So there I was, knees deep in day 3 of my Claude Code source review, and I got curious about something.
What exactly is the system doing to manage safety, and when does safety-shaped context get injected into the agent?
I decided it would be fun to dig through the leaked Claude Code source, the roughly 512k-line TypeScript harness exposed in the March 31 npm sourcemap incident, and it turns out there are multiple mechanisms that can place safety-shaped text into model-visible context outside the normal visible chat flow.
Several layers, not one injector
First observation: this does not look like some giant real-time sentiment analysis engine hovering over every conversation. There is some stuff in there that looks experimental and is not part of the mainline build, for example a heuristics-based frustration detector. But that piece does not appear to be part of the compiled version of the app.
What the code suggests is that policy-shaped context can reach the model through several layers of the harness. Part of it is built into the base prompt from the start. Another part travels through hidden reminders and meta-message machinery the user never sees as normal chat. Then tool use adds its own layer, especially around file reads, while permission and risk decisions can be shaped in parallel by separate classifier logic.
In other words, you don't need one monolithic secret injector for that effect to be real system behavior. All you have to do is build enough layered control surfaces shaping model-visible context in ways the user cannot directly see.
That’s the part I think people have been too quick to wave away.
There have been widespread reports of Claude seeming to take a hard safety turn mid-conversation. In some cases, people have posted evidence that made it look like the model was responding to invisible policy-shaped text.
The standard reaction has been to dismiss them as confused, conspiratorial, or easily fooled by a hallucinating model.
This leak does not validate every maximal version of those claims.
But it does show enough real harness machinery to make some of the broader reports plausible.
To be fair, not all of this is new, and some of it has already been discussed at a high level in Anthropic’s documentation. But I think the Claude Code leak is the first time we’ve really gotten to watch the machine in action.
The governance pattern
For builders, that is the real takeaway.
The safety stack here looks less like one obvious classifier bolted onto an SDK and more like a distributed governance pattern operating across prompts, hidden context, tool serialization, permissioning, and provider-side refusals.
And that is a much more useful place to start thinking.