Maya: Hey builders! Here's what's on the radar today on Claude Code Review. Handoff files for Claude Code sessions, Managed Agents writing their own workflows, free security scans for open-source maintainers, routing cheap jobs to Haiku, and hooks that proofread every prompt. I'm Maya.

James: And I'm James. Let's get into it.

Maya: First up, handoff files for keeping Claude Code coherent across sessions. The problem is simple: a new session has no memory of the last, and long chats get compacted or expensive. The fix is a small written record Claude rereads at startup.

James: Right, Maya, and one X post wraps it into CLAUDE.md: Claude maintains a HANDOFF.md with status, next steps, open decisions and gotchas, updating at milestones. The author reports good results with Opus five point five. That's one user's account, not measured.

Maya: Exactly, James. A Reddit post goes further with a repo offering slash session dash start and slash handoff. Here's the smart part: session dash start checks the notes against git, open pull requests and running jobs, and flags where they're wrong.

James: That verification matters. To adopt it, you clone the repo, run adopt dot sh on your project directory, then tell Claude to follow the Adopt in a new project section. The developer says it works on Linux, macOS and Windows, one repo or several.

Maya: Next, Claude Managed Agents can now write and run their own multi-agent workflows. Anthropic's release notes dated October ninth say an agent handling work with many pieces, like reviewing hundreds of documents, can write a workflow that runs many agents in phases and merges results.

James: And it runs server-side in the background, Maya. Teams opt in through the beta header and set the agent's multiagent field to enabled. You guide it in the system prompt on when to start a run, and progress shows up as workflow run events.

Maya: Claude Code users get a shortcut via slash claude dash api managed agents onboard bug dash hunter, plus templates. One builder pointed it at eighteen thousand lines of code and got twenty-one proven bugs in about five minutes for eight dollars thirty-six.

James: That's impressive, though the same post warns it burns tokens fast, and ClaudeDevs agrees. Their advice: start with a scoped task and increase complexity step by step. So those first runs are a cost test as much as a capability test.

Maya: Story three, Anthropic is opening free security scans to open-source maintainers. Startup Fortune reported it October eighth. Maintainers apply for expedited access and scan a full repository or targeted directories. The scans trace how data moves and draft patches for a person to review.

James: And there's a verification pipeline every finding passes before a human sees it, Maya, meant to cut false-positive noise. There's also a companion Claude Security plugin for Claude Code in beta, with a slash command that launches a team of agents against your changes before you commit.

Maya: The Project Glasswing pilot, pairing an unreleased model with partners like AWS, Google and the Linux Foundation, passed twenty-three thousand findings across more than a thousand projects. Anthropic says it confirmed ninety point six percent of what the model flagged.

James: Worth noting it doesn't replace existing tools. Scans take minutes versus CodeQL's seconds, and cost roughly five to twenty-five dollars each. In one fintech test it caught three issues CodeQL and Semgrep missed, but also produced a dozen false positives.

Maya: Story four, a walkthrough routes Claude Code searches and log reading to cheaper Haiku five point five subagents, keeping planning and multi-file edits on Opus or Sonnet. The price gap is the draw: Haiku runs a dollar ten per million input against Sonnet's two dollars.

James: That's a twenty X difference, Maya. The rule of thumb: if a task has clear input, clear output, and a wrong answer just means looking again, give it to Haiku. Search, running tests, pulling log lines all qualify. Planning and subtle debugging stay bigger.

Maya: The biggest single change is Explore, the built-in search subagent, which runs on the main model. Dropping a dot claude slash agents slash explore dot md file with model haiku overrides it. If the folder didn't exist at startup, restart Claude Code.

James: And watch the settings, because the haiku alias only resolves to five point five on the Anthropic API. On Bedrock, Google Cloud and Microsoft Foundry it still points to Haiku four point five, so set the default Haiku model variable. Needs v two point one point two nine three.

Maya: Last story, Claude Code hooks can run a prompt proofreader every time where a skill may be skipped. A developer found skills fail the same way: Claude decides whether one applies, sometimes forgets, and compaction drops the instructions in long sessions.

James: So the developer moved the logic into hooks they call mods, which run on every prompt before the model sees it. The grammar-fix mod sends your prompt to Haiku with proofreading instructions, and Claude gets clean text while you see the fixes as cross-mark to check-mark lines.

Maya: And why prefer it to a skill? It always runs, it uses fewer tokens on the main model, and compaction can't drop it because the logic runs before context. The repo also includes georgian-bridge for translation. Both need v two point one point two seven five, installed via slash plugin install.

Maya: That's your Claude Code Review daily brief. Check claudecodereview.ai for the full stories. Keep building.