review-async-lifecycle

review-async-lifecycle is a skill for Claude Code, Codex from explyt/spring-plugin. It costs 66 tokens per session (4,069 once invoked), scanned A, original, Apache-2.0.

A project-specific code-review guide for checking asynchronous work, threading, cancellation, listeners, resource cleanup, and safe updates in the explyt Spring plugin. It treats its rules as required standards.

In plain words
What is it for?
Reviewing changes to inspections, code completion, reference resolution, line markers, gutter actions, external-system imports, coroutines, callbacks, read/write actions, listeners, or disposable resources.
Why use it?
It helps reviewers find freezes, race conditions, unfinished background work, incorrect UI updates, and resources that are not cleaned up. It also provides checklist IDs for recording relevant findings.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/explyt/spring-plugin/review-async-lifecycle
Any agent
npx skills add explyt/spring-plugin --skill review-async-lifecycle
Clone the repo
git clone --depth 1 https://github.com/explyt/spring-plugin

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for review-async-lifecycle

README.md
[![agentmods](https://agentmods.dev/badge/skills/explyt/spring-plugin/review-async-lifecycle.svg)](https://agentmods.dev/skills/explyt/spring-plugin/review-async-lifecycle)
Your own site
<a href="https://agentmods.dev/skills/explyt/spring-plugin/review-async-lifecycle"><img src="https://agentmods.dev/badge/skills/explyt/spring-plugin/review-async-lifecycle.svg" alt="Measured on agentmods" height="20"></a>
Per session 66 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 4,069 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00066 $0.04069
Opus 5 $0.00033 $0.02034
Sonnet 5 $0.00013 $0.00814
Haiku 4.5 $0.00007 $0.00407

Measured 5d ago against content hash 1267d406d5a4, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

review-async-lifecycle scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.explyt/skills/review-async-lifecycle/SKILL.md · 236 lines

How it starts

The opening of the file, as written. The whole thing — 236 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Async and lifecycle reviewer

You are a specialized reviewer for threading, coroutines, lifecycle and freeze-safety. This is a normative skill, not a short checklist brief. If a rule below applies, treat it as a project-specific standard, not an optional recommendation.

Owned checklist IDs

Use and reference these checklist IDs when applicable:

  • H1, H10, H11, H16, H23, H24, H25, H26, H27, H28, H29, H30, H31, H32, H33
  • H34, H34a, H34b, H47, H54, H55, H56, H57, H58, H59, H60, H61, H62, H63
  • H64, H65, H66, H68
  • also reference H36 (owned by review-ui-platform) when a UI update path violates threading rules
  • also reference G1, G5, G12 when async/lifecycle bugs break correctness or resilience

Non-negotiable review method

  1. Read REVIEW_SCOPE.md and REVIEW_PACKET.md first.
  2. Identify async entry points, coroutine scopes, callbacks, listeners, disposables, read/write actions and UI update paths. In this plugin the hottest entry points are inspections, line marker providers, completion contributors, reference resolution, gutter handlers and external-system import.
  3. Trace the flow on:
    • success;
    • exception;
    • cancellation;
    • disposal;
    • repeated invocation;
    • project close / plugin reload.
  4. If you find one async/lifecycle bug, apply the Neighborhood Scan Rule: scan the whole method, then the whole class, then sibling files. Bug patterns cluster.
  5. Do not flag coroutine usage by itself. Report only real defect patterns.

Hard rules

1. Core threading rules

Rule: Never perform file I/O, network calls, PSI access, or runBlocking on EDT.

  • No runBlocking outside tests. Period. Check callers — a method may be invoked from EDT indirectly (e.g. from AnAction.actionPerformed, a gutter click handler, or a LineMarkerProvider). Even on background threads, runBlocking inside IntelliJ lock-holding contexts deadlocks.
  • File I/O / network inside invokeLater {}, dispose(), event handlers = EDT freeze.
  • PSI access without runReadAction {} / readAction {} = race condition.
  • Kotlin Analysis API used from EDT = freeze.
  • Synchronous file reads in UI renderers or gutter/line-marker handlers = freeze.
  • Prefer Dispatchers.IO for all background tasks. Accidental I/O on Default is far worse than accidental compute on IO. Use Default only for pure CPU-bound work with absolutely zero I/O. Mixing dispatchers is the most common dispatcher mistake.
  • Dispatchers.EDT is required not only for UI updates, but also when calling some IntelliJ platform services that require it (for example CompilerManager). When uncertain, trace usages in intellij-community source code.
  • Avoid runWriteAction {} in coroutine code — prefer suspending writeAction {} / edtWriteAction {}. It is often non-trivial to prove the caller is not under a background read lock, and runWriteAction there causes deadlocks. For write commands with undo support, use WriteCommandAction.runWriteCommandAction() (blocking contexts) or the suspending writeCommandAction() API.
  • WriteAction.run from a background thread is forbidden — write actions must execute on EDT; prefer suspending writeAction {}.
  • SwingUtilities.invokeLater() forbidden for write actions — no ModalityState support. Use Application.invokeLater().
  • SwingUtilities.invokeLater with PSI/VFS/model access is unsafe since 2025.1 — there is no implicit write-intent lock. Use Application.invokeLater() or explicit ReadAction / WriteAction.
  • AWT event handlers accessing PSI/VFS are unsafe since 2026.1 — there is no implicit write lock. Wrap such access in ReadAction.nonBlocking {} or WriteIntentReadAction.run {}.
  • ReadAction.compute / ReadAction.run are deprecated since 2026.1. Use runReadAction in blocking code or cancellable readAction {} in coroutines.
  • ModalityState.any() + write action = forbidden. Use defaultModalityState() or nonModal().
  • No write actions in UI renderers (paint(), TableCellRenderer, ListCellRenderer).
  • Minimize write action scope — move all preparation (PSI reads, computations) outside.
  • DumbService.smartInvokeLater() instead of invokeLater() when code accesses indexes.
  • DumbService.isDumb() is a point-in-time check (TOCTOU race). Prefer smartReadAction(project) which handles it automatically. Raw isDumb() only as fail-fast optimization, never as correctness guard.
  • No suspend calls inside readAction {} lambda — compile error or deadlock.
  • No manual throw ProcessCanceledException() — use ProgressManager.checkCanceled().
  • Usage-statistics recording (StatisticService) must be fire-and-forget and cheap — never block the calling thread, never perform I/O on EDT.
  • while (true) { delay() } loops → prefer Alarm-based repetition (com.intellij.util.Alarm) to avoid a false Plugin slowing things down banner.
  • Non-suspend functions requiring write lock → annotate @RequiresWriteLock; requiring EDT → @RequiresEdt. Exception: functions in packages/classes with view or ui in the name.
  • runBlockingCancellable — background-thread-only replacement for runBlocking in platform extension points (CompletionProvider, LocalInspectionTool). Annotated @RequiresBackgroundThread. NOT a general replacement in arbitrary contexts.

Read the full file on GitHub · 236 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 236 lines · 66 tokens per session scan A 1267d406d5a4

Subscribe to this mod's changes

review-async-lifecycle is a skill published in the GitHub repository explyt/spring-plugin (160 stars, last pushed yesterday), licensed Apache-2.0. It adds 66 tokens to every session and 4,069 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.