review

name	review
description	Perform a thorough code review of recent changes
user-invocable	true

/review - Code Review

Perform a thorough code review of changes.

Usage

/review [file, PR, or commit]
/review                      # Review staged changes
/review src/auth/login.ts    # Review specific file
/review #123                  # Review PR #123

Review Process

1. Understand Context

Before reviewing:

• What problem does this code solve?
• What was the previous implementation?
• Are there related changes elsewhere?

2. Review Checklist

Correctness

• Does the code do what it's supposed to do?
• Are edge cases handled?
• Is error handling appropriate?
• Are there any logic errors?

Security

• No hardcoded secrets or credentials
• Input validation present
• No SQL injection vulnerabilities
• No XSS vulnerabilities
• Authentication/authorization correct

Performance

• No N+1 query problems
• No unnecessary loops or iterations
• Appropriate data structures used
• No memory leaks

Maintainability

• Code is readable and clear
• Functions are focused and small
• Naming is descriptive
• No code duplication
• Comments explain "why", not "what"

Testing

• Tests cover the changes
• Tests are meaningful (not just for coverage)
• Edge cases tested
• Tests are maintainable

Style

• Follows project conventions
• Consistent formatting
• No leftover debug code
• No commented-out code

3. Provide Feedback

Format feedback clearly:

## Summary
[Overall assessment: approve, request changes, or discuss]

## Highlights
- [What's done well]

## Required Changes
1. **[File:Line]** - [Issue description]
   ```suggestion
   // Suggested fix

Suggestions (Optional)

• [Nice-to-have improvements]

Questions

• [Clarifications needed]

### 4. Severity Levels

Use consistent severity markers:

| Level | Meaning | Action |
|-------|---------|--------|
| 🔴 **Blocker** | Must fix before merge | Required change |
| 🟡 **Warning** | Should fix, potential issue | Strongly suggested |
| 🔵 **Suggestion** | Could improve code | Optional |
| 💬 **Question** | Need clarification | Discussion |
| 👍 **Praise** | Well done | Positive feedback |

## Example Output

```markdown
## Code Review: Add OAuth Login

### Summary
Overall good implementation. A few security concerns need addressing
before merge.

### Highlights
- Clean separation of OAuth providers
- Good error messages for users
- Comprehensive token validation

### Required Changes

1. 🔴 **src/auth/oauth.ts:45** - Token stored in localStorage
   Tokens should be in httpOnly cookies to prevent XSS.
   ```typescript
   // Instead of localStorage, use secure cookie
   res.cookie('token', token, { httpOnly: true, secure: true });

2. 🔴 src/auth/oauth.ts:78 - Missing CSRF protection Add state parameter to OAuth flow.

Suggestions

1. 🔵 src/auth/oauth.ts:23 - Consider extracting provider config This would make adding new providers easier.

Questions

1. 💬 src/auth/types.ts:12 - Why is expiresAt optional? Should tokens always have expiration?

---

Verdict: Request changes (2 security issues)

## Tips

- Be constructive, not critical
- Explain the "why" behind suggestions
- Acknowledge good work
- Offer alternatives, not just criticism
- Consider the author's experience level