CC14: Power User & CI/CD

Learning Objectives

• Resume work three ways (--continue, --resume, --resume <session-id>) and use /rename, /branch, /rewind from inside a session.
• Trigger extended thinking explicitly (Option+T, ultrathink, /effort) and adjust the budget via MAX_THINKING_TOKENS.
• Run parallel sessions on the same repo with --worktree and .worktreeinclude.
• Use the two-Claude review pattern to ship code with significantly fewer escapes.
• Run Claude Code headless (-p, --output-format json|stream-json, --allowedTools, --max-turns) inside GitHub Actions, or via the official anthropics/claude-code-action@v1.
• Pick the right scheduling primitive: /loop (in-session monitor) vs /schedule (cron-style) vs GitHub Actions vs Routines.

Session Mastery — Beyond --continue

CC0 covered the basics: --continue, --resume, /rename. Here's the operator-grade toolkit:

Pro pattern: /branch for "let me try a different approach"

You're 12 turns into a refactor and want to try a different design without losing your current state. /branch forks the session: now you have two timelines from this point. Try approach A in one, approach B in the other, keep whichever wins.

Extended Thinking UX — Triggers & Budget

For complex tasks, extended thinking lets Claude reason longer before responding. Five ways to invoke it; one way to budget it.

Budget

Set MAX_THINKING_TOKENS environment variable (e.g. 32000) to cap how much Claude can reason. Higher = better answers on hard problems, more tokens spent. Default is moderate; turn up for genuine architecture decisions, down for chatty tasks.

Worktrees — Parallel Sessions on the Same Repo

Git worktrees let you check out multiple branches simultaneously into different directories — same repo, multiple working copies. Claude Code's --worktree flag spins up a session in a temporary worktree:

# Open a session in an isolated copy of the current branch
$ claude --worktree

# Or branch off main, isolated
$ claude --worktree --branch main

# Subagents can use the same primitive via frontmatter:
# isolation: worktree

Why isolated worktrees beat just opening two terminals

• Two Claude sessions on the same files would race each other — race conditions on edits, confusing test runs.
• Worktree = independent file system view. Each session edits its own copy.
• Auto-cleaned: if a worktree-isolated session makes no changes, the worktree is deleted on exit.

.worktreeinclude — copy gitignored files in

Worktrees only get tracked files by default. Your .env, node_modules, build artifacts — gone. Drop a .worktreeinclude at repo root to specify gitignored files that should be copied or symlinked into worktrees:

.env.local
.env.development
.vscode/settings.json

For larger artifacts (node_modules, .cache), use worktree.symlinkDirectories in settings.json:

{
  "worktree": {
    "symlinkDirectories": ["node_modules", ".cache", ".next"],
    "sparsePaths": ["packages/api", "packages/web"]
  }
}

sparsePaths uses git sparse-checkout to only materialize specific directories — useful for huge monorepos where you only need to work on one package.

Two-Claude Review — Shift-Left Bug Catching

The pattern

# Session A: generate
$ cd ~/project
$ claude
> "Use the code-generator subagent. Implement the new pricing tier
   (free/pro/enterprise) as described in PRICING.md. Add tests.
   When done, output a summary of changes."

# Session A produces a PR. Now switch to Session B (different terminal):
$ cd ~/project
$ claude --worktree --branch main
> "Use the code-reviewer subagent to review PR #1234.
   Look for security issues, edge cases, missed test coverage,
   and consistency with existing patterns.
   Output: CRITICAL / WARNING / SUGGESTION."

# Session B sees ONLY the PR diff — no generation reasoning.
# Subagents in .claude/agents/ are invoked via the Task tool, not a CLI flag.

Bonus: run them in parallel via worktrees, fork mode, or scheduled jobs. The generator finishes, the SubagentStop hook (CC7) auto-spawns the reviewer with the same task description — entirely automated pipeline.

Background Work — /loop and /schedule

Two primitives for "do this without me watching":

/loop — in-session background monitor

Bundled skill (CC5). Reruns a check on a cadence, reports drift. Common uses:

> /loop every 5 minutes: run `pnpm test:e2e:smoke`. Report only when output changes.

> /loop until error rate > 1%: hit /healthz on staging every 30s. Alert on Slack if it spikes.

> /loop until merged: poll PR #123, when checks turn green and reviews approved, post in #releases.

The loop runs in the same session, doesn't block the main conversation, and you can ask it to stop with "/loop stop."

/schedule — cron-style background tasks

For "run this every weekday morning" / "run this nightly" workflows. The agent fires up automatically, runs the task, reports back next time you're online.

> /schedule weekdays at 9am: run yesterday's PR triage report

> /schedule every Monday 10am: clean up branches merged >30 days ago, open a PR with the deletes

> /schedule daily at 6am: pull latest main into all my long-lived feature branches, report conflicts

Picking the right primitive

Headless Mode — -p, JSON, Pipes

Claude Code can run as a Unix utility. -p (or --print) takes a prompt, runs to completion, prints the result, exits. Three output formats: text (default), json (single JSON envelope), and stream-json (line-delimited JSON events).

# Simple text response
$ claude -p "Summarize the last 5 commits in this repo"

# Structured JSON output (single envelope)
$ claude -p "List exported functions in src/api.ts" --output-format json

# Stream JSON — one JSON event per line, suitable for live processing
$ claude -p "Analyze this PR" --output-format stream-json --verbose

# Steer the response shape via the system prompt (real flag — works today)
$ claude -p "Analyze this PR. Return JSON with keys: summary (string), risk (one of low|medium|high), issues (array of strings). Output ONLY JSON." \
    --output-format json \
    --append-system-prompt "Always return valid JSON matching the requested schema. No prose."

# Pipe input/output
$ git diff main | claude -p "Summarize this diff in 3 bullets"

$ claude -p "Generate test cases for this fn" < src/utils.ts > tests/utils.test.ts

Useful flags

• -p <prompt> / --print — non-interactive, prints result, exits.
• --output-format text|json|stream-json — text (default), json (single envelope), stream-json (line-delimited JSON events; pair with --verbose).
• --system-prompt <text> / --append-system-prompt <text> — replace or append to the system prompt for this run. Use the appended prompt to constrain output shape.
• --max-turns <n> — cap agent loop turns (CI-friendly bounded runs).
• --mcp-config <path> — load an MCP server config just for this run.
• --session-id <id> / --resume <id> — identify or resume a session (scriptable).
• --permission-mode acceptEdits — auto-accept file edits; other tools still prompt unless allowlisted. (Other modes: default, plan, bypassPermissions.)
• --allowedTools / --disallowedTools — explicit allow/deny lists for tools in this run.
• --dangerously-skip-permissions — only inside disposable containers; bypasses all prompts.

GitHub Actions Integration — Claude in Your Pipeline

Claude Code runs in GitHub Actions same as locally. Two patterns: (1) the official anthropics/claude-code-action for chat-style PR review, (2) the raw claude -p headless CLI for full scripting control. Pattern 2 below — every PR triggers a workflow that uses Claude Code to review, suggest, or block.

# Option A: official GitHub Action (simplest)
# .github/workflows/claude-action.yml
name: Claude PR Review
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  review:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }

      - uses: anthropics/claude-code-action@v1
        with:
          # Use either CLAUDE_CODE_OAUTH_TOKEN (Pro/Max plans)
          # or anthropic_api_key (API billing).
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            Review this PR. Look for bugs, security issues, missing tests,
            and style violations against CLAUDE.md.
          claude_args: "--allowedTools Read,Grep,Glob,Bash --max-turns 20"

# Option B: raw headless CLI — full scripting control
# .github/workflows/claude-review.yml
name: Claude PR Review (headless)
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Claude Code
        run: npm install -g @anthropic-ai/claude-code

      - name: Run review
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          claude -p "Review this PR (compare HEAD to origin/main).
                     Look for: bugs, security issues, missing tests,
                     style violations against CLAUDE.md.
                     Output ONLY valid JSON with keys: summary (string),
                     severity (low|medium|high), findings (array)." \
            --output-format json \
            --permission-mode acceptEdits \
            --allowedTools "Read,Grep,Glob,Bash(git diff:*),Bash(git log:*)" \
            --max-turns 15 \
            --append-system-prompt "Return ONLY the JSON envelope. No prose." \
            > review.json

      - name: Post review as PR comment
        run: |
          BODY=$(jq -r '.result' review.json)
          gh pr comment ${{ github.event.pull_request.number }} --body "$BODY"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Hardening for CI

• Tight tool allowlist. Use --allowedTools with an explicit list (e.g. "Read,Grep,Glob,Bash(git diff:*)") plus --permission-mode acceptEdits. CI runners shouldn't have unbounded shell. --dangerously-skip-permissions is for disposable containers only.
• Bounded loop. --max-turns <n> caps the agent loop — runaway tool use can't burn your CI budget.
• Sandbox on. CI runners are ephemeral but mistakes can still leak secrets. sandbox.enabled: true with allowlisted domains in .claude/settings.json.
• Two-Claude review. Run a generator job + reviewer job. Reviewer doesn't see generator's reasoning. (CC14's #4 use case.)
• Token narrowing. The ANTHROPIC_API_KEY (or CLAUDE_CODE_OAUTH_TOKEN for Pro/Max plans) should be a CI-specific credential, rate-limited, with cost caps. Don't share with dev keys.

Image Input, Voice, Plugins — The Last 10%

Image input

Drag an image into the terminal session, or pipe one with cat screenshot.png | claude. Claude reads the image with vision: "What's in this UI screenshot?", "Why does this graph look weird?", "Convert this hand-drawn architecture diagram to Mermaid."

Voice — /voice

Configure with /voice or in settings:

{
  "voice": {
    "enabled": true,
    "mode": "hold",
    "autoSubmit": true
  }
}

mode: "hold" = push-to-talk. "tap" = tap-to-toggle. autoSubmit: true sends when you stop talking. Useful for hands-busy debugging on the couch.

Plugins — share your setup

Plugins package skills, subagents, hooks, and MCP server configs into a single distributable. Install with /plugin install <name>. Browse marketplaces in settings (extraKnownMarketplaces). Anything you build for your team can ship as a plugin so other teams get it with one command.

Plugin caveats from earlier modules: plugin subagents drop hooks, mcpServers, permissionMode silently. Plugin skills are namespaced as plugin:skill. Managed admins control allowlists via strictKnownMarketplaces and blockedMarketplaces.

Desktop notifications — the Notification hook (CC7)

{
  "hooks": {
    "Notification": [
      {
        "matcher": "permission_prompt",
        "hooks": [
          {
            "type": "command",
            "command": "osascript -e 'display notification \"Claude needs you\" with title \"Claude Code\"'"
          }
        ]
      }
    ]
  }
}

For Linux: notify-send. For Windows: powershell -Command "..." with toast notification. Now your laptop pings when Claude needs an answer — you don't have to keep checking.

Hands-On Lab — Two-Claude Review + CI for the PublicRecords API

Working in the PublicRecords API from CC0–CC9. You'll set up a complete two-Claude review pipeline against this Java/Spring project: a generator session implements a new endpoint in a worktree, an isolated reviewer session evaluates the diff with no shared context, and a GitHub Action codifies the pattern for every future PR. End state: a checked-in workflow that runs Claude Code in headless mode on every push and posts a structured review comment. About 20 minutes.

Prerequisites

• The PublicRecords API repo on GitHub (push the local one if you haven't yet).
• The code-reviewer built-in subagent (or your own from CC6) at .claude/agents/code-reviewer.md.
• The pii-auditor subagent from CC6 — we'll wire it in as a second CI gate.
• An ANTHROPIC_API_KEY in your GitHub repo secrets.

Step 1 — Open the generator session in a worktree

$ cd /path/to/PublicRecordsAPI
$ claude --worktree --branch main

Worktree gives this session its own filesystem copy. Edits won't touch your main tree, so you can keep working there in parallel.

Step 2 — Generate a small but real feature

> In plan mode: add a new endpoint
   GET /filings/expiring?days=N that returns filings whose
   expires_at is within the next N days. Default N=90.
   Add validation (1 ≤ N ≤ 365), a derived repository query,
   and a MockMvc test for the happy path + the bound check.
   Show me the plan; don't write code yet.

Read the plan. If it looks right, drop into default mode (Shift+Tab) and:

> Proceed. Implement the plan. Run `mvn test`. Commit when green.

Claude implements, tests, and commits. The hook from CC7 fires Spotless on each Java edit; the permissions from CC4 silence mvn test. Note the branch name in the worktree (something like claude-XXXX).

Step 3 — Push the branch and open a PR

> Push this branch and open a PR titled
   "feat(filings): add /filings/expiring endpoint".
   Body: describe the new endpoint, its validation, and the tests added.
   Don't include implementation reasoning.

Claude will hit the git push ask-tier from CC4 — approve once. Note the PR number, then exit (Ctrl+D).

Step 4 — Open a fresh reviewer session in a NEW worktree

$ cd /path/to/PublicRecordsAPI
$ claude --worktree --branch main

Critical: different process, no shared context. Inside this fresh session, ask Claude to delegate to your code-reviewer subagent (the file at .claude/agents/code-reviewer.md). Subagents are invoked via the Task tool, not a top-level CLI flag — just say "use the code-reviewer subagent to review…" and Claude routes the work. The reviewer has only its own system prompt and the PR diff — no clue why each line was written. That's the value: it sees the code the way a teammate would.

Step 5 — Run the review

> Load PR #<number> and review the diff against this project's
   CLAUDE.md (UCC glossary, security rules, conventions).
   Output:
   - CRITICAL: must fix before merge
   - WARNING: should fix
   - SUGGESTION: consider improving
   For each, cite the file and line. Don't implement.

Read the review. Common findings on a Spring endpoint: missing @Valid, missing 400-error case in test, integer overflow in date arithmetic, missing JavaDoc on the new public method, swallowed exception in service.

Step 6 — Apply fixes and re-review (optional)

• Switch back to the generator worktree
• claude --resume the generator session
• Tell it: "The reviewer flagged these issues. Apply the fixes."
• Push to the same branch
• From the reviewer worktree, re-run the review — confirm clean

Step 7 — Codify the pattern in GitHub Actions

Add this workflow to your repo (every PR opens or pushes will trigger a Claude review):

name: Claude PR Review
on:
  pull_request:
    types: [opened, synchronize]
    branches: [main]

jobs:
  reviewer:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }

      - uses: actions/setup-java@v4
        with: { distribution: 'temurin', java-version: '21' }

      - uses: actions/setup-node@v4
        with: { node-version: 20 }

      - run: npm install -g @anthropic-ai/claude-code

      - name: Claude review (delegates to code-reviewer subagent)
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          claude -p "Delegate to the code-reviewer subagent (in .claude/agents/)
                     to review PR #${{ github.event.pull_request.number }}.
                     Compare HEAD to origin/main.
                     Apply the project's CLAUDE.md conventions strictly.
                     Output ONLY a single JSON object with keys:
                       summary (string),
                       severity (one of: clean, minor, major, blocker),
                       findings (array of {file, line, severity, note}).
                     No prose outside the JSON." \
            --output-format json \
            --permission-mode acceptEdits \
            --allowedTools "Read,Grep,Glob,Bash(git diff:*),Bash(git log:*),Bash(gh pr view:*),Task" \
            --max-turns 20 \
            --append-system-prompt "Return ONLY the JSON envelope. No commentary." \
            > review.json

      - name: PII audit (delegates to pii-auditor subagent)
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          claude -p "Delegate to the pii-auditor subagent (in .claude/agents/)
                     and run it on this checkout. Print the audit table,
                     or the literal string 'PII audit clean.' if nothing is found." \
            --permission-mode acceptEdits \
            --allowedTools "Read,Grep,Glob,Task" \
            --max-turns 10 \
            > pii.txt

      - name: Comment on PR
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          jq -r '.result' review.json > review-inner.json
          SEVERITY=$(jq -r '.severity' review-inner.json)
          SUMMARY=$(jq -r '.summary' review-inner.json)
          PII=$(cat pii.txt)
          gh pr comment ${{ github.event.pull_request.number }} \
            --body "**Claude Review** — severity: \`$SEVERITY\`

          $SUMMARY

          ### PII Audit
          \`\`\`
          $PII
          \`\`\`

          <details><summary>Code review findings (JSON)</summary>

          \`\`\`json
          $(cat review.json)
          \`\`\`
          </details>"

      - name: Block merge on blocker
        run: |
          SEVERITY=$(jq -r '.severity' review-inner.json)
          if [ "$SEVERITY" = "blocker" ]; then
            echo "Reviewer flagged a blocker. Fix before merge."
            exit 1
          fi
          if ! grep -q "PII audit clean" pii.txt; then
            echo "PII auditor found unmasked PII. Fix before merge."
            exit 1
          fi

Add ANTHROPIC_API_KEY to your repo's Settings → Secrets and variables → Actions. Commit and push the workflow file:

Commit, push, and open a fresh PR. Within ~2 minutes you should see a Claude review comment plus a green/red check on the merge button. The CI gate composes everything from CC0–CC9: project conventions (CC3), narrow CI permissions via --allowedTools + --permission-mode acceptEdits (CC4), the code-reviewer agent (CC6), the pii-auditor agent (CC6), and structured JSON output for downstream tooling.

Step 8 — (Optional) Add /loop to watch the CI run locally

> /loop until PR #<number> has the github-actions review comment:
   poll every 30s. When it lands, summarize severity and findings,
   and tell me if the workflow passed or failed.

Knowledge Check

Module Summary

• Session toolkit: --continue, --resume [<id>], --session-id + in-session /rename, /branch, /rewind.
• Extended thinking: Option+T toggle, /effort, "ultrathink" in prompts, MAX_THINKING_TOKENS for budget.
• Worktrees: --worktree, .worktreeinclude, worktree.symlinkDirectories, worktree.sparsePaths.
• Two-Claude review: separate generator and reviewer sessions; reviewer never sees generator's reasoning. Massive bug-catch leverage.
• Background: /loop (in-session monitor), /schedule (recurring), GitHub Actions (repo-event), Routines (cron-like persistence).
• Headless: -p + --output-format json|stream-json + --allowedTools + --permission-mode acceptEdits + --max-turns + --append-system-prompt for shape control. Pipe stdin/stdout like any Unix utility.
• CI/CD: either the official anthropics/claude-code-action@v1 or a raw headless workflow at .github/workflows/claude-review.yml; harden with sandbox, narrow tool allowlist, max-turns cap, CI-specific token / OAuth credential, model triage (Haiku → Sonnet).
• Image input via drag/paste, voice via /voice, plugins for distribution, desktop notifications via the Notification hook.