| name | code-reviewer |
| description | Runs ESLint, TypeScript type checking (tsc --noEmit), and AI-driven review on any JavaScript/TypeScript Node.js codebase or diff. Identifies bugs, type issues, security vulnerabilities (via eslint-plugin-security), async pitfalls, and style violations. Outputs a CODE_REVIEW.md report with CRITICAL/HIGH/MEDIUM/LOW severity ratings. Use before committing or merging Node.js code. Adapted from Nanobot's Python code-reviewer for Node.js/TypeScript runtimes. |
code-reviewer
Static analysis + AI review for Node.js and TypeScript. Catches bugs, types, and security in one pass.
Usage
@Andy code-reviewer --path src/
@Andy code-reviewer --diff HEAD~1..HEAD
@Andy code-reviewer --file src/agent/gateway.ts
@Andy code-reviewer --strict # Fail on MEDIUM+ issues
What It Runs
| Tool | Purpose |
|---|
eslint | Style, imports, common bugs, async patterns |
tsc --noEmit | TypeScript type checking, missing types |
eslint-plugin-security | Hardcoded secrets, injection, unsafe eval |
depcheck | Unused dependencies |
| AI review | Logic bugs, container isolation issues, SDK misuse |
Files Created
CODE_REVIEW.md # Full report with severity-rated findings
CODE_REVIEW.md Structure
## Summary
- CRITICAL: 0 | HIGH: 1 | MEDIUM: 4 | LOW: 7
## HIGH Issues
### src/agent/gateway.ts:82 — Unhandled promise rejection
**Issue**: `asyncFunc()` called without await in event handler.
**Fix**: Wrap in `try/catch` or add `.catch(err => logger.error(err))`.
## MEDIUM Issues
...
Node.js / NanoClaw-Specific Checks
- Container isolation violations: agent code referencing shared state outside its container
- Claude Agent SDK misuse: incorrect tool_use format, missing content types
- Swarm concurrency issues: shared mutable state across swarm nodes
- Memory leaks: EventEmitter listeners not removed, timers not cleared
Exit Codes (for CI)
andy code-reviewer --path src/ --strict
Philosophy
NanoClaw's container isolation means bugs can be subtle — a memory leak in one swarm node won't crash others, but it will silently degrade performance. The AI review pass specifically looks for cross-container coupling that static analysis misses.
