原汁原昧 Claude Code 可运行,可构建, 可调试版; 生产级工程化, 企业级可靠性; 安全无毒, 内存泄露修复
Go to file
James F 8a301dcf74 security: close telemetry leak in preconnectAnthropicApi startup path (#1253)
🔒 Security Discovery: Un-gated outbound connection bypasses privacy controls

Summary
-------
preconnectAnthropicApi() unconditionally sends a TCP+TLS handshake to
api.anthropic.com on every ccb startup — even when the user has explicitly
disabled all non-essential traffic via CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1
or DISABLE_TELEMETRY=1.

This is the LAST un-gated outbound connection in the entire startup path.
Every other telemetry sink (Sentry, Langfuse, OpenTelemetry, GrowthBook,
1P Event Logger, Datadog, BigQuery, etc.) already respects the
privacyLevel module's isEssentialTrafficOnly() gate. This one did not.

Impact
------
While the preconnect is a HEAD request with no payload, the connection
itself leaks the client's IP address and session timing to Anthropic's
infrastructure. For privacy-conscious users and enterprise deployments
that have disabled telemetry, this constitutes an unexpected data leak.

Fix
---
Add isEssentialTrafficOnly() check at the function entry, consistent
with every other privacy-gated code path in the codebase. The
privacyLevel module is already imported by init.ts and 12+ other
modules — no new dependencies.

Verification
------------
Reproduced and verified via strace on Linux (aarch64):

  # Before fix
  $ strace -f -e connect ccb -p <<< 'hello'
  connect(16, sin_addr=inet_addr("160.79.104.10"), sin_port=htons(443)) = 0
  # ↑ connector to api.anthropic.com despite CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1

  # After fix
  $ strace -f -e connect ccb -p <<< 'hello'
  # ↑ zero remote TCP connections — all traffic to localhost only

Changes: 1 file, +5 lines (import + gate)
2026-06-07 01:46:17 +08:00
.claude/agents security: close telemetry leak in preconnectAnthropicApi startup path (#1253) 2026-06-07 01:46:17 +08:00
.githooks claude-code with OpenAI mode fix (#102) 2026-04-04 10:54:13 +08:00
.husky chore: add husky pre-commit hook with lint-staged 2026-06-04 01:45:49 +08:00
.vscode fix: 删除 debug 限制 2026-04-07 16:13:15 +08:00
docs docs: 添加 ToolSearch 设计指南 + 禁用 turn-zero 工具推荐弹窗 2026-06-07 00:56:16 +08:00
learn Learn/20260401 (#39) 2026-04-02 21:47:49 +08:00
packages docs: 添加 ToolSearch 设计指南 + 禁用 turn-zero 工具推荐弹窗 2026-06-07 00:56:16 +08:00
scripts feat: ACP 协议版本 remote control (#293) 2026-06-04 23:53:06 +08:00
spec/feature_20260502_F001_fork-agent-redesign feat: fork-agent-redesign — 新增 AgentTool fork 参数与 spec 设计文档 2026-06-04 13:01:20 +08:00
src security: close telemetry leak in preconnectAnthropicApi startup path (#1253) 2026-06-07 01:46:17 +08:00
tests feat: full merge of f2e9af49 autonomy PR #386 — source + tests 2026-06-04 20:56:53 +08:00
vendor feat: enable /voice mode with native audio binaries 2026-04-03 21:14:44 +08:00
.dockerignore feat: 支持自托管的 remote-control-server (#214) 2026-04-09 17:40:50 +08:00
.editorconfig feat: 配置 Biome 代码格式化与校验工具 2026-04-01 01:40:27 +08:00
.gitignore feat(remote-control): 优化 Web 展示、状态同步与桥接控制流程 (#288) 2026-06-04 23:51:54 +08:00
.impeccable.md feat: ACP 协议版本 remote control (#293) 2026-06-04 23:53:06 +08:00
biome.json chore: 调整配置 2026-04-01 09:52:43 +08:00
build.ts fix: copy ripgrep vendor binary to both dist/ and dist-nosplit/ 2026-06-06 08:30:30 +08:00
bun.lock fix: 重新生成 bun.lock 以包含 React Web UI 新依赖 2026-06-05 00:35:30 +08:00
bunfig.toml feat: 搭建单元测试基础设施 — Bun test runner + 示例测试 2026-04-01 02:08:38 +08:00
CLAUDE.md docs: 添加 ToolSearch 设计指南 + 禁用 turn-zero 工具推荐弹窗 2026-06-07 00:56:16 +08:00
CODEBASE_REPORT.md feat: pull in Vite build system + complete packages/builtin-tools/ 2026-06-01 18:18:03 +08:00
contributors.svg docs: update contributors 2026-06-04 16:04:09 +00:00
DEV-LOG.md feat: restore daemon supervisor and remoteControlServer command (#170) 2026-04-07 15:36:29 +08:00
Friends.md docs: 新增留影文档 2026-04-06 11:04:13 +08:00
knip.json feat: 添加 knip 冗余代码检查工具 2026-04-01 04:57:34 +08:00
mint.json feat: auto dream 开启 2026-04-04 16:28:09 +08:00
package.json feat: 恢复 Chrome MCP 浏览器自动化支持 2026-06-04 17:27:58 +08:00
README_CCB.md docs: add CC_Pure README, preserve original as README_CCB.md 2026-06-02 15:33:10 +08:00
README_EN.md 更新大量 tsx 原始文件; 已经迁移 login panel; 部分 (#121) 2026-04-04 23:24:27 +08:00
README.md docs: v2.3.0 版本表,统计 52→59,SSH/BRIDGE 描述更新 2026-06-05 00:07:21 +08:00
RELEASE.md docs: update RELEASE.md with v1.1.0 changelog 2026-06-01 21:26:33 +08:00
SECURITY.md docs: update SECURITY.md with Phase 4 completion 2026-06-03 19:51:37 +08:00
tsconfig.base.json fix: add tsconfig.base.json and revert strict mode for CC_Pure compatibility 2026-06-01 23:51:07 +08:00
tsconfig.json fix(ci): add @ant/model-provider to tsconfig paths 2026-06-03 12:29:33 +08:00
V6.md Revert "docs: 更新 README,新增 Run.ps1/TODO.md,删除 V6.md" 2026-04-04 23:31:21 +08:00
vite.config.ts chore: remove skillLearning subsystem — unused, incompatible with CCP telemetry approach 2026-06-06 22:27:08 +08:00
YYMa <2942204237@qq.com> chore: merge upstream cleanup — 536 stubs + 17 dead files + 4 as any fixes 2026-06-06 21:12:01 +08:00

Claude Code Best V5 (CCB)

GitHub Stars GitHub Contributors GitHub Issues GitHub License Last Commit Bun

Which Claude do you like? The open source one is the best.

A reverse-engineered / decompiled source restoration of Anthropic's official Claude Code CLI tool. The goal is to reproduce most of Claude Code's functionality and engineering capabilities. It's abbreviated as CCB.

Documentation (Chinese) — PR contributions welcome.

Sponsor placeholder.

  • v1: Basic runability and type checking pass
  • V2: Complete engineering infrastructure
    • Biome formatting may not be implemented first to avoid code conflicts
    • Build pipeline complete, output runnable on both Node.js and Bun
  • V3: Extensive documentation and documentation site improvements
  • V4: Large-scale test suite for improved stability
    • Buddy pet feature restored Docs
    • Auto Mode restored Docs
    • All features now configurable via environment variables instead of bun --feature
  • V5: Enterprise-grade monitoring/reporting, missing tools补全, restrictions removed
    • Removed anti-distillation code
    • Web search capability (using Bing) Docs
    • Debug mode support Docs
    • Disabled auto-updates
    • Custom Sentry error reporting support Docs
    • Custom GrowthBook support (GB is open source — configure your own feature flag platform) Docs
    • Custom login mode — configure Claude models your way
  • V6: Large-scale refactoring, full modular packaging
    • V6 will be a new branch; main branch will be archived as a historical version

I don't know how long this project will survive. Star + Fork + git clone + .zip is the safest bet.

This project updates rapidly — Opus continuously optimizes in the background, with new changes almost every few hours.

Claude has burned over $1000, out of budget, switching to GLM to continue; @zai-org GLM 5.1 is quite capable.

Quick Start

Prerequisites

Make sure you're on the latest version of Bun, otherwise you'll run into all sorts of weird bugs. Run bun upgrade!

  • Bun >= 1.3.11
  • Standard Claude Code configuration — each provider has its own setup method

Install

bun install

Run

# Dev mode — if you see version 888, it's working
bun run dev

# Build
bun run build

The build uses code splitting (build.ts), outputting to dist/ (entry dist/cli.js + ~450 chunk files).

The build output runs on both Bun and Node.js — you can publish to a private registry and run directly.

If you encounter a bug, please open an issue — we'll prioritize it.

First-time Setup /login

After the first run, enter /login in the REPL to access the login configuration screen. Select Anthropic Compatible to connect to third-party API-compatible services (no Anthropic account required).

Fields to fill in:

Field Description Example
Base URL API service URL https://api.example.com/v1
API Key Authentication key sk-xxx
Haiku Model Fast model ID claude-haiku-4-5-20251001
Sonnet Model Balanced model ID claude-sonnet-4-6
Opus Model High-performance model ID claude-opus-4-6
  • Tab / Shift+Tab to switch fields, Enter to confirm and move to the next, press Enter on the last field to save
  • Model fields auto-fill from current environment variables
  • Configuration saves to ~/.claude/settings.json under the env key, effective immediately

You can also edit ~/.claude/settings.json directly:

{
  "env": {
    "ANTHROPIC_BASE_URL": "https://api.example.com/v1",
    "ANTHROPIC_AUTH_TOKEN": "sk-xxx",
    "ANTHROPIC_DEFAULT_HAIKU_MODEL": "claude-haiku-4-5-20251001",
    "ANTHROPIC_DEFAULT_SONNET_MODEL": "claude-sonnet-4-6",
    "ANTHROPIC_DEFAULT_OPUS_MODEL": "claude-opus-4-6"
  }
}

Supports all Anthropic API-compatible services (e.g., OpenRouter, AWS Bedrock proxies, etc.) as long as the interface is compatible with the Messages API.

Feature Flags

All feature toggles are enabled via FEATURE_<FLAG_NAME>=1 environment variables, for example:

FEATURE_BUDDY=1 FEATURE_FORK_SUBAGENT=1 bun run dev

See docs/features/ for detailed descriptions of each feature. Contributions welcome.

VS Code Debugging

The TUI (REPL) mode requires a real terminal and cannot be launched directly via VS Code's launch config. Use attach mode:

Steps

  1. Start inspect server in terminal:

    bun run dev:inspect
    

    This outputs an address like ws://localhost:8888/xxxxxxxx.

  2. Attach debugger from VS Code:

    • Set breakpoints in src/ files
    • Press F5 → select "Attach to Bun (TUI debug)"

Contributors

Star History

Star History Chart

License

This project is for educational and research purposes only. All rights to Claude Code belong to Anthropic.