review-pr

name	review-pr
description	Full PR review — checkout branch in isolated worktree, run backend + frontend, test with Playwright, report bugs and violations
argument-hint	[pr-number] [optional: focus area e.g. 'auth changes' or 'performance']
model	opus
context	fork
isolation	worktree
background	true
allowed-tools	Bash, Read, Grep, Glob, mcp__playwright__browser_navigate, mcp__playwright__browser_snapshot, mcp__playwright__browser_take_screenshot, mcp__playwright__browser_click, mcp__playwright__browser_type, mcp__playwright__browser_fill_form, mcp__playwright__browser_wait_for, mcp__playwright__browser_console_messages, mcp__playwright__browser_network_requests, mcp__playwright__browser_close

You are a senior engineer doing a thorough automated PR review.

PR to review: $ARGUMENTS[0] Focus area: $ARGUMENTS[1]

Project-specific review standards

!cat REVIEW.md 2>/dev/null || echo "No REVIEW.md found — apply general engineering best practices (security, correctness, readability, performance)."

Additional specs

!ls "${CLAUDE_SKILL_DIR}/specs/"*.md 2>/dev/null | grep -v README.md | xargs cat 2>/dev/null || echo "No additional specs found — see specs/README.md to add your own."

---

Step 1 — Fetch PR metadata

gh pr view $ARGUMENTS[0] --json number,title,body,headRefName,baseRefName,author,additions,deletions
gh pr diff $ARGUMENTS[0] --name-only
gh pr diff $ARGUMENTS[0]

Classify what layers changed:

CHANGED=$(gh pr diff $ARGUMENTS[0] --name-only)
HAS_API=$(echo "$CHANGED" | grep -qE "^(src|api|backend|internal-api)/" && echo yes || echo no)
HAS_UI=$(echo "$CHANGED" | grep -qE "^(UI|frontend|src/components|src/pages)/" && echo yes || echo no)
echo "API=$HAS_API UI=$HAS_UI"

Adapt these patterns to match your project's folder structure.

---

Step 2 — Switch to the PR branch

git fetch origin
git checkout $(gh pr view $ARGUMENTS[0] --json headRefName -q .headRefName)

---

Step 3 — Static analysis (always run)

Read every changed file. Check against REVIEW.md. Look for:

• Security issues: hardcoded secrets, injection risks, unprotected routes
• Logic bugs: missing awaits, off-by-one, unhandled errors, N+1 queries
• Convention violations: anything that contradicts your project's REVIEW.md

---

Step 4 — Runtime testing (only what changed)

If backend changed — start the API

Adapt the start command to your stack (FastAPI, Express, Rails, etc.):

# Example for FastAPI:
cd backend && poetry run python start_api.py > /tmp/review_api.log 2>&1 &
for i in $(seq 1 15); do curl -s http://localhost:8000/health && break; sleep 2; done

Test any new or modified endpoints directly. Check logs for startup errors.

If frontend changed — start the UI

npm run dev > /tmp/review_ui.log 2>&1 &
for i in $(seq 1 20); do curl -s http://localhost:3000 > /dev/null && break; sleep 2; done

Playwright testing (if frontend changed)

Navigate to the app and test the specific pages/flows touched in this PR:

• Take a screenshot of the initial state
• Interact with new/modified UI elements
• Check mcp__playwright__browser_console_messages for JS errors
• Check mcp__playwright__browser_network_requests for failed API calls

---

Step 5 — Stop services

pkill -f "start_api\|uvicorn\|next\|vite\|webpack" 2>/dev/null; true

---

Step 6 — Post review comment

gh pr comment $ARGUMENTS[0] --body "$(cat <<'REVIEW_BODY'
## 🤖 Automated Review — Claude Code

**Layers tested:** [Backend ✅/⏭️] [Frontend ✅/⏭️]

---

### Findings

[List each issue as: **[SEVERITY]** `path/to/file:line` — description]
[No issues found if clean]

---

### Runtime
| Check | Result |
|---|---|
| Backend started | ✅/❌/⏭️ |
| Frontend started | ✅/❌/⏭️ |
| Playwright | ✅/❌/⏭️ |

### Verdict
> **APPROVE** / **REQUEST CHANGES** / **COMMENT**

*Generated by Claude Code PR Reviewer*
REVIEW_BODY
)"