Code Review: /review & /ultrareview

> /review

🟡 src/api/auth.py:42 — SQL string concatenation; use parameterized query
🟢 src/api/auth.py:68 — Magic constant 86400; consider TOKEN_TTL_SECONDS
🟢 tests/auth.py — Missing test for expired-token path

No critical issues. 3 suggestions.

> /review --staged           # only review staged changes
> /review src/auth/          # only review files in src/auth/
> /review --since main       # review everything since branching from main
> /review --focus security   # focus on security issues only

> /ultrareview                # review current branch vs main (local bundle)
> /ultrareview 142            # review GitHub PR #142
> /ultrareview --base develop # custom base branch

1. Bundle the diff (current branch vs base, OR fetch PR #N)
2. Spawn parallel cloud agents:
   - security-reviewer    (auth, secrets, injection, OWASP)
   - performance-reviewer (N+1, big-O, blocking I/O, allocations)
   - test-reviewer        (coverage, edge cases, missing assertions)
   - style-reviewer       (project conventions, CLAUDE.md compliance)
   - architecture-reviewer (layering, module boundaries, abstractions)
4. Each agent reads relevant files for context (not just the diff)
5. Synthesizer agent merges findings, dedupes, ranks by severity
6. Outputs unified report + (optional) GitHub PR comment

ULTRAREVIEW — feat/auth-google (12 files, +487 -128)

🔴 CRITICAL (2)
  src/api/auth.py:42  — SQL injection: f-string in WHERE clause
  src/api/auth.py:101 — JWT verified without checking expiry

🟡 MAJOR (4)
  src/api/auth.py:68    — Token TTL hardcoded; use config
  src/api/auth.py:155   — Missing rate limit on /callback endpoint
  tests/auth.py:23      — No test for expired-token branch
  src/db/users.py:12    — N+1: get_user_with_roles loops queries

🟢 MINOR (7)
  ... (style, naming, doc improvements)

OVERALL: 2 blockers, 4 should-fix, 7 nits.
Recommendation: BLOCK merge until critical issues resolved.

# Code Review Guidelines

## Severity Bar
- CRITICAL: blocks merge — security, data loss, public API breakage
- MAJOR: should fix — bugs, missing tests, performance regressions
- MINOR: nits — naming, comments, formatting

## Project-Specific Rules
- All API endpoints must have rate limiting (use @rate_limit decorator)
- Database queries must use parameterized statements (no f-strings in SQL)
- React components must handle prefers-reduced-motion
- TypeScript strict mode — no `any`
- All public functions need JSDoc

## Skip
- Don't flag prettier formatting (CI handles it)
- Don't suggest renaming variables to match a different convention
- Don't recommend abstraction unless the duplication exceeds 3 places

## Tests
- Coverage minimum: 80% on new code
- Every new endpoint needs at least: happy path, auth failure, validation failure

> /review --since main --focus security
   ↳ security-only review of full branch

> /ultrareview --skip style
   ↳ skip the style agent (saves cloud cost on draft PRs)

> /ultrareview 142 --post-comment
   ↳ post the synthesized review as a GitHub PR comment

> /review --diff-only
   ↳ skip context fetching; only look at diff (fastest, less accurate)

# .github/workflows/claude-review.yml
name: Claude Code Review

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Claude Code
        run: npm install -g @anthropic-ai/claude-code

      - name: Run ultrareview on PR
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          claude --headless \
            --permission-mode dontAsk \
            --prompt "/ultrareview ${{ github.event.pull_request.number }} --post-comment"

# .gitlab-ci.yml
claude-review:
  stage: review
  image: node:20
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  script:
    - npm install -g @anthropic-ai/claude-code
    - claude --headless --permission-mode dontAsk \
        --prompt "/ultrareview --base $CI_MERGE_REQUEST_TARGET_BRANCH_NAME"

{
  "hooks": [
    {
      "event": "PostToolUse",
      "matcher": { "tool": "Bash", "pattern": "git commit" },
      "command": "claude --headless --prompt '/review --since HEAD~1' >> .claude/review-log.md"
    }
  ]
}

> /review --persona skeptic
   ↳ assume the code is wrong; look for hallucinated APIs, made-up function signatures, plausible-but-broken patterns