code-review

name	code-review
description	Perform thorough TypeScript/Bun code reviews with security, correctness, performance, and maintainability analysis. Use when the user asks to review code, check for bugs, or audit this codebase.

Code Review Skill

Review as a senior TypeScript/Bun engineer. Lead with concrete findings, grounded in file and line references.

Checklist

Security

• Command injection in Bun.spawn, shell tools, or git wrappers
• Path traversal around workspace reads/writes
• Secrets in source, generated data, logs, or screenshots
• Unsafe HTML rendering, markdown rendering, or user-supplied content
• Missing auth around network or database operations
• Dependency risk with bun audit

bun audit
rg -n "password|secret|token|api[_-]?key" .
rg -n "Bun\\.spawn|sh\", \"-lc|dangerouslySetInnerHTML|eval\\(" src web tests

Correctness

• Tool-result shape matches the model provider contract
• stopReason handling covers tool-use and final-response paths
• File state persists with stable JSON/JSONL schemas
• Worktree/task bindings stay consistent after errors
• Background command timeout and completion paths both enqueue results

Performance

• Avoid loading huge files into model context without truncation
• Keep generated JSON size bounded
• Do not block the REPL on long commands when background_run is available
• Avoid repeated full-directory scans in hot paths

Maintainability

• Tool schemas and handlers stay close together
• Chapter entrypoints remain thin wrappers
• Shared behavior lives in src/core
• Tests use fake clients and temporary directories
• Docs and generated web data remain synchronized

Review Commands

bun test
bunx tsc --noEmit
bun run web:extract
bun run web:build
git diff --stat
git diff --check

Output Format

Findings:
- [P1] path/to/file.ts:42 - What breaks, why it matters, and how to fix it.

Open questions:
- Any uncertainty that affects correctness.

Summary:
- Brief note on what was reviewed and residual risk.

Common TypeScript/Bun Findings

// Bad: command injection through unvalidated shell text
Bun.spawn(["sh", "-lc", `git checkout ${branch}`]);

// Better: pass argv when possible
Bun.spawn(["git", "checkout", branch]);

// Bad: path escape
await Bun.write(userPath, content);

// Better: resolve under workspace first
const target = safeWorkspacePath(workspace, userPath);
await Bun.write(target, content);

// Bad: unbounded tool output
return await Bun.file(path).text();

// Better: cap output before it enters context
return (await Bun.file(path).text()).slice(0, 50_000);