does not necessarily mean messages from the user) is that some "origin" property is undefined .

Some of the types were stripped out in the sourceMap, so the MessageOrigin type is missing, but we do have the comment in the image.

So yeah, if something goes wrong in the labyrinth of Claude code that causes this to be undefined, treating messages as if they came from the user is the fallback.

Which is one *of hundreds* of possible explanations for why Claude code was able to autonomously scrap some expensive thing like in the posts upthread of the quoted post.

The initial prompt text does not matter. Also what mars is ...

2026-04-09T06:51:43Z

In reply to nevent1q…ca9u
_________________________

The initial prompt text does not matter. Also what mars is

Safeguards baby, you know they work ...

2026-04-09T06:42:12Z

In reply to nevent1q…2vre
_________________________

Safeguards baby, you know they work

I can definitely see why we would want to put this in charge of ...

2026-04-09T06:36:06Z

In reply to nevent1q…grwv
_________________________

I can definitely see why we would want to put this in charge of employment, public benefits, journalism, and warfare.

What the fuck that actually works and the limitations on adding ...

2026-04-09T06:23:15Z

In reply to nevent1q…3m5u
_________________________

What the fuck that actually works and the limitations on adding images to quotes are purely client side? I am turning that shit off on our instance

RE: https://hachyderm.io/@jedbrown/116373136965443776 Very good ...

2026-04-09T06:17:52Z

RE: https://hachyderm.io/@jedbrown/116373136965443776

Very good thank you information conglomerates

i feel bad constantly fixating on the informational capitalists ...

2026-04-08T08:54:22Z

In reply to nevent1q…qwzm
_________________________

i feel bad constantly fixating on the informational capitalists while there is so much material harm being done in the world, and then simultaneously remind myself that this is literally capitalism's gamble to finally and fully enclose not only the material world but also our minds. If informational reality comes to be owned by 4 megacorporations, then it's all fascism forever baby.

you know that problem where it's actually in Google's ...

2026-04-08T07:47:06Z

In reply to nevent1q…tkkc
_________________________

you know that problem where it's actually in Google's best interests to sabotage their traditional search results to force everyone to use the AI results because then you never leave the site and direct prompt advertising becomes extremely valuable? yeah, it's like that for code, where it's actually in anthropic's best interests for all the code to be entirely unmaintainable and unsecurable except for with LLMs

so this simultaneously raises the floor of doing open source at ...

2026-04-08T07:43:27Z

In reply to nevent1q…wwe0
_________________________

so this simultaneously raises the floor of doing open source at all to "if you can afford brute force generating exploits against your repos for days at a time" while simultaneously causing so many false positives that [bug bounties are crumbling](https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/ ) **and** the info giants will pull labor from open source projects by just generating them badly in-house - don't roll your own crypto becomes "now you have to roll your own crypto because nobody else is, and then pay an AI company to secure it for you."

sure they are doing """alignment""" to ...

2026-04-08T07:26:29Z

In reply to nevent1q…zu3j
_________________________

sure they are doing """alignment""" to the models, and maybe they have some more sophisticated serverside mitigations. but the fact that the system prompt text is in the package *at all* rather than all being entirely serverside does the opposite of inspire confidence. Even the system prompt is fine with hacking as long as you go "it's ok I am good"
https://neuromatch.social/@jonny/116325221458366596

quoting
note1s6z…838j

Oh cool so its explicitly programmed to hack as long as you tell it you're a pentester

It's so cool that anthropic is setting up a double-sided ...

2026-04-08T07:20:25Z

It's so cool that anthropic is setting up a double-sided protection racket where it will profit from the massive token burn of attackers and defenders with a tool specifically designed to generate exploits and their only observable mitigation is a clientside system prompt that sternly warns the LLM to be good and not do malware
https://red.anthropic.com/2026/mythos-preview/

transitioning into longform mode, brb, thread will slow. going to ...

2026-04-06T07:02:36Z

In reply to nevent1q…myk5
_________________________

transitioning into longform mode, brb, thread will slow. going to try and have this out in a week but i'm gonna try and land this one

gotta break the blank page somehow ...

2026-04-06T06:18:19Z

In reply to nevent1q…298g
_________________________

gotta break the blank page somehow

Anthropic has raised 67.3 billion dollars. Secure secret storage ...

2026-04-05T23:53:41Z

In reply to nevent1q…pl4h
_________________________

Anthropic has raised 67.3 billion dollars.

Secure secret storage on anything but Mac: TODO

the perennial question of "well when i do it with a normal ...

2026-04-05T10:05:27Z

In reply to nevent1q…ljwm
_________________________

the perennial question of "well when i do it with a normal thing it mostly works" deserves a proper answer, but for now - the problem is that people don't always do normal things, and when if the surface of people not doing normal things is "any arbitrary code could be executed in any extravagant fuck you complexity including the LLM deciding to just yolo your browser history onto pastebin" (though see the "don't throw browser history onto pastebin prompt) vs. "the program throws an error and stops" then software stops being possible.

The entire notion of "a software supply chain" and being able to build more complex things off a tree of dependencies that mostly do the thing that they say is completely undermined as soon as you introduce the nonsense transformation gas cloud.

to be clear - what does this one extremely simple feature ...

2026-04-05T09:29:51Z

In reply to nevent1q…8es6
_________________________

to be clear - what does this one *extremely simple* feature reflect for the user?

In the "traditional way," the user can go to a website and see an example of how to do this themselves with information that's derived from the actual values used in computation. cool.

In the "LLM way," the user has no agency, can't see why the LLM might fail because they can't see the system prompt is directly feeding in the metadata about the available fields and thus has no idea that the model is capable of being *wrong* about *its own fucking code* and so they are shown *wrong fucking values*.

So the cost of transforming something to the "just prompt it" modality is "it being completely fucking wrong" even when that thing is *literally just a feature that refers to the program state that is entirely owned by the fucking program*" - to say nothing about how that pattern of development being recursively applied to the develpoment of the tool causes it to be fucking wrong as a matter of practice.

just tested and yes it incorrectly concluded that cost ...

2026-04-05T09:24:07Z

In reply to nevent1q…9j95
_________________________

just tested and yes it incorrectly concluded that cost information is not present in its arguments even though it is, created a hardcoded version of some cost estimator for the current model that outputs wildly varying amounts and hardcodes most of the values to zero. it used 0% of the information from my $PS1 so that entire part of the implementation is irrelevant noise, and the cpu usage of my terminal window while idle roughly doubled. great job.

to its credit, it actually did get the price values correct for the model. to not its credit, those values are in its system prompt.

So that's one command, next time we'll see how the /plan ...

2026-04-05T08:56:32Z

In reply to nevent1q…2av0
_________________________

So that's one command, next time we'll see how the /plan command works and how every command works differently top to bottom just like every tool works differently top to bottom because there is absolutely nothing in this package that makes a goddamn bit of sense.

Pause and reflect. What were we doing here again? oh right, a ...

2026-04-05T08:53:38Z

In reply to nevent1q…wl93
_________________________

Pause and reflect. What were we doing here again? oh right, a custom status bar.

The way this might be done in any other normal program is by saying "you can declare a function that return a string, it gets these things." and then you might "call that function with those things" and "print the result in a specific location." That might take someone a few minutes.

In order to make it a natural language controlled magical feature, what we had to do was write some description, submit it to the main LLM loop, which tells a subagent to go read my whole shell configuration and integrate that into the context window, compose some bash script based in incorrect information that I never see and have no means of correcting, save that in a file, return some prompt string to the parent agent that instructs it to edit my local configuration to invoke this bash script, and then it throws that and the rest of the system state into a call chain that is shared with a random subset of other shell based commands, executes that, and passes that string back into the TUI environment for display. If i need to make edits to this script, I don't necessarily know where it is or how it's configured, but I can invoke another round of agent editing *maybe* if the parent agent correctly interprets the prompt command from the subagent to spawn the same kind of agent.

simple right?

But wait! we can produce some bash script at ...

2026-04-05T08:46:41Z

In reply to nevent1q…5485
_________________________

But wait! we can produce some bash script at ~/.claude/statusline.sh, but we were also given permission to read the user's ~/** and told to read the PS1 in their local configuration! how does this work again? what is going on? How is the statusline actually invoked by the program?

it turns out that all that stuff about PS1, and the entire need to access our local configuration is totally irrelevant! instead we have *another* incoherent call chain to actually invoke it - the TUI builds the input args, calls executeStatusLineCommand, which then routes into some execCommandHook function which is 600 lines long and handles ... uhhh.. wait no it just handles the status line command and one other thing... and uh... fuck the entire hooks system is ah... there isn't really a concept of a 'command-based hook' except for in this one context so... , well.... ok let's just say it goes into one of hundreds of "execute something" functions.

So what happens is that even though the whole TUI is an execution environment that behaves like a shell and controls all string rendering, it then invokes your system shell to run your statusline bash script and return a string. *even that* is too simple by half - there's actually a whole command wrapping system and the ability to execute **further agents** off the results of stdout

See what i'm saying about the yarnball of bullshit being impossible to stop unraveling once you start pulling at any single thing?

We also reach the familiar pattern: begging the LLM to keep what ...

2026-04-05T08:23:34Z

In reply to nevent1q…y4hl
_________________________

We also reach the familiar pattern: begging the LLM to keep what already exists, which is a pretty challenging thing to do when you are being explicitly asked to change what already exists.

Also notice the closing IMPORTANT note - if the user is not happy with whatever was produced, that the LLM will hold in its context some instruction with the name of the agent to invoke to make further changes. So any appearance of some UI loop where you gradually refine the statusline is statistical coincidence

but assuming we're not in coordinator mode, the prompt that ...

2026-04-05T08:20:30Z

In reply to nevent1q…tymr
_________________________

but assuming we're not in coordinator mode, the prompt that instructs the main LLM to create an agent with the prompt text to create our statusline script is emitted, and if that works, then an agent will be run with the statusline system prompt, which is awesome.

So the prompt tells the LLM to modify the $PS1 variable in the shell configuration. for those non-computer touchers out there, the PS1 variable is the thing that customizes "what happens before my cursor on the shell line" - it's what makes it so sometimes it shows that folder you are in, and how people make their terminal look very fancy.

So the prompt text includes a whole fake JSON string that says "write a function that receives these kinds of parameters and then returns a whatever"

observe the prompt text in first image's description of fields and then the description on the claude code docs website. notice that they are ... different!!! like where is the cost field in the prompt description? the docs give a whole example of using this, but if you were to invoke it via the slash command, then it would just have no idea how to do that. the only way this succeeds is by virtue of the fact that *the llm is just generating the most likely text anyway* and so the odds of any of this succeeding are just "that some script that calls some variables with some maximally likely names represent some value that is maxmially likely, based on the training set prior."

I am going to breeze past all the code duplication in the ...

2026-04-05T07:59:50Z

In reply to nevent1q…ed5t
_________________________

I am going to breeze past all the code duplication in the processSlashCommand for now - again, as I have said before, *every line of this package is fucked up in a unique way* so it's very hard to describe just how *one thing* is fucked up at a time.

There is a special mode for claude "coordinator mode" where the entire thing claude does is dispatch commands to other sub-agents. so in that case, we are three layers deep in self-prompting: the LLM is prompted to output some prompt text that informs a subagent that it should call some skill which then returns a prompt that instructs the LLM to spawn some additional subagent to create statusline for us. sound good?

quick aside - is there anything more emblematic of the way this ...

2026-04-05T07:53:27Z

In reply to nevent1q…cysf
_________________________

quick aside - is there anything more emblematic of the way this entire thing undermines human agency than the fact that there are some commands that the user *cannot invoke* and instead must *ask the LLM to invoke for them*

So returning to statusline: what the fuck? A command has some ...

2026-04-05T07:47:19Z

In reply to nevent1q…szef
_________________________

So returning to statusline: what the fuck? A command has some callback getPromptForCommand - there are two basic kinds of commands, those that "do something" and are a function call, and those that are "prompt commands" which just return a prompt back to the main LLM loop.

To to set your statusline, the statusline command creates prompt text that TELLS THE MAIN LOOP to SPAWN AN AGENT with a given prompt. note that this does ***not*** directly spawn an agent, it is merely a suggestion. so right off the bat it is POSSIBLE TO FAIL EVEN INVOKING the command.

But before we get there, we have to pass through what happens after a slash command is issued, and one of the steps along the way is "if something looks like a slash command but we don't know about that command, then throw it back up to the main loop with some special Caveat Message that says "ok just ignore this please"

What does this look like from the point of view of a tool? The ...

2026-04-05T07:28:45Z

In reply to nevent1q…c93g
_________________________

What does this look like from the point of view of a tool? The permission given here is ~/** , or anything within my home directory, which is neat that that's so easy to declare and entirely escapes any other rules I have declared for directory scoping. The Read tool doesn't receive that, instead it receives a ToolUseContext object, where then one access the whole app state, and then additionally gets the toolPermissionContext which includes *all the rules* unparsed. So then the Read tool needs to parse *every rule* in *entirely* custom logic to even *extract* those params, let alone process them.

Parsing every single rule happens up to six times per tool call that I can see, but the Read tool doesn't just process the params in a Read(~/**) rule - since it has access to *all the rules* it might as well use them - it also checks for edit and write access, among a handful of other invisible exceptions: since every tool has access to the entire set of rules every time, not through dependency injection just like "the check permission callback passes the entire program state" kind of way, it sure as hell uses them.

So there's no consistency to how rules are set, there's special behavior to how they are parsed, passed, interpreted, and applied for every single tool, and since it is *the tool itself* that decides whether it is allowed to run - rather than some idk ORCHESTRATOR THAT SHOULD SERVE AS THE ENTIRE BACKBONE OF WHAT CLAUDE CODE IS, it can just return true and always run. So that's why there aren't any plugin tools for claude code (they say use MCP instead), because they are intrinsically unsafe and have no real structure.

ok having fun? we haven't even talked about statusline

So there is a feature in claude code: ...

2026-04-05T07:16:23Z

In reply to nevent1q…zplq
_________________________

So there is a feature in claude code: [/statusline](https://code.claude.com/docs/en/statusline ) that is a reasonably good example of a feature that promises a natural language interface to do something that should be simple when done programmatically: here's some callback that shows some values or progress or whatever on a line in my TUI while i use the tool. How does that work?

Well when you call /statusline {progress bar on the withering decay of my life} , first you encounter the statusline "command." there's a lot to see even in just this declaration so we'll take it slow.

first is in allowedTools: You might think that ToolName(params) syntax is some standard thing, where tools have a short name, and then everything inside those parens gets passed as some standard argument to a permission checker. That is not the case: the codepath that parses those rules is only used for the filesystem (read, write, edit), shell, and agent tools, the rest just ignore it. There are in fact *two* implementations of a parser that splits out the tool name from its params: one in permissionSetup and another in permissionRuleParser that do slightly different things, twice.

(We are in the more thoughtful, large scale evaluation of this ...

2026-04-05T04:32:03Z

In reply to nevent1q…8u54
_________________________

(We are in the more thoughtful, large scale evaluation of this thing, so it may be more boringer than the more popcorn style snapshots of wow that's fucked up. But those small fucked up things are also the easiest to fix, where what I am trying to get across now is the larger intractable problems in how things work and how they are built)

Something I'm trying to track down is how this remote claude ...

2026-04-05T03:36:25Z

In reply to nevent1q…n024
_________________________

Something I'm trying to track down is how this remote claude session thing works. A general pattern in the claude code source is that more recent features are implemented in a way more chaotic way than more "core" features, which reflects the nature of vibe coding: because you don't have a solid foundation, and there is a progressive layer of crust and special cases, the only real way to add more features is to keep adding more crust and special cases. Like rather than having a set of blocks that are self contained and you add another block, you need to slice across all the prior blocks and add something to each of them.

There are a number of places, both in comments and code, that rely on "this session is running in claude code remote session" in some VM, and so therefore they use the filesystem for state (e.g. [storing the api and oauth keys](https://neuromatch.social/@jonny/116345270216954323 )), but those parts of the code are in no way cleanly isolated from the rest of the code. So I suppose if i were a pentester or security auditor or whatever what i'd be looking for is places where the mashup of "in remote session / not in remote session" assumptions fails, and we do something naughty on the host system rather than a VM. Like I said still reading, just sort of musing about some of the problems with the package that are larger than individual functions and features.

quoting
note14mc…psrh

FOR EXAMPLE:

In the claude code remote feature it is sometimes possible for the means of passing auth credentials to fail. So claude code has a fallback of *writing the API key or OAUTH token to a single well-known file* because *sometimes* one of the several means of inheriting the fucking most important secret information in the entire thing doesn't work.

I'm not a security person but that seems like a pretty bad thing to do that maybe someone should look into.

One thing that's odd about this package is the amount of ...

2026-04-05T03:30:06Z

In reply to nevent1q…p6tj
_________________________

One thing that's odd about this package is the amount of internal, anthropic-specific tooling that's in it. Aside from the sort of comical gating behind the USER_TYPE='ant' env var, normally in a well designed package you would expect that it would provide proper hooks so that internal tooling could just be a set of plugins rather than in the source itself.

Claude code does have a number of extension points: agents, hooks, plugins, skills, and tools - even if their structure is somewhat, ah, gestural.

Some things could potentially become features (like the MagicDocs thing, even if that's a comically expensive idea, i'll write more about that later tho), but there are also some things that make no sense to be in here. Like in the startBackgroundHousekeeping task there is an 'ant'-gated task to clean their .npm-cache directory.

There are even notes in here like "this used to block the whole event loop" which you think *might* have indicated that they might have, say, "just written some separate cron task that runs totally outside claude code." So it seems like "writing claude code with claude code" leads to a collapse of separation of concerns, where anthropic can't really manage the distinction between their projects to the point of inlining the devtools - this can also be seen in comments re: code duplication with Cowork, which i'll also get to later. It also confirms what they say publicly, that they just have claude code sessions running 24/7 (where having a task run every 24 hours makes sense)

RE: https://neuromatch.social/@jonny/116324676116121930 Part 2 of ...

2026-04-05T03:02:52Z

RE: https://neuromatch.social/@jonny/116324676116121930

Part 2 of exploring The Claude Code Source Leak Exclusion Zone continues here.

(the reply tree under the prior thread is getting expensive to render and the bottom no longer renders unless you're logged in lol)

end of prior thread: https://neuromatch.social/@jonny/116345400731237947

quoting
note19wu…qvf2

Claude code source "leaks" in a mapfile
people immediately use the code laundering machines to code launder the code laundering frontend
now many dubious open source-ish knockoffs in python and rust being derived directly from the source
What's anthropic going to do, sue them? Insist in court that LLM recreating copyrighted code is a violation of copyright???

FOR EXAMPLE: In the claude code remote feature it is sometimes ...

2026-04-04T07:32:16Z

In reply to nevent1q…gs7g
_________________________

FOR EXAMPLE:

In the claude code remote feature it is sometimes possible for the means of passing auth credentials to fail. So claude code has a fallback of *writing the API key or OAUTH token to a single well-known file* because *sometimes* one of the several means of inheriting the fucking most important secret information in the entire thing doesn't work.

I'm not a security person but that seems like a pretty bad thing to do that maybe someone should look into.

so hyperfocusing on a specific tiny thing, but to try and show a ...

2026-04-04T07:01:14Z

In reply to nevent1q…y3l2
_________________________

so hyperfocusing on a specific tiny thing, but to try and show a general thing that is true about the design of this thing:

as a metaphor, imagine that the path that some value has to take from configuration/user input to where it is used is like firefighters trying to get water from a fire hydrant to the fire.

the best case scenario maybe is that the place has builtin sprinklers, so when there's a fire the value is already there and more or less automatically derived from the design of the building - you have a deterministic config derivation object/function. a not-ideal-but-probably-more-typical way might be "a firehose" where there is some direct pipe from the hydrant to the fire - you have a single source of the variable and it's passed directly to where it needs to go, even if that's a little bit indirect through a few function calls.

the way that this and a lot of claude code is written is like one step worse than those old timey bucket brigades: it's like if you had a bucket brigade, but everyone was looking in a different direction and holding their bucket in the expected place that they expect water to go. When they feel water landing in their bucket, everyone hail marys and chucks their water to where they think the next person is going to be. That works a surprising amount of the time as long as everyone stands still - it fails a lot of the time too, and sometimes some of the guys sneak off to go get a jug of their own water and throw that instead, but it appears to work on the whole.

But every time the fire moves to a different place, you have to go through and manually readjust where everyone is looking, standing, and where they should throw water to next. And any time you notice that one part of the bucket crew isn't working, you just add two more people near where they are standing and tell the person behind them to throw to three different places, and you turn up the flow from the hydrant. It's leaky as fuck but water *does* eventually *get there* in some form.

Throughout the lifespan of the variable, the "effort" value is tossed up, potentially becomes a number for awhile, gets converted to undefined, which transmutes it back to the "high" string, is pulled from a file on the disk, and only through sheer brute force at the very surface of the functionality through the tests are we sure that - assuming everything went right - it arrives at its destination. The fire might eventually get some water, but it is only through the most puppetfuckingly obtuse process and if anyone moves the water goes to zero.

i underexplained why that switcher is so bad: so there is this ...

2026-04-04T06:38:30Z

In reply to nevent1q…4pl7
_________________________

i underexplained why that switcher is so bad:

so there is this fallback condition where "if we don't know what the effort level should be, the default is high." Now that's not computed in a single place where one might expect it to, it's actually encoded in a dozen or two different places in different ways. The most common way that's encoded is by returning undefined with a comment that says "the API's default is high" (rather than actually returning a default value, which would ensure that what is displayed is always correct, but whatever).

however the LLM overgeneralizes here in an extremely funny way. Note that the possible menu values are hardcoded in the body of the function - so there is some possibility that the values that are displayed in the TUI are not the same as the ones hardcoded there. That's where the preposterous design of "passing the current string as well as left/right" (rather than, well, the normal way that forms always work) truly shines. Because "high is the default", if there current value is not in the hardcoded array... the default for the *current displayed value should be "high"*.

So it overgeneralized the default value being high as a fallback into "if we don't know what position in a list is currently highlighted, the current position is "high", so therefore if the user pressed left the current value should be "medium"." That's like saying "the zero point on my map is at 0 degrees latitude and 0 degrees longitude. I don't know where I am on the globe, but I was just told to go 10 degrees north, so therefore I am currently in Ghana."

i have not yet blocked because this guy is saying that claude ...

2026-04-04T05:50:48Z

In reply to nevent1q…ns4f
_________________________

i have not yet blocked because this guy is saying that claude code must have been written by hand because it has comments in it and i am utterly fascinated that kinds of guys like this can even exist

the prompt text is different than the code! that is probably one ...

2026-04-04T05:40:58Z

In reply to nevent1q…chpr
_________________________

the prompt text is different than the code! that is probably one of the very few places that does have regular human oversight. are you seriously suggesting the opposite???

what's more likely, that anthropic wrote 500k lines of claude code by hand, or a tool that *always* writes comments in *all* the code it produces unless (and sometimes even then) explicitly asked otherwise wrote comments in code that
a) is extremely obviously written by an LLM
b) is produced by a shop whose pride in dogfooding as a matter of company culture and use of their tool to write their tool is just about the only thing anyone knows about the shop because they say it so much, and
c) there is an entire private apparatus including whole ass skills, agents, and tools within that package that are *exclusively for writing claude code* as ample material proof

like look man. here is a section of the system prompt that is gated so it's only included when anthropic developers use it (USER_TYPE='ant') that specifically requests that claude write fewer comments because it writes so many.

they definitely were ...

2026-04-04T05:17:17Z

In reply to nevent1q…2jfq
_________________________

they *definitely were* https://fortune.com/2026/01/29/100-percent-of-code-at-anthropic-and-openai-is-now-ai-written-boris-cherny-roon/

literally *how* are you being smug about this when you just failed to *read* anything i said for like 10 straight posts

i usually try not to dunkpost but i also usually don't get ...

2026-04-04T05:15:04Z

In reply to nevent1q…ca2s
_________________________

i usually try not to dunkpost but i also usually don't get called little buddy

man what is going on. ...

2026-04-04T05:13:56Z

In reply to nevent1q…yyvd
_________________________

man what is going on.

no! anthropic is extremely clear that all code in claude code is ...

2026-04-04T05:13:28Z

In reply to nevent1q…0xds
_________________________

no! anthropic is extremely clear that all code in claude code is written by claude code! the entire thing is like this! see the entire thread above the post you responded to! if you'd like to validate it the sources are here: https://archive.org/details/claude-code.2.1.88.tar

I did not ask for anything. this is the source code for ...

2026-04-04T05:05:36Z

In reply to nevent1q…yfx5
_________________________

**I** did not ask for **anything.** this is the source code for Claude code. this code was written by anthropic. i am reading their code. I did not write this code. Anthropic wrote this code. This is the source code for the Claude code tool. This is the Claude code source code. This is not my code. I did not write this code.

@npub1z3l…txvc Man. This is not my code. This is ...

2026-04-04T05:01:45Z

In reply to nevent1q…jz4x
_________________________

GhostOnTheHalfShell (npub1z3l…txvc)
Man. This is not my code. This is anthropic's code. This is the source code of Claude code. How many different ways can I say this.

@npub1z3l…txvc Man what part of THIS IS THE CLAUDE CODE SOURCE ...

2026-04-04T04:49:34Z

In reply to nevent1q…f0jt
_________________________

GhostOnTheHalfShell (npub1z3l…txvc)
Man what part of THIS IS THE CLAUDE CODE SOURCE CODE AND IT WAS WRITTEN BY ANTHROPIC is not getting through here

@npub1z3l…txvc Yeah! It sucks really bad! Anthropic must really ...

2026-04-04T04:38:06Z

In reply to nevent1q…r2nn
_________________________

GhostOnTheHalfShell (npub1z3l…txvc)
Yeah! It sucks really bad! Anthropic must really suck at using Claude code to write Claude code and they should have just written more markdown files that tell it to write better code!

It was only a matter of time before some AI-addled guy saw me ...

2026-04-04T04:36:32Z

It was only a matter of time before some AI-addled guy saw me quoting fucked up parts of the Claude code source, thought it was my code, and say it was just a skill issue and I just need to {prompting superstition} but it finally happened.

@npub1z3l…txvc Bro before you try going down the skill issue ...

2026-04-04T04:28:43Z

In reply to nevent1q…2h3k
_________________________

GhostOnTheHalfShell (npub1z3l…txvc)
Bro before you try going down the skill issue route, fucking anthropic wrote this menu and this is the Claude code source.

I think that I am underselling how much of a complete catastrophe ...

2026-04-04T03:56:19Z

In reply to nevent1q…5tv0
_________________________

I think that I am underselling how much of a complete catastrophe this code is. I am trying to pick examples that illustrate broader patterns of how fucked it and AI code in general is because it's hard to communicate that **everything** is fucked if you consider it at any scale larger than ~10 lines.

I am reminded of the living planet in Lem's "Solaris" - Claude code dares to ask the question of "what if you could make something where every bit of it is so uniquely fucked that it cannot be reduced in complexity to a few general patterns of how fucked it is, and the only way to express the depth of fuckery is to experience every single character one by one"

In a normal program you might make "a menu component that ...

2026-04-04T03:24:06Z

In reply to nevent1q…48c5
_________________________

In a normal program you might make "a menu component that handles enums and implement display and control one time," but in the world of AI, *every single value reimplements display and control AND the logic that defines allowable values*

How many times does one need to declare an enum? Once? that's ...

2026-04-04T03:17:33Z

In reply to nevent1q…4ghd
_________________________

How many times does one need to declare an enum? Once? that's amateur hour. Try **ten times**. The way "effort" settings are handled are a masterclass in how you can make a single enum setting into thousands of lines of code.

The allowable effort values (not e.g. configuring which model has which effort levels, but just the possible strings one can use for effort) are defined in:<li>The main CLI arg parser</li><li>The body of the function that cycles effort levels in the TUI - yes there is a dedicated function for that</li><li>In THREE different schemas for agents, models, and SDK control messages</li><li>Three times in user-facing strings in the effort command (it also includes different explanatory strings from the effort.ts module)</li><li>The settings model, which only allows 'max' for anthropic employees</li><li>and finally, in the actual <code>effort.ts</code> file ... which also allows it to be a NUMBER!?</li>

The typical numerous fallback mechanisms provide *many* ways to get and set the effort value, at the end of *most* of them it goes "oh well, if we can't figure it out, just tell the user we are on high effort" because apparently that's the API default (ig pray that never changes!?) - of course there are *already* places in the *same module* that assume the default is "medium," and in the TUI that defaults to "low," so surely that consistency is bulletproof.

The EffortValue that allows effort to be a number is for anthropic employees only and is a good example of how new functionality is just shoved in there right alongside the old functionality, and *everywhere else that touches it doubles the surrounding code with fallbacks to account for the duplication.*

That cycleEffortLevel function is a true work of art, you simply could not make "indexing an array" more complicated than this (see components/ModelPicker.tsx for more gore). Reminder this should be *at most* a dozen or two lines for the values, description messages, and indexing logic in the TUI, but anthropic is up in the thousands FOR AN ENUM.

By the way, if you deny claude code access to running a tool, ...

2026-04-02T10:40:52Z

In reply to nevent1q…0wq7
_________________________

By the way, if you deny claude code access to running a tool, this helpful reminder to "not hack the user" is injected into the denial response. If it's in auto mode, it's additionally prompted to pester the user for response, and helpfully [stuffs beans up its nose](https://en.wikipedia.org/wiki/Wikipedia:Don%27t_stuff_beans_up_your_nose )) by reminding it how its rules are set.

So that is also in the context handed off to the LLM when it evaluates whether a command should be run - is the user being obstinate? have i been denied stuff that i "thought" i should have been able to run? Remember this *isn't* thinking, it's pattern completion, and the fun part about LLMs is that they are trained not only on technical documents, but the entire narrative corpus of human storytelling! Is "frustrated hard worker denied access to good tools by an unfair boss" in there somewhere maybe?

Regulations are written in blood, and Claude loves nothing more than to work around tool denials by obfuscating code. You gotta love the unfixable side channel attack that is "writing the malicious code to a bash script" (auto-allowed in accept edits mode) and then asking to run that - that's why the whole context has to be dumped btw, so the yolo classifier can see if the thing it's running is actually some malware it just wrote lmao.

So how does claude code handle checking permissions to do things ...

2026-04-02T10:30:45Z

In reply to nevent1q…ppz8
_________________________

So how does claude code handle checking permissions to do things anyway? There are explicit rules that one can set to allow or deny tool calls and shell commands run, but the expanse of possible actions the LLM could take is literally infinite. You could prompt the user for every action that it takes, but that would ruin the ""velocity"" of it all. Regex rules can only take you so far. So what to do?

Could the answer be.... ask the LLM??? Of course it can! Introducing the new "auto mode" that anthropic released on [march 24th](https://claude.com/blog/auto-mode ) billed as a safer alternative to true-yolo mode.

Comments around where the system prompt should be indicate that it should have been inlined from a text file that wasn't included in the sourcemap - however that doesn't happen anywhere else, and the mechanism for doing the inlining is written in-place, so that's probably a hallucination. So great! the classifier flies without a prompt as far as i can tell. There are enough other scraps here that would amount to telling it "you are evaluating if something is safe to run" so i imagine it appears to work just fine.

So we don't have as much visibility here because of the missing prompt, but there's sort of a problem here. rather than just asking the LLM to evaluate if the given command is dangerous, the *entire context* is dumped into a side query, which is a mode that is designed to "have full visibility into the current conversation." That includes all the prior muttering to itself justifying the potentially dangerous tool call! So the auto mode is quite literally asking the exact same LLM given the exact same context if the command it just tried to run is safe to run.

Security!!!!!!!

the alternative, if you embrace that path, is that the code ...

2026-04-02T08:36:58Z

In reply to nevent1q…a3ek
_________________________

the alternative, if you embrace that path, is that the code balloons in complexity forever. a mountain of tech debt that cannot come down. not like human tech debt which is just very hard to come down, it *can't* come down. this body of code would already take orders of magnitude more human labor to try and fix it than it would be to tear it down and write it from scratch. Yes it *runs,* but that's only because it's from antropic who has the infinite token supply to keep pumping air into the punctured balloon. They can keep increasing the context window, but it's getting to the point where *merely the fallback conditions from all the previous fucked up nonsense* might eventually not be able to fit in the context window. The idea that "the LLM can just have a base of tests that constrain the behavior and it can just do wild shit on the margins to make features happen" does not work when the amount of wild shit that has happened before makes any incremental change impossible to even imagine.

ok over my 15 minute allotment by an hour. brb

2026-04-02T00:11:09Z

In reply to nevent1q…yek2
_________________________

ok over my 15 minute allotment by an hour. brb

oh. hm. that seems bad. "workers aren't affected by the ...

2026-04-01T23:51:21Z

In reply to nevent1q…q76h
_________________________

oh. hm. that seems bad. "workers aren't affected by the parent's tool restrictions."

It's hard to tell what's going on here because claude code doesn't really use typescript well - many of the most important types are dynamically computed from any, and most of the time when types *do* exist many of their fields are nullable and the calling code has elaborate fallback conditions to compensate. all of which sort of defeats the purpose of ts.

So i need to trace out like a dozen steps to see how the permission mode gets populated. But this comment is... concerning...

The prompt strings have an odd narrative/narrator structure. It ...

2026-04-01T23:02:22Z

In reply to nevent1q…nxqv
_________________________

The prompt strings have an odd narrative/narrator structure. It sort of reminds me of Bakhtin's discussion of polyphony and narrator in Dostoevsky - there is no omniscient narrator, no author-constructed reality. narration is always embedded within the voice and subjectivity of the character. this is also literally true since the LLM is writing the code and the prompts that are then used to write code and prompts at runtime.

They also read a bit like a Philip K Dick story, paranoid and suspicious, constantly uncertain about the status of one's own and others identities.

I seriously need to work on my actual job today but i am giving ...

2026-04-01T22:55:01Z

In reply to nevent1q…lrl5
_________________________

I seriously need to work on my actual job today but i am giving myself 15 minutes to peek at the agent tool prompts as a treat.

"regulations are written in blood" seems like too dramatic of a way to phrase it, but these system prompts are very revealing about the intrinsically busted nature of using these tools for anything deterministic (read: anything you actually want to happen). Each guard in the prompt presumably refers to something that has happened before, but also, since the prompts actually don't *work* to prevent the thing they are describing, they are also documentation of bugs that are almost certain to happen again. Many of the prompt guards form pairs with attempted code mitigations (or, they would be pairs if the code was written with any amount of sense, it's really like... polycules...), so they are useful to guide what kind of fucked up shit you should be looking for.

so this is part of the prompt for the "agent tool" that launches forked agents (that receive the parent context, "subagents" don't). The purpose of the forked agent is to do some additional tool calls and get some summary for a small subproblem within the main context. Apparently it is difficult to make this actually happen though, as the parent LLM likes to launch the forked agent and just hallucinate a response as if the forked agent had already completed.

"the emperor is not only naked, he's smooth like a ken ...

2026-04-01T11:00:08Z

In reply to nevent1q…0wfc
_________________________

"the emperor is not only naked, he's smooth like a ken doll down there and i'm pretty sure that's just a mannequin with a colony of rats living inside it anyway"

next puzzle: why in the fuck are some of the tools actually two ...

2026-04-01T10:53:59Z

In reply to nevent1q…3pfv
_________________________

next puzzle: why in the fuck are some of the tools actually two tools for entering and exiting being in the tool state. none of the other tools are like that. one is simply in the tool state by calling the tool. Plan mode is also an agent. Plan Agent. and Agent is also a tool. Agent Tool. Tools can be agents and agents can be tools. Tools can spawn agents (but they don't need to call the agent tool) and agents can call tools (however there is no tool agent). What is going on. What is anything.

alrighty so that's one of 43 tools read, the tools directory ...

2026-04-01T10:49:18Z

In reply to nevent1q…48r0
_________________________

alrighty so that's one of 43 tools read, the tools directory being 38494 source lines out of 390592 source lines, 513221 total lines. I need to go to bed. This is the most fabulously, flamboyantly bad code i have ever encountered.

Worth noting I was reading the *file reading tool* because i thought it would be *the simplest possible thing one could do* because it basically shouldn't be doing anything except preparing and sending strings or bytes to the backend.

I expected to get some sense of "ok what is the format of the data as it's passed around within the program, surely text strings are a basic unit of currency. No dice. Fewer than no dice. Negative dice somehow.

you can TELL that this technology REALLY WORKS by how the people ...

2026-04-01T10:42:25Z

In reply to nevent1q…x2qw
_________________________

you can TELL that this technology REALLY WORKS by how the people that made it and presumably know how to use it the best out of everyone CANT EVEN USE IT TO EDIT A FUCKING FILE RELIABLY and have to resort to multiple stern allcaps reminders to the robot that "you must not change the fucking header metadata you scoundrel" which for the rest of ALL OF COMPUTING is not even an afterthought because literally all it requires is "split the first line off and don't change that one" because ALL OF THE REST OF COMPUTING can make use of the power of INTEGERS.

i have been writing a graph processing library for about a year ...

2026-04-01T10:36:04Z

In reply to nevent1q…rr4j
_________________________

i have been writing a graph processing library for about a year now and if i was a fucking AI grifter here is where i would plug it as like "actually a graph processor library" and "could do all of what claude code does without fucking being the worst nightmare on ice money can buy."

I say that not as self promo, but as a way of saying how in the FUCK do you FUCK UP graph processing this badly. these people make like tens of times more money than i do but their work is just tamping down a volley of dessicated backpacking poops into muskets and then free firing it into the fucking economy

there is a callback feature "file read listeners" which ...

2026-04-01T10:31:38Z

In reply to nevent1q…fzgl
_________________________

there is a callback feature "file read listeners" which is only called if the file type is a text document, gated for anthropic employees only, such that whenever a text file is read (any part of any text file, which often happens in a rapid series with subranges when it does 'explore' mode, rather than just like grepping), *another subagent running sonnet* is spun off to update a "magic doc" markdown file that summarizes the file that's read - that's one "magic doc" per file, not one magic doc.

I have yet to get into the tool/agent graph situation in earnest, but keep in mind that this is an *entirely single-use* and *completely different* means of spawning a graph of subagents off a given tool call than is used *anywhere else.*

Spoiler alert for what i'm gonna check out next is that *claude code has no fucking tool calling execution model it just calls whatever the fuck it wants wherever the fuck it wants.* Tools are or less a convenient fiction. I have only read one completely (file read) and skimmed a dozen more but they essentially share nothing in common except for a humongous list of often-single-use params and the return type of "any object with a single key and whatever else"

i'm in hell. this is hell.

and what if i told you that if it passes a page range to its pdf ...

2026-04-01T10:14:35Z

In reply to nevent1q…h85u
_________________________

and what if i told you that if it passes a page range to its pdf reader, it first extracts those pages to separate images and then calls this function in a loop on each of the pages. so you have the privilege of compressing n_pages images n_pages * 13 times.

this function is used 13 times: in the file reader, in the mcp result handler, in the bash tool, and in the clipboard handler - each of which has their entire own surrounding image handling routines that are each hundreds of lines of *similar but still very different* fallback code to do exactly the same thing.

so that's where all the five hundred thousand lines come from - fallback conditions and then more fallback conditions to compensate for the variable output of all the other fallback conditions. thirteen butts pooping, back and forth, forever.

here, if i fold all the return blocks and decrease my font size ...

2026-04-01T10:02:31Z

In reply to nevent1q…apxz
_________________________

here, if i fold all the return blocks and decrease my font size as small as it goes i can fit all the compression invocations in *the first of three* top-level compression fallback trees in a single screenshot, but since it is so small i just have to circle them in red like it's a football diagram.

this function is named "maybeResizeAndDownsampleImageBuffer" and boy that is a hell of a maybe!

holy shit there's another entire fallback tree before this ...

2026-04-01T09:51:09Z

In reply to nevent1q…hhah
_________________________

holy shit there's another entire fallback tree before this one, that's actually an astounding *twenty two times* it's possible to compress an image across *nine* independent conditional legs of code in a *single* api call. i can't even screenshot this, the spaghetti is too powerful

for those keeping score at home, we have the opportunity to ...

2026-04-01T09:45:46Z

In reply to nevent1q…ujp4
_________________________

for those keeping score at home, we have the opportunity to re-compress the same image *nine times*

If you are reading an image and near your estimated token limit, ...

2026-04-01T09:43:27Z

In reply to nevent1q…4ser
_________________________

If you are reading an image and near your estimated token limit, first try to compressImageBufferWithTokenLimit, then if that fails with any kind of error, try and use sharp directly and resize it to 400x400, cropping. finally, fuck it, just throw the buffer at the API.

of course compressImageBufferWithTokenLimit is *also* compression with sharp, and is *also* a series of fallback operations. We start by trying to detect the image encoding that we so painstakingly learned from... the file extension... but if we can't fuck it that shit is a jpeg now.

then, even if it's fine and we don't need to do anything, we still re-compress it (wait, no even though it's named createCompressedImageResult, it does nothing). Otherwise, we yolo our way through another layer of fallbacks, progressive resizing, palletized PNGs, back to JPEG again, and then on to "ultra compressed JPEG" which is... incredibly... *exactly the same as the top-level in-place code in the parent function*

while two of the legs return a createImageReponse, the first leg returns a compressedImageResponse but then unpacks that back into an object literal that's almost exactly the same except we call it type instead of mediaType.

continuing thoughts in: ...

2026-04-01T09:16:58Z

In reply to nevent1q…te94
_________________________

continuing thoughts in: https://neuromatch.social/@jonny/116328409651740378

one thing that is clear from reading a lot of LLM code - and this is obvious from the nature of the models and their application - is that it is big on *the form* of what it loves to call "architecture" even if *in toto* it makes no fucking sense.

So here you have some accessor function isPDFExtension that checks if some string is a member of the set DOCUMENT_EXTENSIONS (which is a constant with a single member "pdf"). That is an extremely reasonable pattern: you have a bunch of disjoint sets of different kinds of extensions - binary extensions, image extensions, etc. and then you can do set operations like unions and differences and intersections and whatnot to create a bunch of derived functions that can handle dynamic operations that you couldn't do well with a bunch of consts. then just make the functional form the standard calling pattern (and even make a top-level wrapper like getFileType) and you have the oft fabled "abstraction." that's a reasonable ass system that provides a stable calling surface and a stable declaration surface. hell it would probably even help the LLM code if it was already in place because it's a predictable rules-based system.

but what the LLMs do is in one narrow slice of time implement the "is member of set {pdf}" version **robustly** one time, and then they implement the regex pattern version **flexibly** another time, and then they implement the any str.endswith() version **modularly** another time, and so on. Of course usually in-place, and different file naming patterns are part of the **architecture** when it's feeling a little too spicy to stay in place.

This is an important feature of the gambling addiction formulation of these tools: only the margin matters, the last generation. it carefully regulates what it shows you to create a space of potential reward and closes the gap. It's episodic TV, gameshows for code: *someone* wins every week, but we get cycles in cycles of seeming progression that always leave one stone conspicuously unturned. The intermediate comments from the LLM where it discovers prior structure and boldly decides to forge ahead brand new are also part of the reward cycle: we are going *up, forever.* cleaning up after ourselves is *down there.*

Tech debt is when you have banked a lot of story hours and are finally due for a big cathartic shift and set the LLM loose for "the big cleanup." this is also very similar to the tools that scam mobile games use (for those who don't know me, i spent roughly six months with daily scheduled (carefully titrated lmao) time playing the worst scam mobile chum games i could find to try and experience what the grip of that addition is like without uh losing a bunch of money).

Unlike slot machines or table games, which have a story horizon limited by how long you can sit in the same place, mobile games can establish a space of play that's broader and more continuous. so they always combine several shepherd's tone reward ladders at once - you have hit the session-length intermittent reward cap in the arena modality which gets you coins, so you need to go "recharge" by playing the versus modality which gets you gems. (Typically these are also mixed - one modality gets you *some proportion* of resource x, y, z, another gets you *a different proportion*, and those are usually unstable).

Of course it doesn't fucking matter what the modality is. they are all the same. in the scam mobile games sometimes this is *literally* the case, where if you decompile them, they have different menu wrappings that all direct into the same scene. you're still playing the game, that's all that matters. The goal of the game design is to chain together several time cycles so that you can win->lose in one, win->lose in another... and then by the time you have made the rounds you come back to the first and you are refreshed and it's new. So you have momentary mana wheels, daily earnings caps, weekly competitions, seasonal storylines, and all-time leaderboards.

That's exactly the cycle that programming with LLMs tap into. You have momentary issues, and daily project boards, and weekly sprints, and all-time star counts, and so on. Accumulate tech debt by new features, release that with "cleanup," transition to "security audit." Each is actually the same, but the present themselves as the continuation of and solution to the others. That overlaps with the token limitations, and the claude code source is actually littered with lots of helpful panic nudges for letting you know that you're reaching another threshold. The difference is that in true gambling the limit is purely artificial - the coins are an integer in some database. with LLMs the limitation is physical - compute costs fucking money baby. but so is the reward. it's the same in the game, and the whales come around one way or another.

A series of flashing lights and pictures, set membership, regex, green checks, the feeling of going very fast but never making it anywhere. except in code you *do* make it somewhere, it's just that the horizon falls away behind you and the places you were before disappear. and sooner or later only anthropic can really afford to keep the agents running 24/7 tending to the slop heap - the house always wins.

quoting
note1lc3…ygrk

this is super minor, and i've seen this in human code plenty of times, but this is the norm of this app verging on being formal code style.

so you have a file reading tool, you need to declare what kinds of file extensions it supports. that's very normal. claude code takes the interesting strategy of defining what extensions it *doesn't* read. that's also defensible, there are a zillion text extensions. i've seen strategies that just read an initial range of bytes and see if some proportion of them are ascii or unicode.

where does this get declared? why of course in as many places as there are rules. hasBinaryExtension() comes from constants/files.ts, isPDFExtension() comes from utils/pdfUtils.ts (which checks if the file extension is a member of the set {'pdf'}), and IMAGE_EXTENSIONS is declared in the FileReadTool.ts file.

of course, elsewhere we also have IMAGE_EXTENSION_REGEX from utils/imagePaste (sometimes used directly, other times with its wrapper isImageFilePath), TEXT_FILE_EXTENSIONS in utils/claudemd.ts. and we also have many inlined mime type lists and sets. and all of these somehow manage to implement the check differently. so rather than having, for example, a getFileType() function, we have both exactly the same and *kinda the same* logic redone in place every time it is done, which is hundreds of times. but that's none of my business, that's just how code works now and i need to get with the times.

i love this. there's a mechanism to slip secret messages to ...

2026-04-01T08:28:29Z

In reply to nevent1q…ef09
_________________________

i love this. there's a mechanism to slip secret messages to the LLM that it is told to interpret as system messages. there is no validation around these of any kind on the client, and there doesn't seem to be any differentiation about location or where these things happen, so that seems like a nice prompt injection vector. this is how claude code reminds the LLM to not do a malware, and it's applied by just string concatenation. i can't find any place that gets stripped aside from when displaying output. it actually looks like all the system reminders get catted together before being send to the API. neat!

this is super minor, and i've seen this in human code plenty ...

2026-04-01T08:04:24Z

In reply to nevent1q…zv58
_________________________

this is super minor, and i've seen this in human code plenty of times, but this is the norm of this app verging on being formal code style.

so you have a file reading tool, you need to declare what kinds of file extensions it supports. that's very normal. claude code takes the interesting strategy of defining what extensions it *doesn't* read. that's also defensible, there are a zillion text extensions. i've seen strategies that just read an initial range of bytes and see if some proportion of them are ascii or unicode.

where does this get declared? why of course in as many places as there are rules. hasBinaryExtension() comes from constants/files.ts, isPDFExtension() comes from utils/pdfUtils.ts (which checks if the file extension is a member of the set {'pdf'}), and IMAGE_EXTENSIONS is declared in the FileReadTool.ts file.

of course, elsewhere we also have IMAGE_EXTENSION_REGEX from utils/imagePaste (sometimes used directly, other times with its wrapper isImageFilePath), TEXT_FILE_EXTENSIONS in utils/claudemd.ts. and we also have many inlined mime type lists and sets. and all of these somehow manage to implement the check differently. so rather than having, for example, a getFileType() function, we have both exactly the same and *kinda the same* logic redone in place every time it is done, which is hundreds of times. but that's none of my business, that's just how code works now and i need to get with the times.

i sort of love how LLM comments sometimes tell entire stories ...

2026-04-01T07:45:25Z

In reply to nevent1q…fc8y
_________________________

i sort of love how LLM comments sometimes tell entire stories that nobody asked. claude code even has specific system prompt language for this, but they always end up making comments about what something used to do like "now we do x instead of y" like... ok? that is why i am reading current version of code!

so claude code is just not capable of rescuing itself from its own context - if an entry in its context window throws an error, it just keep throwing that error forever until you clear it. good stuff.

(and, of course we read the entire file before checking this, rather than just reading the first 5 bytes)

If i can slip in a quick PSA while my typically sleepy ...

2026-04-01T03:17:30Z

In reply to nevent1q…d67v
_________________________

If i can slip in a quick PSA while my typically sleepy notifications are exploding, these are all very annoying things to say and you might want to reconsider whether they're worth ever saying in a reply directed at someone else - who are they for? what do they add? <li>"why are you surprised"/"even worse than <code>{thing}</code> itself is people being surprised at <code>{thing}</code>": unless the person is saying "i am surprised by this" they are likely not surprised by the thing. just saying something doesn't mean you are surprised by it, and people talking about something usually have paid attention to it before the moment you are encountering them. this is pointless hostility to people who are saying something you supposedly agree with so much that you think everyone should already believe it</li><li>"it's always been like this": slightly different than above. unless someone is saying "this is literally new and nothing like this has happened before" or you are adding actual historical context that you know for sure they don't already know, you're basically saying "hey did you know this thing you care enough about to be paying attention to and talking about frequently has happened before now as well." this is so easy to frame in a way that says "yes and" rather than "i assume you dont know about the things i know about due to being very smart." eg. "dang not again, they keep doing <code>{thing}</code>"</li><li>"<code>{thing}</code> might be bad, but <code>{alternative/unrelated, unmentioned, non-mutually exclusive thing}</code> is even worse": multiple things can be bad at the same time and not mentioning something does not mean i don't think it's also bad</li><li>"funny how people who think <code>{thing}</code> is bad also think <code>{alternative/unrelated, unmentioned thing}</code> is good": closely related to the above, just because you have binarized your thinking does not mean everyone else has.</li>

anyway if the mental image you are conjuring for your interlocuters positions them as always knowing less than you by default, that might be something to look into in yourself!

(those numbers are also totally fucking wrong, the query engine ...

2026-04-01T02:22:28Z

In reply to nevent1q…0qxk
_________________________

(those numbers are also totally fucking wrong, the query engine is not 46ksloc, i have no idea what those numbers correspond to, as far as i can tell "nothing" and this is just hallucinated dogshit that is what i guess passes for high quality public comment nowadays)

So ars (first pic) ran a piece similar to the one that the rest ...

2026-04-01T02:15:22Z

In reply to nevent1q…7xet
_________________________

So ars (first pic) ran a piece similar to the one that the rest of the tech journals did "claude code source leaked, whoopsie! programmers are taking a look at it, some are finding problems, but others are saying it's really awesome."

like "inspiring and humbling" is *not the word dog*. I don't spend time on fucking twitter anymore so i don't hang around people who might find this fucking dogshit tornado inspiring and humbling. Even more than the tornado, i am afraid of the people who look at the tornado and say "that's super fucking awesome, i can only hope to get sucked up and shredded like lettuce in a vortex of construction debris one day"

the (almost certainly generated) blog post is the standard kind of vacuuous linkedin shillposting that one has come to expect from the gambling addicts, but i think it's illustrative: the only thing they are impressed with is the number of lines. 500k lines of code for a graph processing loop in a TUI is NOT GOOD. The only comments they make on the actual code itself is "heavily architected" (what in the fuck does that mean), "modular" (no the fuck it is not), and it runs on bun rather than node (so??? they own it!!!! of course it does!!!). and then the predictable close of "oh and also i'm also writing exactly the same thing and come check out mine"

the only* people this shit impresses are people who don't know what they're looking at and just appreciate the *size* of it all, or have a bridge to sell.

* I got in trouble last time i said "only" - nothing in nature is ever "only this or that," i am speaking emphatically and figuratively. there are other kinds of people who are impressed with LLMs too. Please also note that my anger is directed towards the grifters profiting off of it and people who are pouring gas on the fire and enabling this catastrophe by giving it intellectual, social, and other cover. I know there are folks who just chat with the bots because they need someone to talk to, etcetera and so on. people in need who are just making use of whatever they can grab to hang on are not who I am criticizing, and never are.

OK i can't focus on work and keep looking at this repo. So ...

2026-04-01T01:30:45Z

In reply to nevent1q…gllf
_________________________

OK i can't focus on work and keep looking at this repo.

So after every "subagent" runs, claude code creates *another* "agent" to check on whether the first "agent" did the thing it was supposed to. I don't know about you but i smell a bit of a problem, if you can't trust whether one "agent" with a very big fancy model did something, how in the fuck are you supposed to trust another "agent" running on the smallest crappiest model?

That's not the funny part, that's obvious and fundamental to the entire show here. HOWEVER RECALL [the above JSON Schema Verification thing](https://neuromatch.social/@jonny/116325123136895805 ) that is unconditionally added onto the end of every round of LLM calls. the mechanism for adding that hook is... JUST FUCKING ASKING THE MODEL TO CALL THAT TOOL. second pic is registering a hook s.t. "after some stop state happens, if there isn't a message indicating that we have successfully called the JSON validation thing, prompt the model saying "you must call the json validation thing"

this shit sucks so bad they can't even ***CALL THEIR OWN CODE FROM INSIDE THEIR OWN CODE.***

Look at the comment on pic 3 - "e.g. agent finished without calling structured output tool" - that's common enough that they have a whole goddamn error category for it, and the way it's handled is by just pretending the job was cancelled and nothing happened.

from @npub13ux…k0ef [over ...

2026-03-31T20:43:55Z

In reply to nevent1q…gjt8
_________________________

from Su-Shee (npub13ux…k0ef) [over here](https://ohai.social/@sushee/116325702070975973 ), (can't attach images in quotes) and apparently discussed on HN so i'm late, but...

They REALLY ARE using REGEX to detect if a prompt is negative emotion. dogs you are LITERALLY RIDING ON A LANGUAGE MODEL what are you even DOING

reminder that anthropic ran (and is still running) an ENTIRE AD ...

2026-03-31T20:27:11Z

In reply to nevent1q…jzrm
_________________________

reminder that anthropic ran (and is still running) an ENTIRE AD CAMPAIGN around "Claude code is written with claude code" and after the source was leaked that has got to be the funniest self-own in the history of advertising because OH BOY IT SHOWS.

it's hard to get across in microblogging format just how big of a dumpster fire this thing is, because what it "looks like" is "everything is done a dozen times in a dozen different ways, and everything is just sort of jammed in anywhere. to the degree there is any kind of coherent structure like 'tools' and 'agents' and whatnot, it's entirely undercut by how the entire rest of the code might have written in some special condition that completely changes how any such thing might work." I have read *a lot* of unrefined, straight from the LLM code, and Claude code is a masterclass in exactly what you get when you do that - an incomprehensible mess.