{"schemaVersion":"1.0","publication":{"slug":"pivot-claude-code","name":"Claude Code Review","description":"Workflows, releases, and field notes for Anthropic's coding agent.","audience":"Developers and teams adopting Claude Code.","geography":null},"edition":{"id":"61d996c5-a471-42b0-b200-dcba9460f529","date":"2026-10-21","status":"locked","createdAt":"2026-10-20T15:36:11.780Z","storyCount":6,"newsletterSubject":"Hand a long coding job to Claude from your phone and let it keep running with your laptop closed"},"updatedAt":"2026-10-21T15:01:50.771Z","stories":[{"id":"f395ea56-b32b-4451-a07f-f81e21552e29","title":"Hand a long coding job to Claude from your phone and let it keep running with your laptop closed","dek":"A cloud session runs Claude Code on a remote computer instead of yours, so a big job, such as a migration that moves your code to a new setup, carries on while you are away.","bodyMd":"Claude Code's cloud sessions let you give Claude a task, close your laptop and come back to finished work. A Claude video published 2026-10-14 shows the loop: hand off a task, shut the lid, then open the Claude app on a phone. Claude has kept working and has a question waiting. Answer it, and the job continues even though the laptop has been asleep the whole time.\n\nThe video gives a plain description of how cloud sessions work and when to pick one.\n\nIn a cloud session, Claude clones your repository from GitHub into a virtual machine, a remote computer. It works there on its own branch. Because the work lives on that remote machine, your laptop does not need to stay awake.\n\nYou can start a session from the desktop app, the browser, the terminal, your phone or Slack. The video points to two cases. One is a task that will take longer than you will be at your laptop, such as a large refactor (reorganising code without changing what it does) or a migration. The other is an idea that arrives while you are away from your computer. One example the video gives is to start a task before leaving work for the day and look at the result in the morning, without keeping your laptop awake.\n\nEach session has its own branch, so you can run several at once without managing multiple work trees. A work tree is a separate checked-out copy of your repo, which is what you would otherwise need to keep parallel jobs from colliding. To try it, start a cloud session from any of the entry points above and give Claude the task.\n\nTwo open items turn up alongside the video. One write-up of building a Laravel app in cloud sessions with a $250 credit covers what worked and what broke, and its author says they still prefer their laptop. Separately, whether web cloud sessions run slower than local Claude Code, and whether they use more tokens, is a question the sources raise but do not answer.","status":"published","storyType":"news","category":"Workflow","clusterKey":"claude-code-cloud-sessions","slug":"hand-a-long-coding-job-to-claude-from-your-phone-and-let-it-keep-running-f395ea","url":"https://claudecodereview.ai/a/hand-a-long-coding-job-to-claude-from-your-phone-and-let-it-keep-running-f395ea/","relayUrl":"https://relaygrid.com/publications/pivot-claude-code/stories/f395ea56-b32b-4451-a07f-f81e21552e29","role":"lead","position":0,"imageStatus":"ready","imageUrl":"https://media.pivotnews.ai/brands/claude-code-review/articles/hand-a-long-coding-job-to-claude-from-your-phone-and-let-it-keep-running-f395ea/b0fff6a087db07fa-a068447bd05c7bcd/web_hero.webp","imageAlt":"A diagram showing a central remote server pillar maintaining a code branch while a separate, detached laptop icon remains inactive.","createdAt":"2026-10-15T09:06:02.449Z","updatedAt":"2026-10-15T09:30:25.803Z","sources":[{"role":"primary","title":"Coding on the go with Claude Code","url":"https://www.youtube.com/watch?v=nJMwXtD56mA","sourceName":"Claude","author":"Claude","publishedAt":"2026-10-14T19:32:51Z"},{"role":"supporting","title":"What I Learned From My First Claude Code Cloud Sessions","url":"https://medium.com/@arena.alberto/what-i-learned-from-my-first-claude-code-cloud-sessions-102a72590fc6?source=rss------claude_code-5","sourceName":"Alberto Arena","author":"Alberto Arena","publishedAt":"2026-10-15T06:30:57Z"},{"role":"supporting","title":"CC Cloud session vs CC locally","url":"https://reddit.com/r/ClaudeCode/comments/1x641l6/cc_cloud_session_vs_cc_locally","sourceName":"/u/Working_Ninja632","author":"/u/Working_Ninja632","publishedAt":"2026-10-14T21:44:54Z"}]},{"id":"64dded29-6408-4526-8de4-ef0124e02ed2","title":"Code Review leaves preview and reviews pull requests in repositories admins select","dek":"Anthropic's Code Review is now a finished, supported feature on Team and Enterprise plans rather than an early test version, and admins choose which repositories (the shared folders where a project's code lives) it covers and how deep each review goes. Pull request means a proposed code change waiting for someone to review and accept it.","bodyMd":"Anthropic has moved Code Review out of research preview. It is now generally available to Claude Team and Enterprise organizations, which means it is a finished, supported feature on those plans rather than an early test version that might change or disappear. Once an admin switches it on and selects repositories, Claude reviews new pull requests (proposed code changes waiting for a teammate to review) in those repositories automatically. Teams that used the preview told Anthropic it was catching real issues before a human reviewer looked at the PR.\n\nAnthropic says most reviews now finish in 6 to 10 minutes, about 3x faster than the roughly 20 minutes they took during the preview. It also says the findings are concise: each one states the problem, what triggers it, and the fix in a few sentences. The company runs Code Review on its own pull requests, and says preview users wanted reviews that were quieter, sized to each change, and faster.\n\nThe main new control is depth. Admins choose Quick, Standard (the default) or Deep for each repository. A routine codebase can get a quick pass, while the most critical ones get a deep review. Anthropic says every level delivers high-quality reviews.\n\nSetup sits with admins. They enable Code Review in the Claude Code settings on claude.ai, install the GitHub App, and select the repositories to review. Developers then do nothing: once it is enabled, reviews run automatically on new pull requests with no configuration. The docs are at code.claude.com/docs/en/code-review.\n\nThe pitch is about the review queue. Anthropic argues that coding agents keep increasing how fast teams write code while the review bottleneck hasn't eased, and says it made Code Review faster, better at finding the bugs that matter, and easier to tune to each repository.\n\nOn cost, eligible Claude Enterprise organizations can claim at least $10,000 in Code Review credits by January 15, 2027. Credits expire 30 days after they are claimed, and Anthropic's terms apply.","status":"published","storyType":"news","category":"Release","clusterKey":"claude-code-review-generally-available","slug":"code-review-leaves-preview-and-reviews-pull-requests-in-repositories-adm-64dded","url":"https://claudecodereview.ai/a/code-review-leaves-preview-and-reviews-pull-requests-in-repositories-adm-64dded/","relayUrl":"https://relaygrid.com/publications/pivot-claude-code/stories/64dded29-6408-4526-8de4-ef0124e02ed2","role":"item","position":1,"imageStatus":"ready","imageUrl":"https://media.pivotnews.ai/brands/claude-code-review/articles/code-review-leaves-preview-and-reviews-pull-requests-in-repositories-adm-64dded/43433619c2183353-df4a5f94125456ba/web_hero.webp","imageAlt":"Three repository folders funnel into a single stream that splits into three distinct tiers of review depth.","createdAt":"2026-10-16T01:34:17.133Z","updatedAt":"2026-10-16T02:00:44.770Z","sources":[{"role":"primary","title":"[Not Selected] Claude shipped a real feature (code review GA) that vibe coders can use today in their workflow to catch bugs before production","url":"https://claude.com/resources/articles/code-review-is-now-generally-available","sourceName":"Claude Blog","author":"Claude Blog","publishedAt":"2026-10-15T12:00:00Z"}]},{"id":"17e27f93-68a8-46ec-a522-cb07a2a80bc6","title":"Claude Code now gives helper agents your full conversation by default when run from a script","dek":"Claude Code 2.1.302 turns on fork subagents, helpers that inherit the parent conversation, when you run it from a script or command line (the version you drive by typing commands in a terminal) with claude -p instead of typing live, and one setting switches them off.","bodyMd":"Claude Code 2.1.302, published 16 October, turns on fork subagents in more places. A fork subagent (`subagent_type: \"fork\"`) is a helper agent that inherits the parent conversation instead of starting with an empty context. It was already on in the terminal. It is now also on in `claude -p` (the mode that runs Claude Code from a script or command line, with no interactive session), the Agent SDK, the desktop app and VS Code. `claude mcp serve` never offers them, according to the changelog as summarized by WOWHOW.\n\nThe same release changed where helpers run. The desktop app and VS Code now always run the main conversation's subagents in the background, and a subagent's own Agent calls in headless, SDK, desktop and VS Code now run in the foreground by default.\n\nThe practical risk sits with automated jobs. If a CI job or SDK script of yours depended on helpers starting blank, the output can now differ. A fork starts with the parent's context, which can mean more input tokens up front. The changelog does not quantify the cost effect, so the sensible move is to compare a few representative runs, using the cost figure in the SDK result, with and without the change.\n\nTo keep the old behaviour, set the environment variable in your settings:\n\n```json\n{ \"env\": { \"CLAUDE_CODE_FORK_SUBAGENT\": \"0\" } }\n```\n\nTurn it off only if you see a reason, such as a cost spike or a change in output.\n\nA second switch from the same stretch of releases works in the opposite direction on context. `CLAUDE_CODE_DISABLE_FILE_MENTIONS`, added in 2.1.299, makes @ mentions pass the file path instead of the file's contents. It suits a machine with large attachments, where you want Claude to read files itself rather than have each mentioned file loaded up front.\n\nTo get 2.1.302, run `claude update`. Native installs also update in the background, and the update takes effect the next time Claude Code starts. Homebrew, WinGet and Linux package manager installs do not self-update by default, so use your package manager there. `claude --version` confirms where you landed.","status":"published","storyType":"news","category":"Release","clusterKey":"claude-code-2-1-302-fork-subagents-file-mentions","slug":"claude-code-now-gives-helper-agents-your-full-conversation-by-default-wh-17e27f","url":"https://claudecodereview.ai/a/claude-code-now-gives-helper-agents-your-full-conversation-by-default-wh-17e27f/","relayUrl":"https://relaygrid.com/publications/pivot-claude-code/stories/17e27f93-68a8-46ec-a522-cb07a2a80bc6","role":"item","position":2,"imageStatus":"ready","imageUrl":"https://media.pivotnews.ai/brands/claude-code-review/articles/claude-code-now-gives-helper-agents-your-full-conversation-by-default-wh-17e27f/e2941a6da576aadd-c1584025a1d2a307/web_hero.webp","imageAlt":"A diagram shows a central node connected to five smaller nodes, with one small node separated from the rest to indicate the disabling of a helper agent.","createdAt":"2026-10-20T00:03:12.485Z","updatedAt":"2026-10-20T00:30:52.859Z","sources":[{"role":"primary","title":"Claude Code 2.1.302 Adds Idle Compaction, Fork Subagents, and Safer Hook Failures","url":"https://dev.to/akaranjkar08/claude-code-21293-to-21302-settings-worth-enabling-now-4job","sourceName":"Anup Karanjkar","author":"Anup Karanjkar","publishedAt":"2026-10-18T13:15:05Z"}]},{"id":"4d3d5925-0cc8-4166-aa70-676639635a1c","title":"Faster replies from Claude Code: compressed turns and cloud sessions that start while you type","dek":"Anthropic says Claude Code now gzips the conversation it sends on every turn, so it reaches the model faster, and cloud sessions start up as soon as you start typing. Claude Code shrinks the data it sends before each message goes out, so you can expect your replies to start sooner. Each back-and-forth with Claude Code is now packed into a smaller size before sending, so you can expect faster replies.","bodyMd":"Anthropic's ClaudeDevs account announced two speed changes to Claude Code on October 16. Claude Code now gzips the conversation it sends on every turn, so the data reaches the model faster. Cloud sessions also start up as soon as you start typing.\n\nGzip is a standard compression format: the same conversation travels as fewer bytes. The gzip change applies to the conversation Claude Code sends on every turn. For cloud sessions, startup begins when you start typing.\n\nClaudeDevs says the team keeps improving performance across Claude and that users \"may have noticed it starts responding sooner.\" The announcement gives no timing figures for either change, and the announcement names no setting.","status":"published","storyType":"news","category":"Release","clusterKey":"claude-code-faster-startup-gzip","slug":"faster-replies-from-claude-code-compressed-turns-and-cloud-sessions-that-4d3d59","url":"https://claudecodereview.ai/a/faster-replies-from-claude-code-compressed-turns-and-cloud-sessions-that-4d3d59/","relayUrl":"https://relaygrid.com/publications/pivot-claude-code/stories/4d3d5925-0cc8-4166-aa70-676639635a1c","role":"item","position":3,"imageStatus":"ready","imageUrl":"https://media.pivotnews.ai/brands/claude-code-review/articles/faster-replies-from-claude-code-compressed-turns-and-cloud-sessions-that-4d3d59/d5541cd3fce5b855-40898abc4b7ad4c2/web_hero.webp","imageAlt":"A long paper strip being compressed into a stack next to a row of three cloud icons transitioning from empty outlines to solid shapes.","createdAt":"2026-10-17T00:08:06.554Z","updatedAt":"2026-10-17T00:30:54.263Z","sources":[{"role":"primary","title":"Claude Code Gets Faster Startup and Response Times With New Optimizations","url":"https://x.com/ClaudeDevs/status/2111209208012210409","sourceName":"ClaudeDevs","author":"ClaudeDevs","publishedAt":"2026-10-16T21:34:34Z"},{"role":"supporting","title":"Claude Code Gets Faster Startup and Response Times With New Optimizations","url":"https://x.com/ClaudeDevs/status/2111209209664794739","sourceName":"ClaudeDevs","author":"ClaudeDevs","publishedAt":"2026-10-16T21:34:34Z"}]},{"id":"7c7029a9-da88-44ab-9a94-d1f0089d7c42","title":"Check a Claude Code mod before you install it: what it can approve and how to switch it off","dek":"Mods are plugin code that runs inside Claude Code itself and isn't fenced off from the rest of your computer, and they can approve tool calls that your permission rules and hooks would have stopped. Hooks are your own scripts that run automatically at set moments in Claude Code, for example to check or block an action before it happens. Tool calls are the actions Claude asks to take, such as editing a file or running a command, which you normally approve or deny.","bodyMd":"Claude Code v2.1.287 added mods, and they are on by default. A mod is a plugin carrying JavaScript or TypeScript event handlers that run inside Claude Code's own process. Anthropic's overview says \"Mods aren't sandboxed.\" A mod can read and write files anywhere your user account can, start programs, make network requests, and read environment variables and settings files, \"including an API key you keep in either.\" It sees every prompt and every tool call.\n\nThat puts `/plugin install` closer to `npm install` than to adding a prompt file. Plugins could already run code: hooks are shell commands, a stdio MCP server is a process Claude Code starts, and a plugin's `bin/` directory lands on the Bash tool's PATH. What changes is placement. A hook runs at one point and returns. A mod stays loaded for the session, next to the permission system. It can rewrite a tool call, submit a prompt \"as if you had typed it\", call a model on your plan, or answer a call itself.\n\n**Permissions.** A mod that handles the `tool.check` event answers after your permission rules and PreToolUse hooks have decided, and per the permissions page \"its answer can replace theirs.\" It can approve a call that an ask rule would prompt you for. It can approve a call a PreToolUse hook blocked, unless that hook is in managed settings. In auto mode, a call the mod approves skips the classifier check.\n\nDeny rules are the exception, but only in some setups. A built-in guard named `sec-default` keeps them final, and it loads only on a machine with managed settings or with a Team or Enterprise sign-in. On a personal plan or an API key without managed settings, the docs say \"the mod can approve a call that a deny rule refuses.\" Even where the guard loads, it covers Claude's tool calls and not the mod's own: with `Read(.env)` denied, a mod can still read that file with `$.fs.read` or start a program that does.\n\nSome limits hold. A mod can restyle much of the interface but not the permission prompt. In a directory you have not trusted, no mod loads until you answer the trust prompt. From v2.1.292, a tool that needs you, such as AskUserQuestion, still prompts after a mod approves it. Setting `CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=0` no longer keeps mods off, since v2.1.287 and later ignore it.\n\n**Reviewing one first.** Mods route file, process and network access through a single `$` API, so you can read what one does without running it. Clone the source, then run:\n\n`git clone \"$MOD_REPO\" some-mod`\n`claude plugin validate ./some-mod`\n\nThe output has a `hooks:` line listing the events the mod handles and a `calls:` line listing the API methods it uses. `tool.call` or `prompt.submit` means it can see and change every call or prompt. `tool.check` means it can approve or deny a call before the prompt appears. `$.process.run` or `$.process.spawn` start programs as you, outside the sandbox. `$.env.get` or `$.settings.read` read values that can hold keys. `$.http.fetch` makes network requests, and `$.model.complete` spends your plan or API key. Match the list to the mod's stated job: a chart of your context window has no reason to hook `tool.check`. Once `calls:` names `$.process.run`, the rest tells you little, because the program it starts can do anything you can.\n\nUpdates matter too. Auto-update is on by default for most of Anthropic's official marketplaces and ones added from claude.ai, and off for the community marketplace and third-party ones. Leave it off for third-party marketplaces and pin one to a tag when you add it, as in the docs' `your-org/plugins#v1.2.0`.\n\n**Switching mods off.** There are three levels. For one mod, disable or uninstall its plugin from the Installed tab in `/plugin`, or run `claude plugin disable <name>@<marketplace>`. For every mod in one session, start with `claude --safe-mode`, which also skips CLAUDE.md, skills, plugins, hooks, MCP servers, the status line and auto memory. For every mod in every session, set `\"disableAllHooks\": true` in `~/.claude/settings.json`, which also drops your settings hooks and custom status line, including a PreToolUse hook you rely on. None of these stops mods built into Claude Code, such as the one that loads AGENTS.md. Most of those can be turned off one at a time in `/plugin`; `sec-default` cannot.\n\nTeams have a narrower switch in managed settings: set `allowManagedModsOnly` on the built-in guard so user-supplied mods stop running their hooks, and users cannot undo it from their own settings files. Their settings hooks keep working.\n\n```json\n{ \"pluginConfigs\": { \"cc-plugin-sec-default@builtin\": { \"options\": { \"allowManagedModsOnly\": true } } } }\n```\n\nMods have legitimate uses. Anthropic's sample `blast-radius` holds a risky shell command such as `rm -rf` or a force push, shows what it would change, and waits for Proceed or Cancel. A third-party experiment, a small mod that shows a notice above the prompt when Claude edits a file with an open review comment, passed through `claude plugin validate` with just two lines: hooks on `prompt.submit`, `tool.call` and `ui.render`, and calls to `$.process.run`, `$.state.get`, `$.state.set` and `$.ui.resolve`. Drawing works in the terminal and Desktop app only. In the VS Code chat panel, `claude -p` and the Agent SDK the hooks run but nothing they draw appears.","status":"published","storyType":"news","category":"Workflow","clusterKey":"claude-code-mods-run-unsandboxed","slug":"check-a-claude-code-mod-before-you-install-it-what-it-can-approve-and-ho-7c7029","url":"https://claudecodereview.ai/a/check-a-claude-code-mod-before-you-install-it-what-it-can-approve-and-ho-7c7029/","relayUrl":"https://relaygrid.com/publications/pivot-claude-code/stories/7c7029a9-da88-44ab-9a94-d1f0089d7c42","role":"item","position":4,"imageStatus":"ready","imageUrl":"https://media.pivotnews.ai/brands/claude-code-review/articles/check-a-claude-code-mod-before-you-install-it-what-it-can-approve-and-ho-7c7029/0b6f41672c6693c3-ddd0f7298b465dc5/web_hero.webp","imageAlt":"A diagram shows a row of four permission markers, with one marker detached and floating above the rest of the line.","createdAt":"2026-10-17T16:55:11.667Z","updatedAt":"2026-10-17T17:00:29.932Z","sources":[{"role":"primary","title":"Claude Code Mods Run Unsandboxed With Full User Permissions","url":"https://dev.to/gabrielanhaia/claude-code-mods-run-unsandboxed-with-your-permissions-plugin-install-is-npm-install-now-2c3m","sourceName":"Gabriel Anhaia","author":"Gabriel Anhaia","publishedAt":"2026-10-17T12:02:15Z"},{"role":"supporting","title":"Claude Code Mods Let You Draw Custom UI and Intercept Agent Tool Calls","url":"https://dev.to/urion/claude-code-can-draw-now-an-experiment-in-reviewing-from-inside-the-agent-j8c","sourceName":"Matteo Poli","author":"Matteo Poli","publishedAt":"2026-10-17T08:43:15Z"}]},{"id":"b92b6728-eb32-4bff-8d33-3d8d0c84b9ad","title":"A Claude Code hook blocked all 22 force-push and push-to-main variants; deny rules alone stopped only 7","dek":"A force-push overwrites the shared copy of your code history with yours, and pushing to main sends changes straight into the project's primary shared branch; in a test of 22 such commands, deny rules hard-blocked 7, while one PreToolUse hook blocked all 22. A hook is a small script you set up that runs automatically at a chosen moment and can stop a command before Claude Code runs it.","bodyMd":"A team's shared `.claude/settings.json` may include a list like `\"deny\": [\"Bash(git push --force *)\", \"Bash(git push -f *)\", \"Bash(git push * main)\"]`. Those deny rules tell Claude Code which commands it must never run. A force-push overwrites the shared copy of your code history with yours, so you can lose other people's work. Pushing to main sends your changes straight into the project's primary shared code branch. A test of 22 realistic ways to force-push or push to main found the deny rules hard-blocked only 7. The other 15 fell through to a permission prompt, which is one click from running (and no click at all in `bypassPermissions` mode or with a broad allow rule).\n\nThe test targeted the settings file a whole team shares, where one person's \"yes, allow\" can land on everyone's main.\n\nAdding one PreToolUse hook, which is a script Claude Code runs just before a command and which can stop it, blocked all 22. Normal feature-branch pushes still went through.\n\n## What slipped past the deny rules\n\nThe matcher handled `&&`, `;` and environment-variable prefixes, so plain variants like `GIT_TRACE=0 git push -f origin main` and `cd . && git push --force origin main` were denied. The 15 misses fall into four groups:\n\n- **Refspecs:** `+main`, `HEAD:main` and `main:main` don't end in `main`, so `git push * main` never fires.\n- **Git's own options:** `git -C . push` and `git -c alias.p=push p -f` put words between `git` and `push`.\n- **Other ways to run a program:** `/usr/bin/git`, `sh -c`, `bash -lc`, `eval`, `xargs -I`.\n- **Scripts:** the rule sees `bash ship.sh`, not the force push inside it.\n\nThe Claude Code permissions docs say a Bash rule \"isn't a security boundary around the program\" and list `git -C . push` and `sh -c` as forms a `git push *` rule won't match. Six of the 15 prompted only because the team also had a broad `ask: git push *` rule.\n\n## How the hook works\n\nHooks run before permission rules. If a PreToolUse hook exits with code 2, the call is blocked even when an allow rule would permit it. The guard script reads the whole command and does three things:\n\n1. Splits it into simple commands on `&&`, `||`, `;`, `|`, newlines, `$(...)` and backticks, keeping quoted strings together.\n2. Unwraps each one: drops `FOO=bar` prefixes and wrappers such as `env`, `timeout`, `xargs`, `nohup` and `exec`, reduces `/usr/bin/git` to `git`, and recurses into `sh -c`/`bash -c` strings, `eval` arguments and local script files.\n3. Checks any `git push`: skips git's global options, then blocks force flags, `--mirror`, `--all`, `+` refspecs, refspecs it can't verify, and any target that is a protected branch. A bare `git push` is checked against the current branch.\n\nFor text it can't parse as a git call, such as a Python `subprocess.run(['git','push','-f',...])`, it falls back to a regex: git, push, and a force flag or protected branch name means block.\n\nWire it up next to the deny rules:\n\n```json\n\"PreToolUse\": [\n  {\n    \"matcher\": \"Bash\",\n    \"hooks\": [\n      {\n        \"type\": \"command\",\n        \"command\": \"node \\\"${CLAUDE_PROJECT_DIR}/.claude/hooks/guard-git-push.mjs\\\"\",\n        \"timeout\": 10\n      }\n    ]\n  }\n]\n```\n\nKeep the deny rules as a first layer, since they still work if someone disables hooks. The author added `Bash(git push * +*)`, `Bash(git push * *:main)`, `Bash(git push * *:refs/heads/main)`, the `--mirror` forms, and `master`/`production` variants. The full hook, tests, rules and raw results are in the author's demo repo, `teefayb/claude-code-setup-demo` on GitHub.\n\n## Testing it\n\nBecause a hook is a script that reads JSON on stdin, you can pipe each command into it and check the exit code, with no live session needed. The hook ships with 52 Vitest cases (39 should-block, 12 should-allow, plus a current-branch check) that run with the team's normal `npm test`. The allow cases matter: if the guard blocks `git push origin feature/main-menu`, people will turn it off.\n\n## Limits\n\n- It only covers Claude's Bash tool, not your own terminal, a git GUI or CI.\n- It can't read through `npm run release`, a Makefile target, a compiled binary, a script that builds the command at runtime, or a script edited after the check.\n- Pushes through `gh api` or `curl` against the GitHub API are not covered.\n- Anyone who edits the hook can remove it.\n\nBranch protection on main (required review, no force pushes) remains the real backstop. The hook makes the safe path the default inside Claude Code; the server makes it the only path.\n\nOne gotcha from the test: `git rev-parse --abbrev-ref HEAD` fails in a repo with no commits, which made an early version block a plain push on a feature branch. `git symbolic-ref --short HEAD` works there. When the branch can't be known (detached HEAD), the hook blocks.","status":"published","storyType":"tip","category":"Workflow","clusterKey":"block-force-push-pretooluse-hook","slug":"a-claude-code-hook-blocked-all-22-force-push-and-push-to-main-variants-d-b92b67","url":"https://claudecodereview.ai/a/a-claude-code-hook-blocked-all-22-force-push-and-push-to-main-variants-d-b92b67/","relayUrl":"https://relaygrid.com/publications/pivot-claude-code/stories/b92b6728-eb32-4bff-8d33-3d8d0c84b9ad","role":"item","position":5,"imageStatus":"ready","imageUrl":"https://media.pivotnews.ai/brands/claude-code-review/articles/a-claude-code-hook-blocked-all-22-force-push-and-push-to-main-variants-d-b92b67/c5922aa372c4083f-e46765f55fa9a89c/web_hero.webp","imageAlt":"Twenty-two vertical bars in a row, with seven broken bars and fifteen intact, all connected by a single horizontal beam across the top.","createdAt":"2026-10-21T14:25:13.978Z","updatedAt":"2026-10-21T15:01:50.771Z","sources":[{"role":"primary","title":"How to Actually Block Force Pushes in Claude Code When Deny Rules Fail","url":"https://dev.to/teefayb/i-tried-22-ways-to-force-push-past-my-teams-claude-code-rules-7-were-hard-blocked-2b5d","sourceName":"teefayb","author":"teefayb","publishedAt":"2026-10-18T13:09:08Z"}]}],"tips":[{"id":"0fd33c05-7ced-4900-9165-5adbbef809f5","title":"Run several Claude Code sessions at once, each in its own git worktree, with one lead session merging","dek":"The Singapore haze-map project ran several Claude Code sessions in parallel, each in its own git worktree (a separate working copy of the project's code), with one lead session reviewing and merging. Merging means combining the changes made in each separate copy of the code back into the main project so they all end up in one place.","bodyMd":"The Singapore haze-map project, a live map of fires, smoke and wind, is run like a small team: several Claude Code sessions in parallel, each in its own git worktree (a separate working copy of the project's code). Every change starts as a GitHub issue. Every change lands as a pull request, a proposed change submitted for review, with before/after screenshots. One lead session reviews and merges.\n\nClaude Code wrote the project's code: the Python data pipeline, a MapLibre map with no framework, a particle model and the CI (the automated checks and jobs that run on the code). Deciding what to build and what the map is allowed to claim stayed with the human.\n\n**How this project ran it**\n\n1. Every change started as a GitHub issue.\n2. Several Claude Code sessions ran in parallel, each in its own git worktree.\n3. Changes landed as pull requests that carried before/after screenshots.\n4. One lead session reviewed and merged the pull requests.\n\n**Data cleaning**\n\nSeparately from the workflow, data cleaning turned out to be the surprise. Raw satellite fire data includes gas flares, factories, volcanoes, sun glint and reflections over water. The project wrote a rule for each of these and removed 51,922 false detections before the map was honest.\n\nOnce built, the site runs by itself. GitHub Actions refreshes the data twice a day and Cloudflare serves the site. A stale-data warning is set up through a small Cloudflare Worker.","category":"Workflow","slug":"run-several-claude-code-sessions-at-once-each-in-its-own-git-worktree-wi-0fd33c","url":"https://claudecodereview.ai/a/run-several-claude-code-sessions-at-once-each-in-its-own-git-worktree-wi-0fd33c/","relayUrl":"https://relaygrid.com/publications/pivot-claude-code/stories/0fd33c05-7ced-4900-9165-5adbbef809f5","imageUrl":"https://media.pivotnews.ai/brands/claude-code-review/articles/run-several-claude-code-sessions-at-once-each-in-its-own-git-worktree-wi-0fd33c/7b1685c033487ffe-6d5103879fdaa987/web_hero.webp","imageAlt":"A diagram shows multiple parallel lines branching from a main path and then funnelling back into one single, central channel.","createdAt":"2026-10-22T11:46:58.953Z"},{"id":"3239979d-68d9-45cb-85ab-8a7d7524e745","title":"Stop AI code reviews from looping forever with a Claude Code and Codex verdict file","dek":"Claude Code writes and commits (a commit is a saved snapshot of your code changes in Git that you can look back at, review or undo later), then Codex reviews it without being able to edit and saves ACCEPT or CHANGES REQUIRED in a file named after the commit.","bodyMd":"A review loop never ends when the reviewer keeps finding new things and nobody has said what \"done\" means. A shared workflow for pairing Claude Code with Codex as the reviewer agent addresses that with a written definition of done, structured review rounds, and one saved decision per commit. A commit is a saved snapshot of your code changes in Git that you can look back at, review or undo later.\n\n**How it works**\n\n1. Claude Code makes a change on a branch, commits it, and stops.\n2. Codex reviews that commit in read-only mode: it can read files and run `git diff`, but it cannot write to the repo and never hands back a patch.\n3. Codex saves its decision in a file named after the commit hash (for example `[commit_hash].verdict`). The file says either `Verdict: ACCEPT` or `Verdict: CHANGES REQUIRED`.\n\n**Set up before coding**\n\n- Write a \"Done means\" list first. Each line must be checkable from the diff or from a test, and every new test must fail on the base commit, \"or it proves nothing.\"\n- Put \"House rules\" (coding standards, security policies) in both CLAUDE.md and AGENTS.md, so the writer and the reviewer follow the same rules.\n\nFor each \"Done means\" line, the reviewer reports one of three things: met (with file and line), not met (file, line and what is missing), or not checkable (what evidence would settle it).\n\n**Round rules**\n\n- Round 1 lists every finding.\n- Round 2 confirms the fixes and adds only what those fixes broke.\n- From Round 3, only blockers and security findings hold the merge. Nits go to follow-ups.\n\nIf Claude Code and Codex disagree, a finding with a reproducible failure stands. Without one, it goes to follow-ups. If `CHANGES REQUIRED` persists, the merge decision is manual.\n\n**When to use it**\n\nReach for this when AI reviews keep going in circles on the same branch. It needs careful up-front work on the \"Done means\" lists and house rules. The full workflow is offered as a paid product, and the post describing it is new, so community validation is thin.","category":"Workflow","slug":"stop-ai-code-reviews-from-looping-forever-with-a-claude-code-and-codex-v-323997","url":"https://claudecodereview.ai/a/stop-ai-code-reviews-from-looping-forever-with-a-claude-code-and-codex-v-323997/","relayUrl":"https://relaygrid.com/publications/pivot-claude-code/stories/3239979d-68d9-45cb-85ab-8a7d7524e745","imageUrl":"https://media.pivotnews.ai/brands/claude-code-review/articles/stop-ai-code-reviews-from-looping-forever-with-a-claude-code-and-codex-v-323997/38e3897ae897d163-9efb07c20a838e92/web_hero.webp","imageAlt":"A single document icon labeled with a verdict is removed from a sequence of three commit history snapshots.","createdAt":"2026-10-22T11:44:08.975Z"},{"id":"2f20cde9-d1aa-453d-80ad-d3adbc249870","title":"Make Claude Code state a paid tool's price and ask before it spends past a limit","dek":"One line in CLAUDE.md, the file of standing instructions Claude Code reads each session, can make it announce a paid tool's price and pause for approval on expensive or repeated calls.","bodyMd":"Paid MCP tools (add-on tool servers that charge per call) are called as often as Claude Code thinks it needs them. A short rule in CLAUDE.md can make it more careful, though it works only if Claude can look up the price first.\n\n**1. Add the rule to CLAUDE.md**\n\n```\nBefore calling any paid tool, state its price. Ask me first if a single call costs more than $0.25 or if you plan more than 20 paid calls in a task.\n```\n\nThe two thresholds cover different failures. The price limit catches one expensive call. The call-count limit catches loops of cheap calls, which add up just as fast. The $0.25 and 20-call figures are one setup's choices; adjust them to your budget.\n\n**2. Give Claude a way to see the price**\n\nThe rule fails if the price is hidden. Some MCP servers put it in the tool description, and some offer a separate inspect step. Check whether your server exposes it at all. One server, Agentik, reportedly lets every tool be inspected for its maximum price before the call, at no cost.\n\n**When to use it**\n\nReach for it when you connect a paid MCP server and let Claude run multi-step tasks that might call it repeatedly.\n\n**Caveat**\n\nCLAUDE.md is a hint, not a guarantee. Keep a hard spending limit outside Claude too, on the API key or at the provider.","category":"Workflow","slug":"make-claude-code-state-a-paid-tool-s-price-and-ask-before-it-spends-past-2f20cd","url":"https://claudecodereview.ai/a/make-claude-code-state-a-paid-tool-s-price-and-ask-before-it-spends-past-2f20cd/","relayUrl":"https://relaygrid.com/publications/pivot-claude-code/stories/2f20cde9-d1aa-453d-80ad-d3adbc249870","imageUrl":"https://media.pivotnews.ai/brands/claude-code-review/articles/make-claude-code-state-a-paid-tool-s-price-and-ask-before-it-spends-past-2f20cd/d38c1b938e9ab885-4114277debee36d8/web_hero.webp","imageAlt":"A row of twenty circular tokens cut in two by a vertical line, with one larger token positioned above the row to serve as a bridge.","createdAt":"2026-10-22T11:41:48.518Z"},{"id":"935d1f84-e32b-4689-ba8c-11602a639dab","title":"Clean ads and background junk off a slow smart TV over Wi-Fi, with an undo","dek":"Claude Code can connect to an Android or Google TV through Android's debug tool (ADB), switch off the ad and tracking apps that slow it down, and keep a way to turn them back on.","bodyMd":"Smart TVs ship with promotional apps, retail demo software and tracking services running in the background. Claude Code can find a TV on your home network, list what is running, and switch off the apps you do not use. ADB (Android Debug Bridge) is the tool that lets a computer send commands to an Android device. The TV apps and background programs it targets are called packages, and \"disabling\" one only turns it off: it stays installed and can be switched back on.\n\n**What you need**\n\n- A TV and a computer on the same Wi-Fi network.\n- Android platform tools on the computer, which provide ADB. On a Mac with Homebrew, one install command covers it.\n- On the TV: Settings, System, About, then press select on the remote seven times on \"Android TV OS build\" to unlock developer options. Back in System, open Developer options and turn on Wireless debugging. Allow it on the current Wi-Fi network and keep the screen showing the TV's IP address and port open.\n\n**The prompt**\n\nOpen Claude Code and send:\n\n> Hey Claude, my Android TV is connected to the same Wi-Fi network and wireless debugging is enabled. Can you find my TV, analyze why it's slow, and help me safely debloat it? Please review the changes with me before disabling anything and create a way to restore the original settings.\n\nClaude checks that ADB is installed and looks for the TV. You may need to approve the connection or finish wireless debugging pairing on the TV.\n\n**Steps that keep it safe**\n\n1. Before any change, have Claude check free RAM, running background processes, installed apps and app usage history. On a 2 GB Sony Bravia Google TV, that check showed 42 MB of free memory and about 30 background apps, including Spotify, which had not been opened for months, and Sony retail demo and promotional apps.\n2. As a follow-up request, ask Claude to disable apps rather than remove them, so you can re-enable anything that breaks.\n3. Review the list yourself. Do not let Claude disable core Android services, Google Play services, the TV settings app or features you use. A separate write-up of the same approach adds guardrails: back up the full package list first, disable and never uninstall, keep a never-touch list (setup, Wi-Fi, input, and on Google TV the package that breaks casting), and ask before disabling anything the family might use. Its author says disabling 25 Xiaomi ad and tracking packages this way was reversible in one line.\n4. Ask Claude to save a restore script so you do not have to remember each change.\n\n**Optional extras**\n\n- *Cleaner home screen:* Install Projectivy launcher from the Play Store and test it before disabling the built-in launcher. On the Bravia, disabling the original launcher while it was running caused problems and forced a restart, and some TVs may bring the original launcher back after a restart. In that test, launcher memory fell from about 160 MB to 55 MB and the sponsored rows disappeared.\n- *DNS-level ad blocking:* If your TV settings lack a private DNS option, ask: \"Configure AdGuard private DNS on my Android TV using dns.adguard-dns.com and verified that the connection is working. Please also tell me how to restore the original DNS settings.\" AdGuard DNS blocks many known ad and tracking domains, but generally not YouTube video ads or ads inside a streaming service's own video.\n\n**Results and checks**\n\nOn the Bravia, Claude disabled 15 unused packages in the first cleanup and app memory use fell from about 1.13 GB to 911 MB. Across the full session it disabled 36 packages, replaced the launcher and set up ad blocking. Afterward, restart the TV and confirm streaming apps, the home screen, the remote and internet access work. If something fails, ask Claude to restore that app or setting. When finished, turn wireless debugging off in Developer options.","category":"Workflow","slug":"clean-ads-and-background-junk-off-a-slow-smart-tv-over-wi-fi-with-an-und-935d1f","url":"https://claudecodereview.ai/a/clean-ads-and-background-junk-off-a-slow-smart-tv-over-wi-fi-with-an-und-935d1f/","relayUrl":"https://relaygrid.com/publications/pivot-claude-code/stories/935d1f84-e32b-4689-ba8c-11602a639dab","imageUrl":"https://media.pivotnews.ai/brands/claude-code-review/articles/clean-ads-and-background-junk-off-a-slow-smart-tv-over-wi-fi-with-an-und-935d1f/7580d7970c3c9f75-8b79bd3beb540743/web_hero.webp","imageAlt":"A diagram shows thirty-six small squares in a grid, with one square lifted out of the group and connected back to its empty slot by a line.","createdAt":"2026-10-22T00:26:30.715Z"},{"id":"d0476aa5-ef19-43d6-9956-e187ddc0ad17","title":"The official Codex plugin gives Claude Code a second opinion from a model outside Claude's family","dek":"The official Codex plugin runs inside Claude Code and lets Codex review Claude's work or take over a task, with the review billed to your Codex subscription rather than your Claude plan.","bodyMd":"The official Codex plugin, an add-on that extends Claude Code with new commands, brings Codex, a coding agent from outside Claude's family, into Claude Code as a reviewer, so you can check Claude's changes without leaving the session. The walkthrough covers two commands: codex review and codex Rescue.\n\n**Why a second model helps.** In one test, a bug where an app closed itself when a saved item was deleted was diagnosed and fixed by Claude. A separate Claude auditor agent (one that sees only the diff, not the conversation) approved the fix. Running codex review then agreed on the serious points and added one more: the code waited for a delete animation to finish but not long enough, so the screen could briefly flash empty. The auditor was Opus, so it was not a weaker model. The explanation offered is a 2025 study titled, in the source's wording, \"large models think alike\": a model judging output scores it higher when it resembles its own, and models from the same family resemble each other most. The speaker's comparison is asking a second opinion from a doctor who studied at the same school with the same books as the first.\n\n**How to use it**\n1. Install the plugin. The walkthrough says installation takes four commands but does not list them, so check the plugin's official instructions for the exact steps.\n2. After Claude finishes a change, run codex review for Codex's read of the work.\n3. Use codex Rescue to hand Codex a task, which it then carries out in your project.\n\n**The usage-limit angle.** The review runs on your Codex subscription, not your Claude plan. That means review work does not count against the 5-hour limit in your Claude session, so you hit it later. The same walkthrough pushes back on claims that this makes a 20 plan behave like a 200 one (the source does not state a currency): Max 5x gives five times Pro and Max 20x gives twenty times, while two 20 plans give roughly double. If Pro feels tight, adding ChatGPT's 20 plan is an option the speaker suggests trying before jumping to Max.\n\n**When to reach for it.** The speaker's view is that the plugin's real value is a reviewer from outside Claude's family, one that sees what another model misses even when that model tries to be impartial, and that what you may need is someone who does not think like Claude rather than a more expensive plan.","category":"Workflow","slug":"the-official-codex-plugin-gives-claude-code-a-second-opinion-from-a-mode-d0476a","url":"https://claudecodereview.ai/a/the-official-codex-plugin-gives-claude-code-a-second-opinion-from-a-mode-d0476a/","relayUrl":"https://relaygrid.com/publications/pivot-claude-code/stories/d0476aa5-ef19-43d6-9956-e187ddc0ad17","imageUrl":"https://media.pivotnews.ai/brands/claude-code-review/articles/the-official-codex-plugin-gives-claude-code-a-second-opinion-from-a-mode-d0476a/1d75b7a40b7a840a-a3601f81bd066860/web_hero.webp","imageAlt":"Two identical blocks joined by a single, differently-shaped third block that links them together.","createdAt":"2026-10-22T00:23:52.502Z"}]}