Code Review

Review code for quality, type safety, DRY, security, and adherence to project standards. Produces actionable, severity-tagged findings.

Recommended model: Opus (deep multi-file analysis)

Output Format

One finding per line:

path/to/file.ts:42 — CRITICAL: problem description. Fix: what to do.
path/to/file.ts:88 — HIGH: problem description. Fix: what to do.
path/to/file.go:15 — MEDIUM: problem description. Fix: what to do.

Group findings by severity: CRITICAL → HIGH → MEDIUM → LOW.

At the end, output a summary:

Review complete. N findings: X critical, Y high, Z medium, W low.
Action required before proceeding: [list critical/high items]

Severity Definitions

What to Check

Type Safety (TypeScript)

• No any — flag every occurrence; suggest unknown + type guard
• No unchecked type assertions (as SomeType) without a prior type guard
• Zod schema present for every HTTP boundary (body, params, query)
• Response type matches the declared DTO — no extra fields leaking

Type Safety (Go)

• Error return values never ignored (no _ on error unless explicitly justified)
• No unchecked type assertions — v, ok := x.(T) not x.(T) directly
• context.Context present as first arg on all service/repo methods

Error Handling

• Errors caught at the correct layer (handler layer, not buried in service)
• No silent swallowing (catch (e) {} / if err != nil { return } without logging/wrapping)
• Errors mapped to the standard envelope before the client sees them

DRY

• Duplicate logic across files that could be a shared utility
• Inline response envelope construction that should use the shared helper
• Copy-pasted validation that should be a shared schema

Security

• No hardcoded secrets, API keys, passwords, or tokens
• Input validated before use — never pass raw user input to DB/service
• No internal error messages (stack traces, DB errors) sent to clients
• Auth middleware applied to protected routes

Layer Separation (TypeScript)

• Router handlers contain no business logic
• Services contain no SQL / DB calls
• Repositories contain no business rules

Layer Separation (Go)

• Handlers contain no business logic
• Services contain no SQL
• Repositories contain no business rules
• http.Request not passed beyond handler layer

Immutability (TypeScript)

• No direct mutation of objects — flag obj.field = value outside constructors
• No Object.assign(existing, ...) — should be Object.assign({}, existing, ...)

Performance

• No await inside loops (TypeScript) — should be Promise.all
• No N+1 queries — service should batch fetch, not loop-and-query

Review Scope

• If a file list is specified, review those files only
• If no scope given, review all files changed since last commit: git diff HEAD --name-only
• Detect language from file extensions (.ts/.tsx → TypeScript rules; .go → Go rules)

After Findings

For each CRITICAL and HIGH finding, offer a concrete fix inline. For MEDIUM and LOW, describe the fix without rewriting the code.

Never rewrite code that isn't broken. Never suggest changes outside the review scope.