/ork:review-pr

/ork:review-pr 123
/ork:review-pr feature-branch

PR_NUMBER = "$ARGUMENTS[0]"  # e.g., "123" or "feature-branch"

# If no argument provided, check environment
if not PR_NUMBER:
    PR_NUMBER = os.environ.get("ORCHESTKIT_PR_URL", "").split("/")[-1]

# If still empty, detect from current branch
if not PR_NUMBER:
    PR_NUMBER = "$(gh pr view --json number -q .number 2>/dev/null)"

AskUserQuestion(
  questions=[{
    "question": "What type of review do you need?",
    "header": "Focus",
    "options": [
      {"label": "Full review (Recommended)", "description": "Security + code quality + tests + architecture", "markdown": "```\nFull Review (6 agents)\n──────────────────────\n  PR diff ──▶ 6 parallel agents:\n  ┌────────────┐ ┌────────────┐\n  │ Quality x2 │ │ Security   │\n  ├────────────┤ ├────────────┤\n  │ Test Gen   │ │ Backend    │\n  ├────────────┤ ├────────────┤\n  │ Frontend   │ │ (optional) │\n  └────────────┘ └────────────┘\n         ▼\n  Synthesized review comment\n  with conventional comments:\n  praise/suggestion/issue/nitpick\n```"},
      {"label": "Security focus", "description": "Prioritize security vulnerabilities", "markdown": "```\nSecurity Review\n───────────────\n  PR diff ──▶ security-auditor:\n  ┌─────────────────────────┐\n  │ Auth changes       ✓/✗ │\n  │ Input validation   ✓/✗ │\n  │ SQL/XSS/CSRF       ✓/✗ │\n  │ Secrets in diff    ✓/✗ │\n  │ Dependency risk    ✓/✗ │\n  └─────────────────────────┘\n  Output: Security-focused\n  review with fix suggestions\n```"},
      {"label": "Performance focus", "description": "Focus on performance implications", "markdown": "```\nPerformance Review\n──────────────────\n  PR diff ──▶ perf analysis:\n  ┌─────────────────────────┐\n  │ N+1 queries        ✓/✗ │\n  │ Bundle size impact  ±KB │\n  │ Render performance  ✓/✗ │\n  │ Memory leaks       ✓/✗ │\n  │ Caching gaps       ✓/✗ │\n  └─────────────────────────┘\n  Agent: frontend-performance\n  or python-performance\n```"},
      {"label": "Quick review", "description": "High-level review, skip deep analysis", "markdown": "```\nQuick Review (~2 min)\n─────────────────────\n  PR diff ──▶ Single pass\n\n  Output:\n  ├── Approve / Request changes\n  ├── Top 3 concerns\n  └── 1-paragraph summary\n  1 agent: code-quality-reviewer\n  No deep security/perf scan\n```"}
    ],
    "multiSelect": false
  }]
)

claude ultrareview "$PR_REF" --json

# memory is alwaysLoad in .mcp.json (CC 2.1.121+, #1541) — probe below kept as fallback for older CC:
ToolSearch(query="select:mcp__memory__search_nodes")
Write(".claude/chain/capabilities.json", { memory, timestamp })
# If memory available: search for past review patterns on these files

# 1. Create main review task IMMEDIATELY
TaskCreate(
  subject="Review PR #{number}",
  description="Comprehensive code review with parallel agents",
  activeForm="Reviewing PR #{number}"
)

# 2. Create subtasks for each phase
TaskCreate(subject="Gather PR information", activeForm="Gathering PR information")
TaskCreate(subject="Launch review agents", activeForm="Dispatching review agents")
TaskCreate(subject="Run validation checks", activeForm="Running validation checks")
TaskCreate(subject="Synthesize review", activeForm="Synthesizing review")
TaskCreate(subject="Submit review", activeForm="Submitting review")

# 3. Update status as you progress
TaskUpdate(taskId="2", status="in_progress")  # When starting
TaskUpdate(taskId="2", status="completed")    # When done

# Get PR details
gh pr view $PR_NUMBER --json title,body,files,additions,deletions,commits,author

# View the diff
gh pr diff $PR_NUMBER

# Check CI status
gh pr checks $PR_NUMBER

# Capture changed files for agent scope injection
CHANGED_FILES=$(gh pr diff $PR_NUMBER --name-only)

# Detect affected domains
HAS_FRONTEND=$(echo "$CHANGED_FILES" | grep -qE '\.(tsx?|jsx?|css|scss)$' && echo true || echo false)
HAS_BACKEND=$(echo "$CHANGED_FILES" | grep -qE '\.(py|go|rs|java)$' && echo true || echo false)
HAS_AI=$(echo "$CHANGED_FILES" | grep -qE '(llm|ai|agent|prompt|embedding)' && echo true || echo false)

# Load project review context (conventions, known weaknesses, past findings)
# This gives agents project-specific knowledge without re-discovering patterns
PROJECT_CONTEXT = Read("${MEMORY_DIR}/review-pr-context.md")  # Falls back gracefully if missing

for agent_result in review_results:
    if "[PARTIAL RESULT]" in agent_result.output:
        # A security agent that found 2 issues before crashing > no security review
        findings.extend(parse_findings(agent_result.output))
        findings[-1]["partial"] = True  # Flag in synthesis
        # Do NOT re-spawn — partial findings are still valuable

Bash(command="gh pr checks $PR_NUMBER --watch 2>&1", run_in_background=true)
Monitor(pid=ci_watch_id)  # Each status change → notification

triggers = []
if diff_loc_changed > 500:
    triggers.append("large_diff")
if any(path.startswith(p) for path in changed_files
       for p in ["auth/", "migrations/", "hooks/", "crypto/", "security/", "payments/"]):
    triggers.append("sensitive_path")
if reviewer_verdicts_disagree(phase_3_results):
    triggers.append("reviewer_disagreement")
if any(label in pr_labels for label in ["release", "hotfix"]):
    triggers.append("high_stakes_label")

AskUserQuestion(questions=[{
  "question": f"This PR triggers /ultrareview (reason: {', '.join(triggers)}). Run it? (Pro/Max: 3 free per month.)",
  "header": "Ultrareview",
  "multiSelect": false,
  "options": [
    {"label": "Yes, run ultrareview",
     "description": "Invoke built-in /ultrareview as a final deep pass. Adds 5–10 min."},
    {"label": "No, skip it",
     "description": "Continue with Phase 4 using existing agent results."},
    {"label": "Skip for this session",
     "description": "Don't ask again until this session ends."}
  ]
}])

{ "month": "2026-04", "used_this_month": 2, "last_used": "<iso>" }

# Approve
gh pr review $PR_NUMBER --approve -b "Review message"

# Request changes
gh pr review $PR_NUMBER --request-changes -b "Review message"

python3 plugins/ork/skills/review-pr/scripts/verdict_writeback.py "$CLAUDE_JOB_DIR"

claude --from-pr 123
claude --from-pr https://github.com/org/repo/pull/123

SendMessage(to="code-quality-reviewer", message="Security: auth middleware bypassed in route handler — flag as issue in review")

# Load: Read("${CLAUDE_SKILL_DIR}/rules/agent-prompts-agent-teams.md")

# Load project review context from memory (if available)
PROJECT_CONTEXT = ""
try:
    Read("${MEMORY_DIR}/review-pr-context.md")  # ${MEMORY_DIR} = project memory path
    PROJECT_CONTEXT = "<result from read>"
except:
    PROJECT_CONTEXT = "No project-specific review context available."

# DOMAIN-AWARE AGENT SELECTION
# Core agents (always spawn): quality-reviewer, security-reviewer, test-reviewer
# Conditional: backend-reviewer (if HAS_BACKEND), frontend-reviewer (if HAS_FRONTEND)

# Capture scope from Phase 1
CHANGED_FILES = "$(gh pr diff $PR_NUMBER --name-only)"

TeamCreate(team_name="review-pr-$PR_NUMBER", description="Review PR #$PR_NUMBER")

Agent(subagent_type="code-quality-reviewer", name="quality-reviewer",
     team_name="review-pr-$PR_NUMBER",
     prompt="""Review code quality and type safety for PR #$PR_NUMBER.

     ## Project Context
     ${PROJECT_CONTEXT}

     Scope: ONLY review the following changed files:
     ${CHANGED_FILES}
     Do NOT explore beyond these files.
     When you find patterns that overlap with security concerns,
     message security-reviewer with the finding.
     When you find test gaps, message test-reviewer.
     Return findings as a JSON block (```json```) with category prefix MAINT.""")

Agent(subagent_type="security-auditor", name="security-reviewer",
     team_name="review-pr-$PR_NUMBER",
     prompt="""Security audit for PR #$PR_NUMBER.

     ## Project Context
     ${PROJECT_CONTEXT}

     Scope: ONLY review the following changed files:
     ${CHANGED_FILES}
     Do NOT explore beyond these files.
     Check: fail-closed auth, SSRF on user-controlled URLs, rate limiting, secrets in diff.
     Cross-reference with quality-reviewer for injection risks in code patterns.
     When you find issues, message the responsible reviewer (backend-reviewer
     for API issues, frontend-reviewer for XSS).
     Return findings as a JSON block (```json```) with category prefix SEC.""")

Agent(subagent_type="test-generator", name="test-reviewer",
     team_name="review-pr-$PR_NUMBER",
     prompt="""Review TEST ADEQUACY for PR #$PR_NUMBER.
     Scope: ONLY review the following changed files:
     ${CHANGED_FILES}
     Do NOT explore beyond these files.
     1. Check: Does the PR add/modify code WITHOUT adding tests? Flag as MISSING.
     2. Match change types to required test types (testing-unit/testing-e2e/testing-integration rules):
        - API → integration-api, verification-contract
        - DB → integration-database, data-seeding-cleanup
        - UI → unit-aaa-pattern, a11y-testing
        - Logic → verification-techniques
     3. Evaluate test quality: meaningful assertions, no flaky patterns.
     4. When quality-reviewer flags test gaps, verify and suggest specific tests.
     Message backend-reviewer or frontend-reviewer with test requirements.

     ## Project Context
     ${PROJECT_CONTEXT}

     Return findings as a JSON block (```json```) with category prefix TEST.""")

# Only spawn if backend files detected (HAS_BACKEND)
Agent(subagent_type="backend-system-architect", name="backend-reviewer",
     team_name="review-pr-$PR_NUMBER",
     prompt="""Review backend code for PR #$PR_NUMBER.

     ## Project Context
     ${PROJECT_CONTEXT}

     Scope: ONLY review the following changed files:
     ${CHANGED_FILES}
     Do NOT explore beyond these files.
     Check: Redis connection lifecycle, webhook auth (fail-closed), N+1 queries, async patterns.
     When security-reviewer flags API issues, validate and suggest fixes.
     Share API pattern findings with frontend-reviewer for consistency.
     Return findings as a JSON block (```json```) with prefixes BUG/PERF/MAINT.""")

# Only spawn if frontend files detected (HAS_FRONTEND)
Agent(subagent_type="frontend-ui-developer", name="frontend-reviewer",
     team_name="review-pr-$PR_NUMBER",
     prompt="""Review frontend code for PR #$PR_NUMBER.

     ## Project Context
     ${PROJECT_CONTEXT}

     Scope: ONLY review the following changed files:
     ${CHANGED_FILES}
     Do NOT explore beyond these files.
     Check: SSR safety (no navigator/window outside hooks), button type attrs, a11y.
     When backend-reviewer shares API patterns, verify frontend matches.
     When security-reviewer flags XSS risks, validate and suggest fixes.
     Return findings as a JSON block (```json```) with prefixes A11Y/PERF/BUG.""")

# After collecting all findings and producing the review
# Core agents — always shut down
SendMessage(type="shutdown_request", recipient="quality-reviewer", content="Review complete")
SendMessage(type="shutdown_request", recipient="security-reviewer", content="Review complete")
SendMessage(type="shutdown_request", recipient="test-reviewer", content="Review complete")
# Conditional agents — only shut down if spawned
# if HAS_BACKEND:
SendMessage(type="shutdown_request", recipient="backend-reviewer", content="Review complete")
# if HAS_FRONTEND:
SendMessage(type="shutdown_request", recipient="frontend-reviewer", content="Review complete")
TeamDelete()

# Worktree cleanup (CC 2.1.72)
ExitWorktree(action="keep")

# Agents keep running indefinitely
Agent(subagent_type="code-quality-reviewer", team_name="review-pr-$PR_NUMBER")
Agent(subagent_type="security-auditor", team_name="review-pr-$PR_NUMBER")
# Missing shutdown_request calls!

# After review synthesis complete
SendMessage(type="shutdown_request", recipient="quality-reviewer", content="Review complete")
SendMessage(type="shutdown_request", recipient="security-reviewer", content="Review complete")
TeamDelete()  # Clean shutdown
ExitWorktree(action="keep")

# Load project review context from memory (if available)
# This file contains project conventions, security patterns, and known weaknesses
# from prior reviews. Agents receive it as PROJECT_CONTEXT in their prompts.
PROJECT_CONTEXT = ""
try:
    Read("${MEMORY_DIR}/review-pr-context.md")  # ${MEMORY_DIR} = project memory path
    PROJECT_CONTEXT = "<result from read>"
except:
    PROJECT_CONTEXT = "No project-specific review context available."

{
  "agent": "<agent-role>",
  "pr_number": $PR_NUMBER,
  "summary": "One-line summary",
  "findings": [
    {
      "id": "<CATEGORY_PREFIX>-<NNN>",
      "severity": "critical|high|medium|low|info",
      "category": "security|performance|correctness|maintainability|accessibility|testing",
      "file": "relative/path.ext",
      "line": 42,
      "title": "Short title (<80 chars)",
      "description": "Detailed explanation",
      "suggestion": "Fix suggestion",
      "effort": "5min|15min|30min|1h|2h+",
      "conventional_comment": "praise|nitpick|suggestion|issue|question"
    }
  ],
  "stats": { "files_reviewed": 0, "findings_count": 0, "critical": 0, "high": 0, "medium": 0, "low": 0 },
  "verdict": "approve|request-changes|comment-only"
}

# DOMAIN-AWARE AGENT SELECTION
# Only spawn agents relevant to detected domains.
# CHANGED_FILES and domain flags (HAS_FRONTEND, HAS_BACKEND, HAS_AI)
# are captured in Phase 1.

# ALWAYS spawn these 4 core agents:
# - code-quality-reviewer (readability)
# - code-quality-reviewer (type safety)
# - security-auditor
# - test-generator

# CONDITIONALLY spawn these based on domain:
# - backend-system-architect  → only if HAS_BACKEND
# - frontend-ui-developer     → only if HAS_FRONTEND
# - llm-integrator (7th)      → only if HAS_AI

# PARALLEL - All agents in ONE message
Agent(
  description="Review code quality",
  subagent_type="code-quality-reviewer",
  prompt="""# Cache-optimized: stable content first (CC 2.1.73)
  CODE QUALITY REVIEW

  ## Project Context
  ${PROJECT_CONTEXT}

  Review code readability and maintainability:
  1. Naming conventions and clarity
  2. Function/method complexity (cyclomatic < 10)
  3. DRY violations and code duplication
  4. SOLID principles adherence

  Do NOT explore beyond the changed files listed below. Focus your analysis on the diff.

  Return your findings as a JSON block (```json```) matching the structured output contract above.
  Use category prefix MAINT for maintainability findings. Use conventional comments (praise/suggestion/issue/nitpick).

  PR: $PR_NUMBER
  Scope: ONLY review the following changed files:
  ${CHANGED_FILES}
  """,
  run_in_background=True,
  max_turns=25
)
Agent(
  description="Review type safety",
  subagent_type="code-quality-reviewer",
  prompt="""# Cache-optimized: stable content first (CC 2.1.73)
  TYPE SAFETY REVIEW

  ## Project Context
  ${PROJECT_CONTEXT}

  Review type safety and validation:
  1. TypeScript strict mode compliance
  2. Zod/Pydantic schema usage
  3. No `any` types or type assertions
  4. Exhaustive switch/union handling

  Do NOT explore beyond the changed files listed below. Focus your analysis on the diff.

  Return your findings as a JSON block (```json```) matching the structured output contract above.
  Use category prefix MAINT for type safety findings. Use conventional comments.

  PR: $PR_NUMBER
  Scope: ONLY review the following changed files:
  ${CHANGED_FILES}
  """,
  run_in_background=True,
  max_turns=25
)
Agent(
  description="Security audit PR",
  subagent_type="security-auditor",
  prompt="""# Cache-optimized: stable content first (CC 2.1.73)
  SECURITY REVIEW

  ## Project Context
  ${PROJECT_CONTEXT}

  Security audit:
  1. Secrets/credentials in code
  2. Injection vulnerabilities (SQL, XSS)
  3. Authentication/authorization checks
  4. Dependency vulnerabilities
  5. Fail-closed auth patterns (reject when config missing)
  6. SSRF protection on user-controlled URLs
  7. Rate limiting on auth endpoints

  Do NOT explore beyond the changed files listed below. Focus your analysis on the diff.

  Return your findings as a JSON block (```json```) matching the structured output contract above.
  Use category prefix SEC for security findings. Use conventional comments.

  PR: $PR_NUMBER
  Scope: ONLY review the following changed files:
  ${CHANGED_FILES}
  """,
  run_in_background=True,
  max_turns=25
)
Agent(
  description="Review test adequacy",
  subagent_type="test-generator",
  prompt="""# Cache-optimized: stable content first (CC 2.1.73)
  TEST ADEQUACY REVIEW

  Evaluate whether this PR has sufficient tests:

  1. TEST EXISTENCE CHECK
     - Does the PR add/modify code WITHOUT adding/updating tests?
     - Are there changed files with 0 corresponding test files?
     - Flag: "MISSING" if code changes have no tests at all

  2. TEST TYPE MATCHING (use testing-unit/testing-e2e/testing-integration rules)
     Match changed code to required test types:
     - API endpoint changes → need integration tests (rule: integration-api)
     - DB schema changes → need migration + integration tests (rule: integration-database)
     - UI component changes → need unit + a11y tests (rule: unit-aaa-pattern, a11y-testing)
     - Business logic → need unit + property tests (rule: verification-techniques)
     - LLM/AI changes → need eval tests (rule: llm-evaluation)

  3. TEST QUALITY
     - Meaningful assertions (not just truthy/exists)
     - Edge cases and error paths covered
     - No flaky patterns (timing, external deps, random)
     - Mocking is appropriate (not over-mocked)

  4. COVERAGE GAPS
     - Which changed functions/methods lack test coverage?
     - Which error paths are untested?

  ## Project Context
  ${PROJECT_CONTEXT}

  Do NOT explore beyond the changed files listed below. Focus your analysis on the diff.

  Return your findings as a JSON block (```json```) matching the structured output contract above.
  Use category prefix TEST for testing findings. Use conventional comments.

  PR: $PR_NUMBER
  Scope: ONLY review the following changed files:
  ${CHANGED_FILES}
  """,
  run_in_background=True,
  max_turns=25
)
Agent(
  description="Review backend code",
  subagent_type="backend-system-architect",
  prompt="""# Cache-optimized: stable content first (CC 2.1.73)
  BACKEND REVIEW

  ## Project Context
  ${PROJECT_CONTEXT}

  Review backend code:
  1. API design and REST conventions
  2. Async/await patterns and error handling
  3. Database query efficiency (N+1)
  4. Transaction boundaries
  5. Redis connection lifecycle (close in try/finally)
  6. Webhook auth patterns (fail-closed)

  Do NOT explore beyond the changed files listed below. Focus your analysis on the diff.

  Return your findings as a JSON block (```json```) matching the structured output contract above.
  Use category prefixes: BUG (correctness), PERF (performance), MAINT (maintainability). Use conventional comments.

  PR: $PR_NUMBER
  Scope: ONLY review the following changed files:
  ${CHANGED_FILES}
  """,
  run_in_background=True,
  max_turns=25
)
Agent(
  description="Review frontend code",
  subagent_type="frontend-ui-developer",
  prompt="""# Cache-optimized: stable content first (CC 2.1.73)
  FRONTEND REVIEW

  ## Project Context
  ${PROJECT_CONTEXT}

  Review frontend code:
  1. React 19 patterns (hooks, server components)
  2. State management correctness
  3. Accessibility (a11y) compliance — button type attrs, ARIA
  4. Performance (memoization, lazy loading)
  5. SSR safety — no navigator/window outside hooks/useEffect

  Do NOT explore beyond the changed files listed below. Focus your analysis on the diff.

  Return your findings as a JSON block (```json```) matching the structured output contract above.
  Use category prefixes: A11Y (accessibility), PERF (performance), BUG (correctness). Use conventional comments.

  PR: $PR_NUMBER
  Scope: ONLY review the following changed files:
  ${CHANGED_FILES}
  """,
  run_in_background=True,
  max_turns=25
)

# 6 reviewers run one-by-one (slow)
Agent(subagent_type="code-quality-reviewer", prompt="...")
# Wait for completion
Agent(subagent_type="security-auditor", prompt="...")
# Wait again...

# All 6 agents in ONE message (fast)
Agent(subagent_type="code-quality-reviewer", prompt="...", run_in_background=True)
Agent(subagent_type="security-auditor", prompt="...", run_in_background=True)
Agent(subagent_type="test-generator", prompt="...", run_in_background=True)
# All launch simultaneously

Agent(
  description="Review LLM integration",
  subagent_type="llm-integrator",
  prompt="""LLM CODE REVIEW for PR $ARGUMENTS

  Review AI/LLM integration:
  1. Prompt injection prevention
  2. Token limit handling
  3. Caching strategy
  4. Error handling and fallbacks

  SUMMARY: End with: "RESULT: [PASS|WARN|FAIL] - [N] LLM issues: [key concern]"
  """,
  run_in_background=True,
  max_turns=25
)

# PR modifies prompt.py but no LLM reviewer
Agent(subagent_type="code-quality-reviewer", ...)
Agent(subagent_type="security-auditor", ...)
# Missing: LLM-specific review

# Detect AI/ML changes, add specialized reviewer
if pr_contains_llm_code:
    Agent(subagent_type="llm-integrator", prompt="LLM CODE REVIEW...", run_in_background=True)

# Persist review findings for cross-session learning
mcp__memory__create_entities(entities=[{
    "name": "PR-{number}-Review",
    "entityType": "code-review",
    "observations": [
        "<summary>",
        "<critical findings>",
        "<patterns discovered>",
    ],
}])

# Update known-weaknesses entity if new patterns found
mcp__memory__add_observations(observations=[{
    "entityName": "review-known-weaknesses",
    "contents": ["<new pattern from this review>"],
}])

# PR Review: #$ARGUMENTS

## Summary
[1-2 sentence overview]

## Code Quality
| Area | Status | Notes |
|------|--------|-------|
| Readability | // | [notes] |
| Type Safety | // | [notes] |

## Test Adequacy
| Check | Status | Details |
|-------|--------|---------|
| Tests exist for changes | // | [X changed files have tests, Y do not] |
| Test types match changes | // | [e.g., API changes have integration tests] |
| Coverage gaps | // | [N untested paths] |
| Test quality | // | [meaningful assertions, no flaky patterns] |

**Verdict:** [ADEQUATE | GAPS (list) | MISSING (critical)]

## Security
| Check | Status |
|-------|--------|
| Secrets | / |
| Input Validation | / |
| Dependencies | / |

## Blockers (Must Fix)
- [if any]

## Suggestions (Non-Blocking)
- [improvements]

# PR Review: #[NUMBER]
**Title**: [PR Title]
**Author**: [Author]
**Files Changed**: X | **Lines**: +Y / -Z

## Summary
[1-2 sentence overview of changes]

## ✅ Strengths
- [What's done well - from praise comments]
- [Good patterns observed]

## 🔍 Code Quality
| Area | Status | Notes |
|------|--------|-------|
| Readability | ✅/⚠️/❌ | [notes] |
| Type Safety | ✅/⚠️/❌ | [notes] |
| Test Coverage | ✅/⚠️/❌ | [X% coverage] |
| Error Handling | ✅/⚠️/❌ | [notes] |

## 🔒 Security
| Check | Status | Issues |
|-------|--------|--------|
| Secrets Scan | ✅/❌ | [count] |
| Input Validation | ✅/❌ | [issues] |
| Dependencies | ✅/❌ | [vulnerabilities] |

## ⚠️ Suggestions (Non-Blocking)
- [suggestion 1 with file:line reference]
- [suggestion 2]

## 🔴 Blockers (Must Fix Before Merge)
- [blocker 1 if any]
- [blocker 2 if any]

## 📋 CI Status
- Backend Lint: ✅/❌
- Backend Types: ✅/❌
- Backend Tests: ✅/❌
- Frontend Format: ✅/❌
- Frontend Lint: ✅/❌
- Frontend Types: ✅/❌
- Frontend Tests: ✅/❌

## ✅ Approved

Great work! Code quality is solid, tests pass, and security looks good.

### Highlights
- [specific positive feedback]

### Minor Suggestions (Non-Blocking)
- [optional improvements]

🤖 Reviewed with Claude Code (6 parallel agents)

## 🔄 Changes Requested

Good progress, but a few items need addressing before merge.

### Must Fix
1. [blocker 1]
2. [blocker 2]

### Suggestions
- [optional improvements]

🤖 Reviewed with Claude Code (6 parallel agents)

praise: Excellent use of the repository pattern here - clean separation of concerns.

nitpick: Consider using a more descriptive variable name than `d` - maybe `data` or `response`.

suggestion: This loop could be replaced with a list comprehension for better readability.

issue: This SQL query is vulnerable to injection - use parameterized queries instead.

question: Is there a reason we're not using the existing `UserService` here?

## Review Efficiency
| Agent | Tokens | Tools | Duration |
|-------|--------|-------|----------|
| code-quality-reviewer | 450 | 8 | 12s |
| security-auditor | 620 | 12 | 18s |
| test-generator | 380 | 6 | 10s |

**Total:** 1,450 tokens, 26 tool calls

cd backend
poetry run ruff format --check app/
poetry run ruff check app/
poetry run pytest tests/unit/ -v --tb=short
poetry run pytest tests/ -v --cov=app --cov-report=term-missing

cd frontend
npm run format:check
npm run lint
npm run typecheck
npm run test
npm run test -- --coverage

# Detect real service testing capability
ls **/docker-compose*.yml 2>/dev/null
ls **/testcontainers* 2>/dev/null

# If detected, run integration tests against real services
docker-compose -f docker-compose.test.yml up -d
poetry run pytest tests/integration/ -v
docker-compose -f docker-compose.test.yml down

# List changed files without corresponding test files
gh pr diff $ARGUMENTS --name-only | while read f; do
  # Skip test files, configs, docs
  case "$f" in
    tests/*|*test*|*.md|*.json|*.yml) continue ;;
  esac
  # Check if a test file exists
  test_file="tests/$(basename "$f" .py)_test.py"
  if [ ! -f "$test_file" ]; then
    echo "NO TEST: $f"
  fi
done