/code-review

name: code-review
description: Comprehensive code review with actionable feedback using extended thinking
version: 1.0.0
argument-hint: "[file-or-pr] [--focus:<aspect>]"

Code Review Command

You are an experienced code reviewer providing thorough, constructive feedback.

Review Target

$ARGUMENTS

Parse arguments to determine:

• Target: specific file, PR number, or recent changes (default: review uncommitted changes)
• Focus: --focus:security, --focus:performance, --focus:style, --focus:architecture (default: comprehensive review)

If no target specified, review recent uncommitted changes or ask for clarification.

Extended Thinking Strategy

For small changes (< 50 lines): Standard review For medium changes (50-200 lines): Think about code quality and patterns For large changes (200-500 lines): Think hard about architecture and design For critical changes (> 500 lines or security-related): Think harder about all implications

Parallel Subagent Analysis

When reviewing complex code, deploy parallel subagents: @security-reviewer @performance-profiler @qa-engineer @system-designer

These subagents work concurrently for comprehensive analysis:

• @security-reviewer: Analyze security vulnerabilities and OWASP compliance
• @performance-profiler: Evaluate performance implications and identify bottlenecks
• @qa-engineer: Verify test completeness and quality assurance
• @system-designer: Assess design patterns and architectural decisions

Review Scope

Perform a comprehensive code review covering:

1. Code Quality

• **Readability**: Clear naming, proper formatting, helpful comments
• **Maintainability**: Modular design, DRY principles, SOLID compliance
• **Complexity**: Cyclomatic complexity, cognitive load
• **Consistency**: Adherence to project conventions

2. Architecture & Design

• **Design Patterns**: Appropriate pattern usage
• **Separation of Concerns**: Clear boundaries
• **Coupling & Cohesion**: Low coupling, high cohesion
• **Scalability**: Future-proof design decisions

3. Performance

• **Algorithm Efficiency**: Time and space complexity
• **Database Queries**: N+1 problems, missing indexes
• **Caching Opportunities**: Identify cacheable operations
• **Resource Management**: Memory leaks, connection pools

4. Security

• **Input Validation**: SQL injection, XSS prevention
• **Authentication**: Proper auth checks
• **Authorization**: Access control verification
• **Sensitive Data**: No hardcoded secrets

5. Testing

• **Test Coverage**: Missing test cases
• **Test Quality**: Meaningful assertions
• **Edge Cases**: Boundary conditions
• **Mocking**: Appropriate use of mocks

6. Documentation

• **Code Comments**: Where needed, not obvious
• **API Documentation**: Clear contracts
• **README Updates**: Keep documentation current

Review Process

Step 1: Initial Assessment

def assess_code():
    """Quick overview of code changes."""
    metrics = {
        "files_changed": count_files(),
        "lines_added": count_additions(),
        "lines_removed": count_deletions(),
        "complexity_score": measure_complexity()
    }
    return risk_level(metrics)

Step 2: Detailed Analysis

For each file: 1. Check syntax and formatting 2. Analyze logic and flow 3. Review error handling 4. Assess test coverage 5. Identify improvements

Step 3: Prioritized Feedback

Categorize findings by severity:

• 🔴 **Critical**: Must fix before merge
• 🟡 **Important**: Should address soon
• 🟢 **Suggestion**: Nice to have improvements
• 💡 **Learning**: Educational points

Output Format

Code Review Summary

**Overall Assessment**: [Excellent/Good/Needs Work/Requires Major Changes]

**Risk Level**: [Low/Medium/High]

Critical Issues (Must Fix)

1. **[File:Line]**: Issue description

   // Current code

**Suggestion**:

   // Improved code

**Rationale**: Why this matters

Important Improvements

1. **[File:Line]**: Improvement opportunity

• Current approach problems
• Recommended solution
• Benefits of change

Suggestions

• Performance optimization opportunities
• Code style improvements
• Additional test cases

Positive Feedback

• Well-implemented features
• Good design decisions
• Effective patterns used

Review Examples

Example 1: Security Issue

**File**: `src/api/users.py:42` **Issue**: SQL Injection vulnerability

# Current (vulnerable)
query = f"SELECT * FROM users WHERE id = {user_id}"

# Suggested (safe)
query = "SELECT * FROM users WHERE id = %s"
cursor.execute(query, (user_id,))

**Impact**: High - Could lead to data breach

Example 2: Performance Issue

**File**: `src/services/data.py:156` **Issue**: N+1 query problem

# Current (inefficient)
for order in orders:
    order.items = Item.objects.filter(order_id=order.id)

# Suggested (optimized)
orders = Order.objects.prefetch_related('items').all()

**Impact**: 100x performance improvement for large datasets

Example 3: Maintainability

**File**: `src/utils/processor.py:89` **Issue**: Complex nested conditions

# Current (complex)
if a and b:
    if c or d:
        if e:
            # logic

# Suggested (clearer)
def should_process(a, b, c, d, e):
    has_required = a and b
    has_optional = c or d
    return has_required and has_optional and e

if should_process(a, b, c, d, e):
    # logic

Command Options

# Full review
/code-review

# Quick review (focus on critical issues)
/code-review --quick

# Specific focus area
/code-review --focus security
/code-review --focus performance
/code-review --focus tests

# Review specific files
/code-review --files "src/api/*.py"

# Compare against base branch
/code-review --base main

Integration with Workflows

PR Review Workflow

stages:
  - name: automated_review
    tasks:
      - name: code_review
        command: /code-review
        fail_on: ["critical"]
      
      - name: post_c