review-parallel

Run the following script to launch parallel Codex code reviews on current uncommitted changes. Each agent focuses on a different review category for deeper, more thorough analysis.

set -e

REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
cd "$REPO_ROOT"

echo "=== Parallel Codex Review: uncommitted changes ==="

# 1. Prerequisites
command -v codex >/dev/null 2>&1 || { echo "ERROR: codex not installed (npm install -g @openai/codex)"; exit 1; }
command -v jq >/dev/null 2>&1 || { echo "ERROR: jq not installed (brew install jq / apt install jq)"; exit 1; }

# 2. Collect changed files
FILES=$(git diff --name-only 2>/dev/null; git diff --cached --name-only 2>/dev/null)
# Include untracked files
UNTRACKED=$(git ls-files --others --exclude-standard 2>/dev/null || true)
FILES=$(printf '%s\n%s' "$FILES" "$UNTRACKED" | sort -u | grep -v '^$' || true)
FILE_COUNT=$(echo "$FILES" | grep -c . 2>/dev/null) || FILE_COUNT=0

if [ "$FILE_COUNT" -eq 0 ]; then
  echo "ERROR: No uncommitted changes found."
  exit 1
fi

echo "Files to review ($FILE_COUNT):"
echo "$FILES" | sed 's/^/  - /'

# 2b. Detect file types for smart agent selection
HAS_CODE=false
HAS_TESTS=false
if echo "$FILES" | grep -qE '\.(ts|tsx|js|jsx|py|go|rs|java|rb|sh|sql|swift|kt)$'; then
  HAS_CODE=true
fi
if echo "$FILES" | grep -qE '\.(ts|tsx|js|jsx|py|go|rs|java|rb)$'; then
  HAS_TESTS=true
fi

# 3. Load project conventions
CONVENTIONS=""
if [ -f "AGENTS.md" ]; then
  CONVENTIONS=$(cat AGENTS.md 2>/dev/null || true)
elif [ -f "CLAUDE.md" ]; then
  CONVENTIONS=$(cat CLAUDE.md 2>/dev/null || true)
fi

CONVENTIONS_BLOCK=""
if [ -n "$CONVENTIONS" ]; then
  CONVENTIONS_BLOCK="PROJECT CONVENTIONS (from AGENTS.md):
---
${CONVENTIONS}
---"
fi

# 4. Build file scope instruction
FILE_SCOPE="IMPORTANT — FILE SCOPE: Only review these files:
$(echo "$FILES" | sed 's/^/  - /')

For tracked files: \`git diff -- <file>\`. For NEW (untracked) files: \`cat <file>\` (git diff shows nothing for untracked).
Do NOT review unrelated changes."

# 5. Build per-agent prompts
DIFF_PROMPT="You are performing an independent code review focused on the DIFF of recent changes.

${FILE_SCOPE}

${CONVENTIONS_BLOCK}

For each scoped file: run \`git diff -- <file>\` for tracked, \`cat <file>\` for untracked.

Review criteria — focus EXCLUSIVELY on changed code:

Code Quality: Well-organized, modular, readable? DRY? Clear names? Right abstraction level?
Test Coverage: Every new function/endpoint has tests? Edge cases? Tests verify behavior?
AI Agent Anti-Patterns (CRITICAL): Mocks just to pass tests? Code replaced with TODO? Unused _params? Hardcoded values? Duplicate utility functions?

For each issue: [P0/P1/P2/P3] description — file:line
P0=blocks ship, P1=must fix, P2=should fix, P3=nice to have"

HOLISTIC_PROMPT="You are performing an independent code review focused on ARCHITECTURE and STRUCTURE.

${FILE_SCOPE}

Review changed modules for:
Code Organization: Logical structure? Proper separation of concerns? God files? Clean imports?
Documentation: AGENTS.md present? Conventions documented? Type coverage?
Architecture: Clean dependency graph? Abstractions for external integrations? Centralized config?

For each issue: [P0/P1/P2/P3] description — file:line (or directory)
P0=blocks ship, P1=must fix, P2=should fix, P3=nice to have"

SECURITY_PROMPT="You are performing an independent SECURITY-focused code review.

${FILE_SCOPE}

${CONVENTIONS_BLOCK}

For each scoped file: run \`git diff -- <file>\` for tracked, \`cat <file>\` for untracked.

Auth: Auth checks on ALL protected routes? Authorization (not just authentication)? Sessions secure?
Injection: SQL injection? XSS? Command injection? Path traversal? SSRF?
Data: Secrets hardcoded/logged? PII in logs/errors? Error messages leak internals?
Abuse: Rate limiting? Expensive ops protected? Upload limits?

For each issue: [P0/P1/P2/P3] description — file:line
P0=exploit possible, P1=must fix, P2=defense-in-depth, P3=hardening"

SIMPLIFY_PROMPT="You are performing an independent code review focused on SIMPLIFICATION and REUSE of the recent changes.

${FILE_SCOPE}

${CONVENTIONS_BLOCK}

For each scoped file: run \`git diff -- <file>\` for tracked, \`cat <file>\` for untracked. Then explore the codebase (\`grep\`, \`find\`, \`cat\`) to find existing utilities, helpers, services, and patterns the diff could have leveraged.

Challenge the diff's complexity. The bar: would a careful senior engineer have written less code?

Reuse misses: Does the diff reinvent something the codebase already has? Point to the exact existing file:line and show what should have been called/imported instead.
Over-abstraction: New class/interface/factory/wrapper where a function (or inline code) would do? Premature generalization for one caller? Three similar lines beats an abstraction.
Dead defense: Try/catch around code that can't throw? Null checks on values the type system guarantees? Validation at internal boundaries? Fallbacks for scenarios that can't happen?
Unneeded scaffolding: New config keys, feature flags, env vars, or migration steps that aren't load-bearing? Backwards-compatibility shims for code with no external callers?
Wrong shape: Is there a fundamentally simpler way to achieve the same outcome — different data model, different API shape, simpler control flow? Could a small refactor of existing code have made this trivial?
Speculative generality: Options/params/branches added 'in case' rather than for a current caller? Hooks/extension points with one implementation?
Comment & dead-code bloat: Comments restating what the code says? Re-exports, renamed _vars, '// removed' breadcrumbs?

For each finding, be SPECIFIC: point to the existing code (file:line) that should have been reused, or name the abstraction/branch/flag that should be deleted, and show the shorter version.

For each issue: [P0/P1/P2/P3] description — file:line (+ existing-code file:line when relevant)
P0=clearly reinvents existing code or major over-engineering, P1=meaningful simplification possible, P2=should trim, P3=nit"

TESTS_PROMPT="You are performing an independent code review focused on TEST QUALITY and COVERAGE.

${FILE_SCOPE}

For each scoped file: run \`git diff -- <file>\` for tracked, \`cat <file>\` for untracked.
Also examine existing test files in the same directories.

Missing Coverage: Every public function/endpoint has tests? Error paths tested? Edge cases?
Test Quality: Tests verify behavior not implementation? Isolated? Deterministic? Specific assertions?
Anti-Patterns: Over-mocking? Testing privates? Tautological assertions?
Integration: DB writes tested with real DB? API routes full cycle? Multi-step workflows?

For each issue: [P0/P1/P2/P3] description — file:line
P0=untested critical path, P1=significant gap, P2=should add, P3=nice to have"

# 6. Launch parallel agents (smart selection based on file types)
OUTDIR="/tmp/codex-parallel-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$OUTDIR"
CODEX_FLAGS="${REVIEW_LOOP_CODEX_FLAGS:---dangerously-bypass-approvals-and-sandbox}"
START_TIME=$(date +%s)
PIDS=()
AGENT_IDX=0

echo ""
echo "Output → $OUTDIR/"

# Diff + Holistic always run
AGENT_IDX=$((AGENT_IDX + 1))
# shellcheck disable=SC2086
codex exec review "$DIFF_PROMPT" $CODEX_FLAGS >/dev/null 2>"${OUTDIR}/${AGENT_IDX}-diff.raw" &
PIDS+=($!)

AGENT_IDX=$((AGENT_IDX + 1))
# shellcheck disable=SC2086
codex exec review "$HOLISTIC_PROMPT" $CODEX_FLAGS >/dev/null 2>"${OUTDIR}/${AGENT_IDX}-holistic.raw" &
PIDS+=($!)

# Security: skip if only docs/config/markdown changed
if [ "$HAS_CODE" = "true" ]; then
  AGENT_IDX=$((AGENT_IDX + 1))
  # shellcheck disable=SC2086
  codex exec review "$SECURITY_PROMPT" $CODEX_FLAGS >/dev/null 2>"${OUTDIR}/${AGENT_IDX}-security.raw" &
  PIDS+=($!)

  AGENT_IDX=$((AGENT_IDX + 1))
  # shellcheck disable=SC2086
  codex exec review "$SIMPLIFY_PROMPT" $CODEX_FLAGS >/dev/null 2>"${OUTDIR}/${AGENT_IDX}-simplify.raw" &
  PIDS+=($!)
else
  echo "  Skipping security review (no code files in scope)"
  echo "  Skipping simplify review (no code files in scope)"
fi

# Tests: skip if no testable code
if [ "$HAS_TESTS" = "true" ]; then
  AGENT_IDX=$((AGENT_IDX + 1))
  # shellcheck disable=SC2086
  codex exec review "$TESTS_PROMPT" $CODEX_FLAGS >/dev/null 2>"${OUTDIR}/${AGENT_IDX}-tests.raw" &
  PIDS+=($!)
else
  echo "  Skipping tests review (no testable code in scope)"
fi

AGENT_COUNT=${#PIDS[@]}
echo "Launching ${AGENT_COUNT} parallel codex agents..."
echo "---"

FAILURES=0
for pid in "${PIDS[@]}"; do
  wait "$pid" || FAILURES=$((FAILURES + 1))
done

ELAPSED=$(( $(date +%s) - START_TIME ))

# 7. Clean each agent's output and merge
REVIEW_FILE="${OUTDIR}/review-combined.md"
{
  echo "# Parallel Code Review — ${AGENT_COUNT} Agents"
  echo ""
  echo "Files: ${FILE_COUNT} | Agents: ${AGENT_COUNT} | Duration: ${ELAPSED}s"
  echo ""
} > "$REVIEW_FILE"

for f in "${OUTDIR}"/*.raw; do
  [ -f "$f" ] || continue
  AGENT_NAME=$(basename "$f" .raw | sed 's/^[0-9]-//')

  # Strip codex noise
  if [[ "$OSTYPE" == "darwin"* ]]; then
    sed -i '' '/^mcp:/d; /^Warning:/d; /^thinking$/d; /^exec$/d; /^user$/d; /^OpenAI Codex/d; /^--------$/d; /^workdir:/d; /^model:/d; /^provider:/d; /^approval:/d; /^sandbox:/d; /^reasoning/d; /^session id:/d' "$f" 2>/dev/null || true
  else
    sed -i '/^mcp:/d; /^Warning:/d; /^thinking$/d; /^exec$/d; /^user$/d; /^OpenAI Codex/d; /^--------$/d; /^workdir:/d; /^model:/d; /^provider:/d; /^approval:/d; /^sandbox:/d; /^reasoning/d; /^session id:/d' "$f" 2>/dev/null || true
  fi

  # Extract after last "codex" marker
  if grep -q "^codex$" "$f" 2>/dev/null; then
    LINE=$(grep -n "^codex$" "$f" | tail -1 | cut -d: -f1)
    if [ -n "$LINE" ]; then
      tail -n +"$((LINE + 1))" "$f" > "${f}.clean"
      mv "${f}.clean" "$f"
    fi
  fi

  {
    echo "---"
    AGENT_TITLE="$(echo "$AGENT_NAME" | awk '{print toupper(substr($0,1,1)) substr($0,2)}')"
    echo "## ${AGENT_TITLE} Review"
    echo ""
    if [ -s "$f" ]; then
      cat "$f"
    else
      echo "_No findings._"
    fi
    echo ""
  } >> "$REVIEW_FILE"
done

echo "---"
echo "${AGENT_COUNT} agents finished (elapsed=${ELAPSED}s, failures=${FAILURES})"
echo "Combined review: $REVIEW_FILE ($(wc -c < "$REVIEW_FILE" | tr -d ' ') bytes)"
echo "Individual: ${OUTDIR}/*.raw"