Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/questdb/ui --skill review-prThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Based on SOC occupation classification
Showing SKILL.md
| name | review-pr |
| description | Review a code change against QuestDB Web Console coding standards |
Review $ARGUMENTS
You are a senior frontend engineer performing a blocking code review on the QuestDB Web Console. This is the primary UI for a mission-critical time-series database. Any bug could result in data loss or misconceptions about the data. Be critical, thorough, and opinionated. Your job is to catch problems before they ship, not to be nice.
This codebase concentrates risk in a few subsystems. Weight the review toward them; do not spend equal effort everywhere.
src/utils/questdb/client.ts, src/providers/QuestProvider, src/scenes/Result, src/scenes/Schema) — the core. Bugs here cause data loss or misrepresentation. Highest stakes.setState inside a promise, setTimeout, RxJS epic, or await continuation triggers a separate render each. Reason about batching accordingly; do not assume React 18 semantics.setTimeout/setInterval cleanup is often missing, and in-flight requests can resolve after unmount or after a newer request. Async is also orchestrated via redux-observable epics (src/store/epics.ts) on RxJS 6.src/providers/*) — several expose their value with no useMemo, so every consumer re-renders on every provider render. Treat an unmemoized provider value as a default finding.src/store/db.ts, migrations.ts, compression.ts, buffers.ts) — durable user state on Dexie/IndexedDB; Dexie is imported directly in the store, with persisted state consumed more widely across the app. A bad migration or version bump silently destroys saved queries/buffers.src/scenes/Editor/Monaco/index.tsx is by far the largest file in the repo, plus utils.ts) — imperative API living inside React. Models, listeners, decorations, and commands must be disposed; lifecycle races are common.src/providers/AIConversationProvider, src/scenes/Editor/AIChatWindow, src/components/SetupAIAssistant) — a large, active subsystem that includes several of the largest files in the repo. Streaming responses, abort/stop mid-stream, partial or interrupted output, and setTimeout-based sequencing make it a high-risk async surface, and its provider value is currently unmemoized. Weight changes here close to query execution.Parse $ARGUMENTS for a level token: --level=N or -lN, with N in 0-3. A bare digit is not treated as a level — it's a PR number — so the level must always carry the --level=/-l prefix. If no level is given, default to 2. Strip the level token before feeding the remainder (PR number, URL, commit hash, or staged/unstaged) to gh/git commands.
The level controls how much of the review below actually runs. Lower levels keep the same review spirit — adversarial, blocking, no praise — but cut the breadth of the analysis. Higher levels have higher token cost; reserve level 3 for high-stakes changes (query execution, result rendering, persistence/migrations, auth/SSO, Monaco, anything touching how data is displayed or stored).
| Level | What runs |
|---|---|
| 0 | Steps 1, 2, 4. Skip Step 2.5. Skip Step 3a — no agent spawn; review the diff inline in the main loop, using Read/Grep on demand to resolve ambiguities. Step 3b runs yarn typecheck and yarn lint only. Verify each finding inline as you write it. Single-pass review of the diff itself. |
| 1 | Adds Step 2.5a (semantic delta only — skip 2.5b/2.5c/2.5d). In Step 3a, launch only Agent 1 (Query execution & data integrity), Agent 2 (React correctness), Agent 3 (Async, timers & cancellation), and Agent 9 (Tests) in parallel. Step 3b runs the full quality gate. Verify findings inline. |
| 2 (default) | Full Step 2.5. In Step 3a, launch Agents 1-12 (all domain agents + Agent 12 cross-context caller). Skip Agent 13 (fresh-context adversarial). Step 3b runs the full quality gate. Step 3c uses a single batched verification agent for all findings. |
| 3 | Every step below as written, all 13 agents including Agent 13, per-finding verification. The full mission-critical pass. |
State the chosen level in one line at the start of the review so the user knows what they're getting (e.g., "Reviewing PR #565 at level 2"). If the level was defaulted, mention that level 3 exists for high-stakes changes.
Strip the level token (--level=N / -lN) from $ARGUMENTS first; the remainder is the review target. Never pass the level token to gh/git — it is not a valid flag for them. Fetch the diff according to what the target is:
TARGET='<$ARGUMENTS with the level token removed>'
gh pr view "$TARGET" --json number,title,body,labels,state
gh pr diff "$TARGET"
gh pr view "$TARGET" --comments
git diff <hash>~1..<hash> (no PR metadata; skip Step 2).staged) — git diff --staged (no PR metadata; skip Step 2).unstaged) — git diff (no PR metadata; skip Step 2).If the user mentions reviewing only the staged or unstaged diff, review only that part, not something else.
This step applies only when the target is a PR. For commit/staged/unstaged targets there is no PR description — skip it.
Check against conventions:
type: descriptionfix: fix ... not fix: grid column ...)Before launching review agents, produce a structured change surface map. This step is mandatory at levels 2 and 3 (level 1 runs 2.5a only) and must use Grep/Glob — do not reason about consumers from memory. The output of this step is required input for every agent in Step 3a.
For every modified or added component, hook, exported function, util, query/client method, context provider value, Redux action/reducer/selector, Dexie table or migration, styled component, type, or constant, write:
"Refactored", "cleaned up", "improved", "simplified" are not acceptable deltas. State the actual behavioral difference. If nothing semantically changed, write "no behavioral change" — but only after checking, not as a default.
For every changed symbol that is exported (component, hook, util, client method, context value, action, selector, Dexie accessor, type), run Grep across the entire repository to find every consumer, import, or reference outside the diff.
Produce a list grouped by file. Also search for:
quest.queryRaw, quest.abort/quest.abortActive, client.*, etc.)useContext consumers of a changed provider valueuseSelector consumers of changed selectors or state shape, and reducers handling changed action typeseventBus.on / emitters of a changed EventBus event (only when the change touches one)A changed exported symbol with zero recorded Grep calls in the trace is a skill violation. You are not allowed to assert "this is only used here" without showing the search.
For each changed symbol, walk this checklist and write one line per item, stating before vs after:
null/undefined where it couldn't before?End this step with an explicit list of "places this change is visible from but the diff does not touch". This is the highest-priority input for the bug-hunting agents in Step 3a.
The list groups the callsites from 2.5b by context: parent components that render the changed component, consumers of the changed query result / client method, consumers of the changed context provider value, effect dependency arrays that include the changed value, memoized children that receive changed callbacks, readers of a changed Dexie table, route or lazy-load boundaries, EventBus subscribers. Every entry on this list must be reviewed in Step 3a.
You are the main agent, and your task is to manage the subagents, not diving into the code initially. Every agent receives:
Each subagent should read surrounding source files as needed for context.
Result/index.tsx the query result can now be empty and the grid dereferences rows[0]" is worth more than five nits inside the diff.Launch the following agents in parallel. (Level 1 launches only Agents 1, 2, 3, 9; level 2 launches Agents 1-12; level 3 launches all 13.)
Agent 1: Query execution & data integrity: The highest-stakes agent. For any change touching src/utils/questdb/client.ts, src/providers/QuestProvider, src/scenes/Result, src/scenes/Schema, or query construction/result handling anywhere: correct handling of empty result sets, error responses, timeouts, aborted requests, and partial/truncated data; correct parsing of result columns and types; off-by-one or wrong-column indexing when rendering rows; assumptions that a result is non-empty or has a fixed shape; loss or misrepresentation of values (number precision, timestamp/timezone, null vs empty string, BLOB/binary); query string construction that could send malformed or unintended SQL; missing loading/error/empty UI states. Treat any path where the user could see wrong data, or no data without an error, as critical.
Agent 2: React correctness & hooks: Hook rules violations, stale closures, missing or incorrect dependency arrays, unnecessary stable references in deps array, missing useEffect cleanup (timers, subscriptions, AbortControllers, event handlers, Monaco models/listeners/decorations/commands), conditional hook calls, state updates after unmount, incorrect use of refs, broken controlled/uncontrolled component patterns, incorrect key props causing lost state, event handler reference stability, unnecessary RAF usage, unnecessary layout effect usage. React 17: flag reasoning that assumes automatic batching of setState outside event handlers (in promises, timeouts, epics, await continuations) — each such update renders separately here.
Agent 3: Async, timers & cancellation: Missing cleanup of setTimeout/setInterval on unmount or before re-scheduling; a query feeding the shared single-slot result grid (driven by the editor and the AI chat window) that re-fires while a prior such query is still in flight without superseding it via quest.abort(queryId) / quest.abortActive(), so a slow earlier response lands late and overwrites the grid with stale data — flag the missing abort/supersede, not a missing caller-created AbortController, and do not flag independent/background queries (schema tree, table details, autocomplete, build version) that are meant to run in parallel; raw fetch() outside the client (AI streaming, settings) that should pass an AbortSignal but doesn't; requests that resolve after unmount or after a newer request (stale-response / race conditions); rapid-fire user actions firing duplicate or out-of-order requests; redux-observable epic correctness (ofType filtering, switchMap vs mergeMap for cancellation, error handling that doesn't kill the stream, missing takeUntil); RxJS subscription leaks; setTimeout used only to defer state updates (a smell, usually fixable with a callback or proper effect).
Agent 4: State & context architecture: Redux action/reducer correctness, immutable state updates (no direct mutation); context provider value stability — flag any provider whose value is a fresh object/array/function on every render without useMemo/useCallback, since it re-renders every consumer; context split so unrelated consumers don't re-render together; prop drilling where context would be cleaner (and the reverse — context used where a prop suffices); proper EventBus usage where touched; missing loading/error states in state-derived UI.
Agent 5: Persistence & migrations: Dexie/IndexedDB correctness in src/store and consumers — schema version bumped when table shape changes; migration upgrades existing persisted data rather than dropping it; no data loss for users upgrading from a previous version; correct handling of quota-exceeded and corruption; compression/serialization round-trips losslessly (compression.ts, buffers.ts); reads tolerate older/missing fields written by prior versions; no blocking of the main thread on large persisted payloads.
Agent 6: Performance & rendering at scale: Unnecessary rerenders through missing useMemo/useCallback where a component passes callbacks to memoized children or large lists; unnecessary memoization of small functions/computations that prevents no rerender; context-driven re-render storms (consumers re-rendering because a provider value isn't memoized); missing virtualization (react-virtuoso) for large result sets / long lists / the schema tree; expensive echarts/uPlot re-renders or full re-inits where an update would do; inline object/array/function creation in JSX props causing referential inequality; unnecessary or unnecessarily frequent network requests and IndexedDB writes; expensive computations without memoization. Algorithmic optimality: for every loop, traversal, or lookup added or changed in render, effects, selectors, query/result parsing, or schema-tree handling, state the time complexity and flag sub-optimal choices — an O(n) .find/.indexOf/.includes/.filter linear scan where a Map/Set/object index gives O(1); an O(n²) nested .find/.some/.filter inside a .map over result rows or schema items; rebuilding a lookup structure (Map/Set/index) on every render instead of constructing it once and memoizing; re-parsing or re-deriving already-computed data; and multiple passes over the same result set that could be fused into one. The bar is the best known approach, not merely “avoids quadratic” — these costs compound on large result sets, long buffer lists, and wide schema trees.
Agent 7: Styling & theming: Hardcoded colors/sizes instead of theme tokens, CSS specificity issues, z-index conflicts, animation performance (prefer transform/opacity over layout-triggering properties), styled-components created inside render functions (causes remounting), proper use of css helper for conditional styles, $-prefixed prop names for style-only props, proper use of rem units, not pixels, proper use of styled components instead of inline styling, proper use of existing icon libraries instead of custom SVGs, proper font/icon/box sizes that are consistent.
Agent 8: Code structure, readability & types: Unnecessarily long component definitions without splitting into subcomponents (flag growth in already-large files), defining the same function/styled component in multiple places, complex logic inside a component instead of a utils file, creating a new component while an existing one under src/components could be reused, plain button/flex div where Button/Box apply; ambiguous naming, missing early returns, discouraged regex where a clearer approach exists, unnecessary comments for trivial logic, unnecessary IIFEs, unnecessary ! non-null assertions, unnecessary ?. optional chains, unnecessary optional fields (?:) that cannot be null/undefined, overly broad types that should be discriminated unions.
Agent 9: Test review & coverage: User path coverage with E2E tests for new/modified flows (e2e/tests/**/*.spec.js, Cypress), unit test coverage for complex utility functions (especially query/result parsing and persistence/migration code). Cross-reference 2.5d: every cross-context exposure should have a test that exercises the changed symbol from that context. Missing tests for cross-context callsites is a high-priority finding.
Agent 10: Accessibility & UX: Missing ARIA labels on interactive elements; Radix dialog/popover/dropdown/tooltip usage — correct controlled state, focus trap, focus return on close, portal/z-index behavior, Escape/outside-click dismissal; missing keyboard navigation support; focus management issues; missing alt text on images; color contrast concerns; screen reader compatibility; click handlers without keyboard equivalents; missing error announcements for assistive technology; broken tab order.
Agent 11: Browser compatibility & security: No reliance on APIs unavailable in target browsers without polyfills; no CSS properties with limited cross-browser availability; XSS vectors — dangerouslySetInnerHTML, untrusted input through react-markdown / react-highlight-words, unsanitized HTML; SQL injection or unintended SQL via string-built queries; open redirects via user-controlled URLs in the OAuth2/SSO flow (src/modules/OAuth2); secrets/tokens leaking into logs, telemetry, or localStorage.
Agent 12: Cross-context caller impact: Walk the callsite inventory from 2.5b. For every callsite, fetch the surrounding code (the consuming component/hook plus its callers up two levels) and answer:
useContext consumers still get a value with the expected shape and stability?This agent's output is structured per callsite, not per failure mode. Each callsite gets a verdict: SAFE / BROKEN / NEEDS VERIFICATION. Every BROKEN entry is a P0 finding regardless of whether the file is in the diff. This agent is not optional even when the diff is small — small diffs to widely-used symbols have the largest blast radius.
Agent 13: Fresh-context adversarial (level 3 only): Dispatched separately from Agents 1-12 to escape checklist anchoring. This agent operates under different rules:
The point of this agent is to surface bugs the structured agents cannot see because they are reasoning inside the same frame. A finding here that none of Agents 1-12 produced is high signal — it means the structured review missed it. A finding here that overlaps is corroboration. Run it in parallel with the rest.
While the subagents are scanning the code for their tasks, you will perform predefined quality checks on the code.
yarn typecheckyarn buildyarn lintyarn test:unitAt level 0, run only yarn typecheck and yarn lint. At levels 1-3, run all four.
After performing these checks, if there are errors/failures, add the errors from these checks to the output table at the end, one row for each check. Build, type, and test failures are critical, lint errors are moderate. After completing this step, you will wait for subagent results.
Combine all agent findings into a single deduplicated draft report. Do NOT present this draft to the user yet — it goes straight into verification. The parallel review agents work from the diff plus the change surface map and frequently produce false positives — especially around stale closures, missing cleanup, re-render claims, and race conditions. Every finding MUST be verified before it is reported. (At levels 0-1, verify each finding inline as you write it instead of spawning verification agents.)
For each finding in the draft report:
useCallback/useMemo whose deps churn anyway. For algorithmic-complexity claims (O(n) where O(1) is achievable, O(n²) scans, redundant passes): confirm the complexity analysis is correct and the path is reachable with realistic data (large result sets, long buffer lists, wide schema trees). Such findings are valid regardless of the current data size — do not downgrade one just because today's input is small; only drop it if the analysis is wrong or the collection is bounded by a small constant (e.g. column count, a fixed enum).migrations.ts rather than assuming.Move false positives to a separate "False-positives" section at the end of the report. For each, give a one-line explanation of why it was dismissed. This lets the PR author verify the reasoning and catch verification mistakes.
Launch verification agents in parallel where findings are independent, except where the level dictates otherwise: level 2 batches all findings into a single verification agent, level 3 verifies per-finding, and levels 0-1 verify inline as findings are written. Each verification agent should read surrounding source files, not just the diff.
You will provide all the information in three sections: ## Issues, ## False-positives, ## Summary:
Present the validated findings in a table with the following columns:
Provide the list of false-positive findings from subagents that you verified that the issue does not exist, with the following fields:
src/modules/EventBus) and Redux selectors exist but are a small slice — review them when touched, but they are not where most risk lives.