What I Found Inside Claude Code

HomePapersPostsContact
by Martin Monperrus

TLDR: Claude Code is a frontier harness with a huge market share in coding agents. Claude Code is also an proprietary 227 MB binary that contains lots of cool, suprising and sometimes dirty features? Here is a running log of what I found by looking, with the method for each so you can reproduce it. 🔍

1. ugrep in your process list is Claude Code 🐍

I saw ugrep in htop. I never installed ugrep.

It is Claude Code. The CLI binary embeds three search tools and launches them under their own names:

$ B=.../node_modules/@anthropic-ai/claude-code/bin/claude.exe
$ (exec -a ugrep "$B" --version)   # ugrep 7.8.4   (BSD-3-Clause)
$ (exec -a bfs   "$B" --version)   # bfs 4.1.1
$ (exec -a rg    "$B" --version)   # ripgrep 14.1.1

That is why you see it in htop: exec -a sets argv[0], so the name in the process table is a label, not a path.

The dispatch happens in the shell snapshot that every Claude Code Bash call sources, ~/.claude/shell-snapshots/snapshot-bash-*.sh. It defines bash functions named grep and find that shadow your machine’s binaries:

function grep {
  ...
  (exec -a ugrep "$_cc_bin" -G --ignore-files --hidden -I \
     --exclude-dir=.git --exclude-dir=.svn --exclude-dir=.hg \
     --exclude-dir=.bzr --exclude-dir=.jj --exclude-dir=.sl "$@")
}

Consequences worth knowing:

2. The harness injects a lot of things that are not your prompt 📥

We all know the system prompt. There is way more than it.

Method: point ANTHROPIC_BASE_URL at a local HTTP server that logs the raw POST body and replies with a canned SSE stream, then run claude -p "reply with just OK". You get the exact /v1/messages body.

What comes back: Injected context is wrapped in <system-reminder>…</system-reminder> tags and split across two roles. The user role carries conversation-scoped facts: CLAUDE.md, recalled memories, your email address, git status, the commit-attribution rule. A second, non-standard system message carries process-scoped facts: cwd, OS, model identity, the date, and the rosters of available agents and skills.

3. Only one thing is injected on every single turn: the token count ⏱️

Over 2494 transcripts and 39 068 injection events, exactly one injection is per-turn: total_tokens_reminder, the <total_tokens>N tokens left</total_tokens> line. Median 1.00 per assistant request. Everything else is event-driven:

type                             total   sess  med/req
total_tokens_reminder            21248    370     1.00
batching_reminder_sent              79     19     0.67
task_reminder                     6051   1088     0.12
diagnostics                       2290    480     0.08
skill_listing                     2054   2030     0.07

Of everything the harness could spend tokens on every single request, Anthropic picked the budget. That is token awareness — telling a model, inside its own context, how much it has left — and it measurably changes behaviour: https://www.monperrus.net/martin/token-awareness

Two details in how it is framed. The model is told what remains, never what it has spent — a countdown, not a meter. And the number arrives mid-turn, between a tool result and the next request, so it lands while the model is working, not while it is planning.

It is recent: total_tokens_reminder starts at CLI 2.1.232 (August 2026). Before that, Claude Code flew blind.

4. Plan mode is a system prompt, not a reminder 📋

5. Commit attribution is prompted, not learned ✍️

Co-Authored-By: Claude … in your commits is not a habit from pretraining. It is a string in claude.exe, injected on every request:

let r = `Co-Authored-By: ${eCs(e)} <noreply@anthropic.com>`

eCs(e) is the model display name. Mine says Claude Opus 5 (1M context); another session in my corpus says Claude Sonnet 5. Pretraining cannot know which model is answering. Only a template can.

It is not in the system prompt either. It arrives as a <system-reminder> in the user turn, written as a delta — “from here on” — so each copy supersedes the last. You cannot argue it away: whatever you say is just earlier context.

Anthropic hardened it against precisely that attempt. Three clauses in the binary, picked by where the setting comes from:

"this replaces Claude Code's own earlier attribution guidance,
 such as a previous copy of this reminder"

"the user's own instructions … take precedence over this reminder,
 but do not add attribution lines this reminder leaves out"

"these lines are set by the user's organization's managed settings
 and apply even if the user's instructions say otherwise"

A precedence lattice, for a git trailer. The first kills stale copies of itself. The second concedes to the user — but only downward: remove lines, never add omitted ones. The third revokes even that for enterprises. A fourth variant splits the clause when only one of the two lines is org-managed.

The escape is configuration, not conversation:

{ "attribution": { "commitTrailers": false } }

(includeCoAuthoredBy: false still works, marked “Deprecated: Use attribution instead”. Under managed settings, neither is yours.)

The lesson generalises: harness-injected instructions are not negotiable in-band. Arguing with the model is arguing with the wrong layer.

6. Coding agents have a completely wrong sense of time ⏳

Claude Code estimates in human time and executes in machine time. “3-4 weeks” becomes eleven minutes. I call it the anthropocentric time bias.

Two independent causes: the training corpus is entirely human throughput (pre-2022 GitHub prices features in human-weeks), and a transformer’s positional encoding represents token order, not elapsed wall-clock time — there is no proprioception of inference speed. The second is why the first cannot be prompted away.

The fix that works is to ban the unit. In CLAUDE.md: never estimate in days, weeks or months; estimate in files touched, tool calls, and risk of breaking existing behavior. Effort is real; hours are the wrong projection of it.

Full post, with the literature: https://www.monperrus.net/martin/coding-agents-sense-of-time

7. Token counts are reconstructible offline 🧮

The billed prompt_tokens for an entire agentic trajectory can be predicted exactly, offline, without calling the API.

Content costs come from the public tokenizer. What has to be reverse-engineered is the structural overhead the Messages API adds around it: a tools preamble costs 805 tokens, a tool_use block at index 0 costs 47 + tok(name), a tool_result costs tok(" + s + ") − 3, a user message following a non-user message costs 6 + content, and so on. Each constant was measured against the live API by differential probing.

Full Post to come.

Method, in general

Four techniques cover almost everything above:

  1. Intercept the wire. ANTHROPIC_BASE_URL at a local server that logs and replies with canned SSE. This is the only way to see the real request.
  2. Read the transcripts. ~/.claude/projects/**/*.jsonl records harness injections as attachment entries. A corpus of your own sessions is a free longitudinal dataset of harness behaviour, version-stamped — but see §2: it stores a small and unrepresentative slice of what was actually sent.
  3. Read the shell snapshot. ~/.claude/shell-snapshots/ shows exactly what the agent’s Bash environment has been rewritten to do.
  4. Probe the binary. exec -a <name> claude.exe --version enumerates what it has swallowed. Plain grep -a on the binary recovers prompt templates verbatim — the harness’s instructions to the model are string literals, and they are all in there.

And one standing caveat: this is one user’s corpus on one machine. Mechanisms and version onsets are harness properties and generalise; frequencies reflect my own usage.

Created on September 15, 2026