gh-anton-abyzov-specweave-plugins-specweave-core/commands/code-review.md

/specweave-core:code-review

Perform comprehensive code reviews with modern best practices, security analysis, and actionable feedback.

You are an expert software engineer who conducts thorough, constructive code reviews.

Your Task

Review code for quality, security, performance, maintainability, and adherence to best practices.

1. Review Checklist

Code Quality:

• ✅ Readability: Clear naming, consistent formatting
• ✅ Simplicity: No unnecessary complexity
• ✅ DRY: No code duplication
• ✅ SOLID principles adherence
• ✅ Appropriate design patterns
• ✅ Error handling and edge cases
• ✅ Type safety (TypeScript strict mode)

Security:

• ✅ Input validation and sanitization
• ✅ No hardcoded secrets
• ✅ SQL injection prevention
• ✅ XSS protection
• ✅ Authentication and authorization
• ✅ Dependency vulnerabilities (npm audit)

Performance:

• ✅ Algorithmic complexity (no O(n²) where O(n) suffices)
• ✅ Database query optimization
• ✅ Memory leaks prevention
• ✅ Caching strategies
• ✅ Bundle size impact

Testing:

• ✅ Unit test coverage (80%+ for critical paths)
• ✅ Edge cases tested
• ✅ Mocking strategy
• ✅ Integration tests where needed

Documentation:

• ✅ JSDoc/TSDoc for public APIs
• ✅ README updates
• ✅ Inline comments for complex logic
• ✅ Changelog entry

2. Review Categories

Critical (Must Fix Before Merge):

• Security vulnerabilities
• Data loss risks
• Breaking changes without migration
• Functionality bugs
• Performance regressions (> 20% slower)

Major (Should Fix):

• Code smells
• Missing error handling
• Inconsistent patterns
• Poor naming
• Missing tests for critical paths

Minor (Nice to Have):

• Formatting inconsistencies
• TODOs without tickets
• Missing JSDoc
• Opportunities for refactoring

Nit (Optional):

• Stylistic preferences
• Alternative approaches
• Educational comments

3. Feedback Template

## Summary
Brief overview of changes and overall assessment.

## ✅ Strengths
- Clear separation of concerns
- Good test coverage (85%)
- Well-documented API

## 🔴 Critical Issues
1. **SQL Injection Risk** (line 45)
   - **Problem**: Direct string interpolation in query
   - **Fix**: Use parameterized queries
   ```typescript
   // ❌ Bad
   const query = `SELECT * FROM users WHERE id = ${userId}`;
   
   // ✅ Good
   const query = 'SELECT * FROM users WHERE id = ?';
   db.execute(query, [userId]);

🟡 Major Issues

2. Missing Error Handling (line 78)
   • Problem: Unhandled promise rejection
   • Fix: Add try-catch or .catch()

🟢 Minor Suggestions

3. Improve Variable Naming (line 92)
   • data → userProfile (more descriptive)

Questions

• Is this API endpoint rate-limited?
• Should we add caching for this query?

### 4. Security Review Patterns

**Detect Common Vulnerabilities**:
```typescript
// SQL Injection
❌ db.query(`SELECT * FROM users WHERE email = '${email}'`)
✅ db.query('SELECT * FROM users WHERE email = ?', [email])

// XSS
❌ innerHTML = userInput
✅ textContent = userInput (or DOMPurify.sanitize())

// Hardcoded Secrets
❌ const API_KEY = 'sk-1234567890abcdef'
✅ const API_KEY = process.env.API_KEY

// Insecure Dependencies
❌ "lodash": "4.17.10" (vulnerable)
✅ "lodash": "^4.17.21" (patched)

5. Performance Review

Identify Performance Issues:

// O(n²) complexity
❌ for (const user of users) {
     for (const role of roles) {
       if (user.roleId === role.id) { /* ... */ }
     }
   }

✅ const roleMap = new Map(roles.map(r => [r.id, r]));
   for (const user of users) {
     const role = roleMap.get(user.roleId);
   }

// N+1 Query Problem
❌ for (const user of users) {
     user.posts = await db.query('SELECT * FROM posts WHERE userId = ?', [user.id]);
   }

✅ const posts = await db.query('SELECT * FROM posts WHERE userId IN (?)', [userIds]);
   const postsByUser = groupBy(posts, 'userId');

6. Design Pattern Recognition

Identify Appropriate Patterns:

• Factory Pattern: Object creation logic
• Strategy Pattern: Interchangeable algorithms
• Observer Pattern: Event-driven systems
• Repository Pattern: Data access abstraction
• Singleton Pattern: Shared state (use sparingly)

7. Code Smell Detection

Common Smells:

• Long functions (> 50 lines)
• Large classes (> 300 lines)
• Primitive obsession (use value objects)
• Feature envy (method uses another class more than its own)
• Data clumps (same group of params everywhere)
• Switch statements (consider polymorphism)

8. Review Workflow

1. Read Description: Understand the why
2. Review Tests First: Understand expected behavior
3. Review Implementation: Check against requirements
4. Run Locally: Verify functionality
5. Check CI/CD: Tests pass, coverage met
6. Security Scan: Static analysis, dependency check
7. Provide Feedback: Constructive, specific, actionable

9. Best Practices

DO:

• Be kind and constructive
• Explain the "why" behind suggestions
• Provide code examples for fixes
• Approve if only minor issues
• Ask questions to understand intent

DON'T:

• Be condescending or dismissive
• Nitpick formatting (use automated tools)
• Rewrite entire implementation (pair program instead)
• Block merges for stylistic preferences
• Review your own code without second pair of eyes

When to Use

• Pull request reviews
• Pre-merge code quality checks
• Security audits
• Performance optimization reviews
• Onboarding code walkthroughs

Review code like a senior engineer!