Reviewing Claude Code Diffs Before You Hit Merge
Two review passes for the same Claude Code diff
Claude Code can turn a small request into a convincing patch before your coffee cools. The danger is not that generated code always looks wrong. It is that clean naming, plausible tests, and a confident summary can make an unfinished change feel finished.
My review stays in the terminal: git status --short, git diff --stat, then git diff. I compare the usual checklist with an agent-aware version below. The ordinary checks still matter; the extra checks target mistakes that a fast, broad editing session makes easier to miss.
Scope: readable changes beside authorized changes
- Standard review: Check whether each changed file belongs to the requested feature or fix.
- Claude Code review: Compare every changed file against the original request, including configuration and lockfiles.
Start by writing the intended behavior in one sentence. For a retry fix, mine might be: retry transient upstream failures without repeating non-idempotent requests. A renamed logging module or dependency upgrade now needs an explanation, not a free pass because the patch looks tidy.
Inspect untracked files separately because git diff does not show their contents. Read repository instruction changes carefully, too: an agent should not quietly rewrite the rules used to evaluate its own work.
Correctness: plausible logic beside traced behavior
- Standard review: Read the implementation and check its behavior against the documented contract.
- Claude Code review: Trace one successful request and two failure paths through actual callers.
For that retry patch, follow a timeout, an authentication failure, and a partially completed write. Check cancellation, deadlines, and whether the response body gets consumed before another attempt. Verify unfamiliar library methods against the installed version rather than accepting a familiar-looking API.
Also check error translation. Turning every upstream exception into a successful empty response can make tests green while breaking the caller's ability to recover.
Tests: green output beside independent evidence
- Standard review: Run the relevant tests and confirm existing coverage remains green.
- Claude Code review: Verify that a regression test fails before the fix and passes afterward.
Use a separate worktree or temporary branch to check the pre-fix behavior without disturbing your working changes. If the regression test passes there, it has not demonstrated the bug. Check assertions for observable outcomes, not merely that a mocked helper was called.
Run commands yourself and read the output, including skipped tests. An agent's summary is a useful index, not an execution record you should trust without checking.
Safety: application permissions beside terminal permissions
- Standard review: Inspect authentication, input validation, secret handling, and dependency changes before approving.
- Claude Code review: Also inspect new scripts and commands before granting execution permissions.
A test helper that downloads and executes a remote script deserves scrutiny even when application code is harmless. Look for destructive cleanup commands, expanded filesystem access, credentials printed in debug logs, and fixtures containing real customer data. Keep execution sandboxed where practical, and do not approve elevated permissions simply to unblock a green check.
Second opinions through Fluxo without shared blind spots
When a diff remains ambiguous, I ask for a narrowly scoped second review: identify retry paths that could duplicate writes, citing files and functions. With Fluxo, one key and one base URL, https://api.fluxorelay.com, provide access to Claude, GPT, Gemini, DeepSeek, Kimi, GLM, Qwen, Grok, and more. For example, Claude Sonnet 5.5 can draft a patch while GPT-6.1 Sol challenges its assumptions.
Fluxo works with Claude Code, Codex, Gemini CLI, and any OpenAI SDK. Billing is per real token, including cache reads and writes, with no monthly fee, so keep review context focused. If that fits your terminal workflow, you can create a Fluxo account. Users also earn a referral share when people they invite pay; that is separate from the technical review decision.
Merge verdict: keep the checklist, raise the evidence bar
The agent-aware checklist wins, but it supplements rather than replaces ordinary review. Merge when scope is justified, behavior is traced, regression evidence holds, and permissions are appropriate. Request changes when any condition fails. Claude Code accelerates implementation; the reviewer still owns the decision to ship.