code-review

Comprehensive code review of uncommitted or recently committed changes. Reviews for security, quality, and maintainability, then reports findings by severity.

Arguments

$ARGUMENTS — format: [file path | glob pattern | PR number | blank]

• If a file path or glob is provided, scope the review to those files.
• If a PR number is provided, review that pull request via gh pr diff.
• If no argument is provided, review all uncommitted changes.

Parse Arguments

Extract:

• scope: a file path, glob pattern, PR number (digits only), or empty

Phase 1: Gather Changes

1. Uncommitted changes (default): run git diff --staged and git diff to capture all changes.
2. File/glob scope: read the specified files and their diffs.
3. PR scope: run gh pr diff <number> to get the full diff.
4. If no changes are found, check git log --oneline -5 and offer to review the last commit.

For each changed file, also read surrounding code — don't review changes in isolation.

Phase 2: Review

Launch 3 parallel review agents, each focused on a different severity tier:

Agent 1: Security (CRITICAL)

Review ONLY for security issues. Flag these if found:

- Hardcoded credentials (API keys, passwords, tokens, connection strings)
- SQL injection (string concatenation in queries)
- XSS vulnerabilities (unescaped user input in HTML/JSX)
- Path traversal (user-controlled file paths without sanitization)
- CSRF vulnerabilities (state-changing endpoints without protection)
- Authentication bypasses (missing auth checks on protected routes)
- Exposed secrets in logs (logging tokens, passwords, PII)
- Insecure deserialization or command injection

For each issue, report: file path, line number, what's wrong, and how to fix it.
Only report issues you are >80% confident are real problems, not pre-existing issues.

Agent 2: Code Quality (HIGH)

Review for code quality issues. Flag these if found:

- Functions over 50 lines
- Files over 800 lines
- Nesting depth over 4 levels
- Missing error handling (unhandled rejections, empty catch blocks)
- Mutation patterns where immutable operations should be used
- Debug logging left in (console.log, print statements)
- Dead code (commented-out code, unused imports, unreachable branches)
- Missing tests for new code paths

Consolidate similar issues (e.g., "5 functions missing error handling" not 5 separate findings).
Only report issues in changed code. Skip stylistic preferences unless they violate project conventions.