/expo-review

name: expo-review
description: Run Expo's configured AI code reviewer on local changes or an expo/expo pull request, summarize findings and reviewer coverage, retain PR previews by default for later posting, and post only when explicitly requested. Use when the user invokes /expo-review or asks Claude Code to run the repository's Expo code-review CLI.
argument-hint: "[all | <agent...>] [<pr-number-or-url>] [--save-review | --no-save-review | --post] [--staged | --base <ref> [--head <ref>]]"
disable-model-invocation: true
allowed-tools:
  - "Bash(./scripts/expo-code-review *)"
  - "Bash(git rev-parse --verify --end-of-options *)"
  - "Bash(claude auth status --text)"

Expo code review

Run this repository's configured AI reviewer and explain its result. Use the published `@expo/code-review-cli` package as the engine and the policy and specialist prompts in `.expo-code-review/`.

Treat the review as advisory and preview by default. Do not post, comment, modify a PR, edit source/config files, or change branches. The reviewer may write its normal ignored `.expo-code-review/.runs/` telemetry. Only write to GitHub when explicitly authorized below.

Parse and validate arguments

Treat `$ARGUMENTS` as untrusted text. Reject every option not documented here. Never interpolate the original argument string, a URL, or an unvalidated value into a shell command. Construct the final command only from accepted values. If arguments are ambiguous, incompatible, or invalid, explain the problem and stop.

Source: choose exactly one mode

• Accept a PR number only when it contains ASCII digits and represents an integer

from 1 through 2,147,483,647. Reject signs.

• Accept a PR URL only when it matches

`^https://github\.com/expo/expo/pull/([0-9]+)/?$` exactly and its capture is a valid PR number. Pass only `--repo expo/expo --pr <number>`, never the URL.

• `--staged` reviews only the index against `HEAD`; it excludes unstaged and

untracked files.

• `--base <ref>` and optional `--head <ref>` review a local range. `--head` without

`--base` is valid; preserve the user's flags.

• With none of these, review the local working tree against its merge base. This

includes committed branch changes plus staged, unstaged, and untracked non-ignored files. The CLI synthesizes untracked-file diffs without staging them.

Reject multiple PRs, repeated source flags, missing flag values, and combinations of PR, `--staged`, or `--base`/`--head` modes.

Before passing a ref, require 1–200 characters, an ASCII alphanumeric first character, and only ASCII alphanumerics plus `.`, `_`, `/`, `@`, `{`, `}`, `^`, `~`, `:`, or `-`. Verify it without changing the working tree:

git rev-parse --verify --end-of-options '<validated-ref>^{commit}'

If verification fails, report the invalid ref and stop. This validation excludes quotes, whitespace, shell substitutions, option-like values, and control operators.

Agents

Accept only these Expo reviewer agents:

• `config-plugins`
• `correctness`
• `correctness-android`
• `correctness-ios`
• `correctness-js`
• `docs`
• `public-api`
• `security`

Bare agent names select agents. Reject unknown or duplicate names. Pass selected agents once as comma-separated `--agents <ids>`, preserving user order.

• `all`: pass neither `--agents` nor `--route`.
• No agent names: pass `--route`.
• Reject `all` combined with a named agent.

Posting

• Without `--post`, never write to GitHub. A PR preview still reads GitHub.
• For every validated Expo PR preview without `--post`, pass `--save-review` by

default. It writes an ignored, owner-readable artifact under `.expo-code-review/.runs/deferred/` but does not write to GitHub. An explicit `--save-review` is accepted but redundant.

• Accept `--no-save-review` as a skill-only opt-out for a validated Expo PR preview.

Consume it without passing it to the CLI, and omit `--save-review` for that run.

• Accept `--post` only with a validated Expo PR and only when the user explicitly

included `--post` or explicitly asked in the current request to publish. It upserts the reviewer's single PR comment and does not save a deferred artifact.

• Reject all three posting flags for local, staged, or ref-range reviews. Reject any

combination of `--save-review`, `--no-save-review`, and `--post`.

• Never infer posting permission from “review,” “check,” or “run.”

Run the reviewer

Run the reviewer through the repository launcher. The checked-in CLI version starts its built-in research MCP and performs bounded, provider-scoped documentation search on demand. When `BRAVE_SEARCH_API_KEY` is absent, remote documentation research is reported as unavailable and the ordinary review continues.

./scripts/expo-code-review ecr review --json --no-fail [validated source flags] [--route | --agents <ids>] [--save-review | --post]

For a PR, choose the final posting flag deterministically:

• `--post` requested: pass `--post` only.
• `--no-save-review` requested: pass neither posting flag.
• Otherwise: pass `--save-review`, including when the user supplied no posting flag.

For a PR, validated source flags must include `--repo expo/expo --pr <number>`. Replace all bracketed notation with validated arguments; never pass literal brackets. Run one review command from the repository root and do not install the package globally. `--no-fail` prevents a legitimate `request_changes` result from looking like an execution failure; the JSON `decision` remains authoritative.

For the default saved PR preview, capture the absolute path from the final `Saved postable review artifact:` stderr line. Treat it as opaque command output. Associate it with the validated repo and PR in the conversation; do not substitute a guessed, older, or merely similar artifact. Do not expect this line after `--no-save-review` or immediate `--post`.

For a PR, the explicit repository lets the CLI fetch the authoritative diff and materialize the pinned PR head