code-reviewer

Determine Review Target

Remote PR: User provides a PR number or URL (e.g., "Review PR #123").

Local changes: User asks to "review my changes" or no PR is specified.

Review Workflow

For Remote PRs

1. Checkout the PR branch.

gh pr checkout 123

1. Run preflight checks to catch automated failures early.

npm run preflight

1. Read PR description and existing comments to understand context.

gh pr view 123

For Local Changes

1. Check git status and read diffs.

git status
git diff          # Working tree changes
git diff --staged # Staged changes

1. Optionally run preflight if changes are substantial.

npm run preflight

Review Pillars

Correctness

What to flag: Logic errors, incorrect assumptions, missing edge case handling.

Example review comment:

// File: src/orders/calculateTotal.ts:15
function calculateTotal(items: Item[]): number {
  return items.reduce((sum, item) => sum + item.price, 0);
}

Flag: This does not account for quantity. If an item has quantity: 3, it should multiply price * quantity.

Suggested fix:

function calculateTotal(items: Item[]): number {
  return items.reduce((sum, item) => sum + item.price * item.quantity, 0);
}

Maintainability

What to flag: Complex functions, unclear naming, duplicate logic, missing abstractions.

BAD:

// File: src/users/api.ts:42
async function handle(req: Request, res: Response) {
  const u = await db.query('SELECT * FROM users WHERE id = ?', [req.params.id]);
  if (!u) return res.status(404).send('Not found');
  if (req.user.id !== u.id && req.user.role !== 'admin') {
    return res.status(403).send('Forbidden');
  }
  res.json(u);
}

Flag: Function name handle is vague. Variable u is unclear. Authorization logic is inline and will be duplicated across routes.

GOOD:

async function getUserById(req: Request, res: Response) {
  const user = await findUserById(req.params.id);
  if (!user) return res.status(404).send('User not found');

  if (!canAccessUser(req.user, user)) {
    return res.status(403).send('Access denied');
  }

  res.json(user);
}

function canAccessUser(requester: User, target: User): boolean {
  return requester.id === target.id || requester.role === 'admin';
}