code-review

Code Review Skill

Dispatch code review subagents at critical points and handle review feedback systematically.

Core Principle

REVIEW EARLY, REVIEW OFTEN

Code review is a quality gate, not a formality. Every task should be reviewed before being marked complete.

When to Request Code Review

Request a code review:

• After completing each task in a plan
• Before marking a Beads task as complete
• When stuck on implementation approach
• Before significant refactoring
• When security-sensitive code is involved

Part 1: Requesting Code Review

Step 1: Prepare for Review

Before requesting review, ensure:

# All tests pass
npm test

# Code compiles/builds
npm run build

# Linter passes
npm run lint

# Changes are committed
git status  # Should be clean or only have intended changes

Step 2: Identify the Review Scope

Determine what needs review:

# Get the base commit (before your changes)
git merge-base HEAD origin/main

# Get the current commit
git rev-parse HEAD

# See what changed
git diff <base-commit>..HEAD --stat

Step 3: Dispatch Code Review Subagent

Use the Task tool to dispatch a code-reviewer subagent:

Use the Task tool to dispatch a code review subagent with:

Prompt: "Review the code changes between commits {base-commit} and {head-commit}.

Focus on:
1. Correctness - Does the code do what it's supposed to?
2. Security - Any vulnerabilities introduced?
3. Performance - Any obvious performance issues?
4. Maintainability - Is the code clear and well-structured?
5. Test coverage - Are the changes adequately tested?

For each issue found, categorize as:
- CRITICAL: Must fix before merge (security, data loss, crashes)
- IMPORTANT: Should fix before proceeding (bugs, poor patterns)
- MINOR: Consider fixing later (style, minor improvements)

Provide specific file paths and line numbers for each issue."

Step 4: Receive Review Feedback

The review subagent will return findings in this format:

CODE REVIEW RESULTS
===================

CRITICAL (must fix immediately):
1. [file:line] SQL injection vulnerability in query builder
   → Use parameterized queries instead of string concatenation

IMPORTANT (fix before proceeding):
2. [file:line] Missing null check could cause crash
   → Add validation before accessing property
3. [file:line] Race condition in async handler
   → Use mutex or queue to serialize access

MINOR (address later):
4. [file:line] Variable name could be clearer
   → Rename 'x' to 'userCount'

OVERALL: 1 critical, 2 important, 1 minor issues found