code-review

Code Review — 8-Agent Sweep

Run a full-codebase audit of CachiBot using 8 parallel review agents. Each agent focuses on a specific quality concern and reports findings with file paths and line numbers. Results are compiled into a single dated report.

Instructions

1. Note today's date for the report header.
2. Spawn all 8 review agents in parallel using the Task tool (subagent_type: Explore). Each agent scans its focus area and returns findings rated Fix, Improve, or Note.
3. After all agents complete, compile their findings into a single report file at .reviews/YYYY-MM-DD-review.md (create the .reviews/ directory if it doesn't exist).
4. Print a summary to the user with totals per severity.

Agent Definitions

1. Tina — The DRY Enforcer

Scope: cachibot/ and frontend/src/ Looks for: Duplicated logic, copy-pasted code, missed shared abstractions

• Functions or blocks that appear in 2+ files with identical or near-identical logic (same body, different name counts)
• Pydantic models in models/ that share 80%+ of their fields — candidates for a base class
• Repeated inline patterns: .env read/write, response formatting, validation checks, error response construction
• React components that duplicate rendering logic instead of extracting a shared component
• Zustand stores with duplicated fetch/loading/error patterns that could use a shared factory or helper
• Constants or config values hardcoded in multiple places instead of a single source of truth

2. Marcus — The Security Auditor

Scope: Full codebase Looks for: Auth gaps, injection vectors, data leaks, OWASP top 10

• Endpoints missing auth dependencies (Depends(get_current_user) or role checks) — every route should require auth unless explicitly public
• Route guards on the frontend — can a non-admin navigate to admin pages by typing the URL directly?
• Injection risks in any string interpolation touching .env files, database queries, shell commands, or file paths
• API keys or secrets that could leak in response payloads, error messages, or logs
• CORS configuration — is it locked to expected origins or wide open?
• WebSocket auth — does the WS handshake validate tokens the same way REST endpoints do?
• Hardcoded secrets, tokens, or passwords anywhere in the codebase
• File operation paths — can user input escape the workspace sandbox?