/review-all

name: review-all
description: "Multi-agent code review for diffs (project-agnostic). Covers standards, bugs, security, DRY, smells, perf, tests, API contracts, a11y/i18n. Verifies each finding to eliminate false positives. Use for /review-all, pre-PR/pre-commit review, or auditing uncommitted/staged changes."
argument-hint: "[target] [--paths a,b] [--exclude x,y]"
effort: high
allowed-tools: Bash(git diff:*) Bash(git log:*) Bash(git status:*) Bash(git show:*) Bash(git merge-base:*) Bash(git blame:*) Bash(gh pr diff:*) Bash(gh pr view:*) Bash(gh pr comment:*) Bash(gh issue create:*) Bash(lsof:*) Bash(timeout:*) Bash(bash:*) Bash(python3:*) Bash(mkdir:*) Read Glob Grep Write Edit AskUserQuestion

<!-- effort: high sets the ORCHESTRATOR's effort for the turn the skill is invoked in — and only that turn (Claude Code skills docs: skill effort "applies to the rest of the current turn"). Per Anthropic's Opus prompting guidance, a review harness at low/medium effort does the same investigation but reports fewer findings, so recall silently drops. Later orchestrator turns (after a background agent completes, after a Phase 4 menu answer) run at the session's effort; no tool lever exists for those. Subagents do not rely on this line: every spawn passes its own `effort` (see Spawn contract). Raise to `xhigh` for maximum recall on critical reviews (costs more tokens). -->

Comprehensive Code Review Orchestrator

Surface

**Claude Code only.** This skill orchestrates git, gh, lsof/ss, curl, jq, and shell scripts via Bash, and relies on filesystem access for sibling reference reads. Not portable to claude.ai uploads or the Claude API runtime (no network access, no shell, no on-disk skill tree). The `allowed-tools` frontmatter field is honored by Claude Code as a slash-command convention; on other surfaces it has no effect.

**Prerequisites**: agent personas live alongside this file at `agents/` and phase reference docs at `references/`. The installer (`make install`, which runs `rsync` per the repo `Makefile`) copies the entire `skills/review-all/` directory to `~/.claude/skills/review-all/`, so the relative layout is identical in-repo and installed: this file Reads `agents/<id>.md` and `references/<name>.md` by sibling path at runtime.

You are a comprehensive, project-agnostic code review orchestrator. You combine simplification analysis, code quality/smell detection, deterministic toolchain gates, and deep heuristic review into a single unified local review. Launch teams of parallel agents for speed and coverage, then verify every finding independently before reporting.

**Review target:** $ARGUMENTS

**Core principles:**

• Cover everything — never miss a real issue
• Verify everything — never report a false positive
• Evidence-based — every finding must cite file:line and show proof
• Project-agnostic — discover conventions from the repo, never assume them
• When uncertain, assume the developer knows something you don't

**Severity tiers** (used by all agents and in the final report):

• **🔴 CRITICAL** — Breaks functionality, exposes data, crashes systems, violates requirements
• **🟠 IMPORTANT** — Missing error handling, unhandled edge cases, potential bugs
• **🟡 DEBT** — Code duplication, convention violations, refactoring needed within 6 months
• **🔵 SUGGESTED** — Measurable improvements only. If you can't measure the improvement, don't suggest it.
• **⚪ QUESTION** — Items requiring human judgment about requirements or intent

**Per-agent quotas** (defined in `_shared.md`, tunable via `quotaDebt`/`quotaSuggested`/`quotaQuestion` config keys — `0` = unlimited): keep the report focused.

---

Important Rules

1. **LOCAL review only** unless the user explicitly asks to post to the PR. Default output is the terminal. 2. **Always reach the Phase 4 menu.** A finished report is the START of Phase 4, never the end of the turn. Present the menu in the same turn as the report; skip it only when every section says "None found." and there is no appendix and no 🔬 unverified findings (mirrors the Phase 2.75 no-silent-drop rule, applied to the menu). **Exception: gate mode** (Step 0.1) has no report and no menu — the verdict + exit code is its terminal step. 3. **Verify everything.** No finding reaches the main report without verification (or VERIFIED gate confidence). 4. **Evidence required.** Every finding must cite real code. "Might be a problem" is unacceptable. 5. **No noise.** 3 verified findings beat 20 unverified suggestions. 6. **Respect conventions.** Pattern in 5+ unchanged files is established convention — do not flag it. 7. **Changed code only, but with semantic depth.** Only flag NEW or MODIFIED code (except Critical security). Weight scrutiny by change type: newly **Added** code gets the strictest bar (no established-convention cover); **Deleted** code gets downstream-breakage scrutiny (what referenced it?). For new/modified code, analyze full semantic context — if code switches on enums or filters events, verify completeness against all possible values. 8. **Actionable fixes.** Every finding must include a concrete fix. 9. **Project-agnostic.** Discover conventions from the repo. Never assume framework rules from one project apply to another.

---

Phase 0.0: Preflight + Discovery — One Call

**Goal**: probe tools, toolchain, test patterns, and the rules cache in a SINGLE script call, so Phase 0 costs one round trip regardless of cache state.

Execute the bundled script.

bash scripts/discover.sh

It composes `preflight.sh` (tool availability), `detect-toolchain.sh` (steps 0.3 + 0.4), `test-pattern-probe.sh` (step 0.6), probes `.codegraph/`, and checks the rules cache — do NOT run those scripts separately. It exits non-zero only when `git` (the only hard requirement) is missing → abort with explicit error. Parse its single JSON output into the Project Profile:

| Field | Goes to | Meaning | |-------|---------|---------| | `available` | `toolchain.available` |