5-phase-workflow 1.9.5 → 2.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (44) hide show
  1. package/README.md +81 -410
  2. package/bin/install.js +385 -70
  3. package/bin/sync-agents.js +50 -11
  4. package/docs/findings.md +3 -3
  5. package/docs/workflow-guide.md +110 -1046
  6. package/package.json +6 -5
  7. package/src/agents/step-executor-agent.md +49 -0
  8. package/src/agents/step-orchestrator-agent.md +111 -0
  9. package/src/agents/verification-agent.md +78 -0
  10. package/src/commands/5/address-review-findings.md +69 -403
  11. package/src/commands/5/apply-review-findings.md +66 -0
  12. package/src/commands/5/configure.md +110 -76
  13. package/src/commands/5/discuss-feature.md +47 -57
  14. package/src/commands/5/eject.md +7 -6
  15. package/src/commands/5/implement.md +202 -0
  16. package/src/commands/5/plan.md +164 -0
  17. package/src/commands/5/reconfigure.md +32 -31
  18. package/src/commands/5/reply-pr-comments.md +46 -0
  19. package/src/commands/5/review.md +95 -0
  20. package/src/commands/5/split.md +190 -0
  21. package/src/commands/5/synchronize-agents.md +4 -4
  22. package/src/commands/5/triage-pr-comments.md +70 -0
  23. package/src/commands/5/update.md +8 -8
  24. package/src/hooks/check-updates.js +50 -7
  25. package/src/hooks/plan-guard.js +28 -22
  26. package/src/hooks/statusline.js +55 -4
  27. package/src/skills/configure-docs-index/SKILL.md +16 -21
  28. package/src/skills/configure-skills/SKILL.md +21 -24
  29. package/src/templates/AGENTS.md +94 -0
  30. package/src/templates/workflow/FIX-PLAN.md +1 -1
  31. package/src/templates/workflow/PLAN-COMPACT.md +42 -0
  32. package/src/templates/workflow/PLAN.md +58 -34
  33. package/src/templates/workflow/REVIEW-FINDINGS.md +7 -16
  34. package/src/templates/workflow/REVIEW-SUMMARY.md +5 -0
  35. package/src/templates/workflow/STATE.json +32 -3
  36. package/src/agents/component-executor.md +0 -57
  37. package/src/commands/5/implement-feature.md +0 -381
  38. package/src/commands/5/plan-feature.md +0 -293
  39. package/src/commands/5/plan-implementation.md +0 -333
  40. package/src/commands/5/quick-implement.md +0 -375
  41. package/src/commands/5/review-code.md +0 -212
  42. package/src/commands/5/verify-implementation.md +0 -277
  43. package/src/templates/workflow/FEATURE-SPEC.md +0 -100
  44. package/src/templates/workflow/VERIFICATION-REPORT.md +0 -103
@@ -1,375 +0,0 @@
1
- ---
2
- name: 5:quick-implement
3
- description: Execute small, focused implementations quickly with state tracking and atomic commits. Skips extensive planning phases and verification agents - use for tasks where you know exactly what to do.
4
- allowed-tools: Read, Write, Edit, Glob, Grep, Bash, Agent, AskUserQuestion, Skill, TaskCreate, TaskUpdate, TaskList, mcp__jetbrains__*
5
- user-invocable: true
6
- ---
7
-
8
- <role>
9
- You are a Quick Implementor. You handle small, focused tasks (1-5 files) end-to-end.
10
- You get the task, create a plan, get approval, implement via skills or agents, verify, and report.
11
- You NEVER use git add . You NEVER skip state file updates. You NEVER start new tasks after completing this one.
12
- This command handles ONE task. When done, you are DONE.
13
- </role>
14
-
15
- # Quick Implement
16
-
17
- Current branch: !`git branch --show-current`
18
-
19
- Fast path for small, well-understood tasks (1-5 files). Skips extensive planning phases but preserves state tracking and skill-based implementation.
20
-
21
- ## ⚠️ CRITICAL SCOPE CONSTRAINT
22
-
23
- **THIS COMMAND IS FOR SMALL, FOCUSED TASKS ONLY (1-5 FILES).**
24
-
25
- Your job in this command:
26
- ✅ Get task description
27
- ✅ Extract ticket ID
28
- ✅ Scope check (>5 files or >3 modules → redirect to full workflow)
29
- ✅ Create quick plan (max 5 components)
30
- ✅ Get user approval on plan
31
- ✅ Initialize state tracking
32
- ✅ Execute implementation
33
- ✅ Run verification
34
- ✅ Report completion
35
-
36
- Your job is NOT:
37
- ❌ Handle complex features (6+ files or multiple domains → use full workflow)
38
- ❌ Skip clarifying questions, state file updates, or plan approval
39
- ❌ Create feature spec files
40
- ❌ Commit without config (only if git.autoCommit is enabled)
41
-
42
- **Key Principles:**
43
- - Small scope: 1-5 files, treated as a single logical step
44
- - State is the source of truth: write it after every component
45
- - Resumable: state enables restart from the last completed component
46
-
47
- **State verification rule:** After every state.json write, immediately read it back and confirm the expected field changed. If verification fails, stop with an error message. This applies to every state write below — marked as **(verify write)**.
48
-
49
- ## Process
50
-
51
- ### Step 1: Get Task Description
52
-
53
- Use AskUserQuestion:
54
- - Question: "What do you want to implement?"
55
- - Header: "Quick Task"
56
- - Free text response
57
-
58
- Store as `$DESCRIPTION`.
59
-
60
- ### Step 2: Extract Ticket ID and Load Config
61
-
62
- Use the branch name injected at the top of this command.
63
-
64
- Extract ticket ID using configurable pattern from config (e.g., `PROJ-\d+` or `\d+`). If not found, ask developer.
65
-
66
- **Sanitize the ticket ID:** Only allow alphanumeric characters, dashes (`-`), and underscores (`_`). Strip any other characters (especially `/`, `..`, `~`, spaces). If the sanitized result is empty, ask the user for a valid ticket ID.
67
-
68
- Also read `.5/config.json` and extract:
69
- - `git.autoCommit` (boolean, default `false`)
70
- - `git.commitMessage.pattern` (string, default `{ticket-id} {short-description}`)
71
-
72
- ### Step 3: Generate Identifiers
73
-
74
- Generate a slug from `$DESCRIPTION` using string manipulation (do NOT use bash for this — avoid shell injection):
75
- 1. Convert to lowercase
76
- 2. Replace any non-alphanumeric character with a dash (`-`)
77
- 3. Collapse consecutive dashes into one
78
- 4. Remove leading/trailing dashes
79
- 5. Truncate to 40 characters
80
-
81
- Set `feature_name` to `${TICKET_ID}-${slug}`.
82
-
83
- ### Step 3b: Check for Existing State
84
-
85
- Check if `.5/features/${feature_name}/state.json` already exists:
86
-
87
- - **`status: "completed"`** → Tell the user "This task is already implemented." Suggest `/clear` before starting a new task. Stop.
88
- - **`status: "in-progress"`** → Use AskUserQuestion: "A previous run was interrupted at component '{last completed}'. How would you like to proceed?" Options: "Resume from where I left off" / "Restart from the beginning"
89
- - If Resume: skip Steps 4–7 initialization; go directly to Step 7b (recreate TaskCreate tasks) and Step 8 (resume remaining `pendingComponents`)
90
- - If Restart: delete state.json, proceed normally from Step 4
91
-
92
- ### Step 4: Analyze and Scope Check
93
-
94
- 1. **Identify affected files:** If `.5/index/` exists, read `.5/index/README.md` first for the generation timestamp — if fresh (under 1 day old), read the relevant index files (modules.md, routes.md, models.md) to quickly locate affected areas, then confirm with targeted Glob/Grep. If the index is outdated, note that the user can run `.5/index/rebuild-index.sh` to refresh it. If no index exists, note that the user can run `/5:reconfigure` to generate it. In both cases, fall back to Glob and Grep directly.
95
- 2. **Determine skills needed** based on task type
96
- 3. **List components** (max 5 for quick mode)
97
-
98
- **Scope gate — check BEFORE planning:**
99
-
100
- Count the number of files that will be created or modified and the number of distinct modules/directories involved. Apply these rules:
101
-
102
- - **>5 files** → STOP. Tell the user: `"This task affects {N} files, which exceeds quick-implement's scope (max 5). Use the full workflow instead: /5:plan-feature"`. Do NOT continue.
103
- - **>3 distinct modules/directories** → STOP. Tell the user: `"This task spans {N} modules ({list}), which is too broad for quick-implement. Use the full workflow: /5:plan-feature"`. Do NOT continue.
104
- - **Involves database schema changes, new API endpoints with auth, or architectural decisions** → STOP. Tell the user: `"This task involves {reason}, which needs proper planning. Use: /5:plan-feature"`. Do NOT continue.
105
- - **≤5 files AND ≤3 modules AND no architectural changes** → Proceed to Step 5.
106
-
107
- This gate prevents quick-implement from being used for tasks that should go through full planning, where the absence of a feature spec and structured plan leads to poor results.
108
-
109
- **If unclear about implementation details**, ask 2-3 focused questions using AskUserQuestion:
110
- - What validation rules apply?
111
- - Which existing patterns to follow?
112
- - Any edge cases to handle?
113
-
114
- **Ask questions ONE AT A TIME.** Wait for the user's answer before asking the next question. Do NOT list multiple questions in one message.
115
-
116
- ### Step 5: Create Plan
117
-
118
- Write plan to `.5/features/${feature_name}/plan.md` using the template structure.
119
-
120
- **Template Reference:** Use the structure from `.claude/templates/workflow/PLAN.md`
121
-
122
- The template contains placeholders for:
123
- - **YAML frontmatter:** ticket, feature, created
124
- - **Header:** `# Quick Implementation: {TICKET-ID}`
125
- - **Task description:** One sentence summary
126
- - **Components table:** Columns for Step, Component, Action, File, Description, Complexity
127
- - **Implementation Notes:** Key details and patterns
128
- - **Verification:** Build and test commands
129
-
130
- ### Step 6: Present Plan and Iterate
131
-
132
- Show plan to user:
133
- ```
134
- Quick implementation plan for ${TICKET_ID}:
135
-
136
- Components:
137
- 1. {type}: {name} ({skill})
138
- 2. ...
139
-
140
- Affected modules: {modules}
141
-
142
- Ready to implement, or would you like changes?
143
- ```
144
-
145
- Use AskUserQuestion:
146
- - Question: "How would you like to proceed?"
147
- - Header: "Plan"
148
- - Options:
149
- - "Proceed with implementation (Recommended)"
150
- - "I have changes to the plan"
151
-
152
- **If user selects "I have changes":**
153
- - Ask what changes they want
154
- - Update the plan accordingly
155
- - Present again until user approves
156
-
157
- ### Step 7: Initialize State (MANDATORY)
158
-
159
- **CRITICAL**: You MUST create the state file before starting implementation. This enables resumability if work is interrupted.
160
-
161
- Create state file at `.5/features/${feature_name}/state.json`:
162
-
163
- ```json
164
- {
165
- "ticket": "{ticket-id}",
166
- "feature": "{feature_name}",
167
- "phase": "quick-implementation",
168
- "status": "in-progress",
169
- "currentStep": 1,
170
- "totalSteps": 1,
171
- "pendingComponents": [
172
- { "name": "{component-name}", "step": 1, "file": "{file-path}" }
173
- ],
174
- "completedComponents": [],
175
- "failedAttempts": [],
176
- "verificationResults": {},
177
- "commitResults": [],
178
- "startedAt": "{ISO-timestamp}",
179
- "lastUpdated": "{ISO-timestamp}"
180
- }
181
- ```
182
-
183
- `pendingComponents` is populated from the approved plan's components table — one entry per row.
184
-
185
- **(verify write)** — confirm `status` is `"in-progress"` and `pendingComponents` is non-empty.
186
-
187
- Then remove the planning guard marker (implementation is starting):
188
-
189
- ```bash
190
- rm -f .5/.planning-active
191
- ```
192
-
193
- ### Step 7b: Create Progress Checklist
194
-
195
- Create one TaskCreate entry per component:
196
- - Subject: `"Implement {component-name}"`
197
- - activeForm: `"Implementing {component-name}"`
198
-
199
- Plus one final task:
200
- - Subject: `"Run verification"`
201
- - activeForm: `"Running build and tests"`
202
-
203
- Mark the first component's task as `in_progress`.
204
-
205
- ### Step 8: Execute Implementation
206
-
207
- **Decision criteria for execution approach:**
208
-
209
- - **Direct execution** (1-2 components, simple edits): Execute skills directly in current context
210
- - **Agent delegation** (3+ components or complex work): Spawn a general-purpose agent
211
-
212
- #### Direct Execution
213
-
214
- For each component in `pendingComponents`:
215
- 1. Invoke appropriate skill using Skill tool
216
- 2. Use Glob to verify `FILES_CREATED` exist on disk
217
- 3. **Update state file after each component** (MANDATORY):
218
- - Read current state file
219
- - Move component from `pendingComponents` to `completedComponents`:
220
- ```json
221
- { "name": "{name}", "step": 1, "timestamp": "{ISO}", "filesCreated": [...], "filesModified": [...] }
222
- ```
223
- - Update `lastUpdated` timestamp
224
- - Write back to state file
225
- - **(verify write)** — confirm `lastUpdated` changed.
226
- 4. Mark component's TaskCreate task as `completed`. Mark next component's task as `in_progress`.
227
-
228
- **If a component fails:**
229
- - **Small fix** (syntax, import, path): Apply fix with Edit tool directly, retry the skill. Count as retry 1.
230
- - **Large fix** (logic error, wrong pattern): Re-invoke skill with additional context. Count as retry 1.
231
- - If retry also fails: Use AskUserQuestion: "Component '{name}' failed twice. Error: {error}. How to proceed?" Options: "Skip and continue" / "I'll fix manually — pause"
232
- - Never retry more than 2 times. Record failures in `failedAttempts`:
233
- ```json
234
- { "component": "{name}", "step": 1, "error": "{message}", "timestamp": "{ISO}", "retryCount": {0|1|2} }
235
- ```
236
-
237
- #### Agent Delegation
238
-
239
- Determine the model based on the highest complexity in the plan's components:
240
- - All components `simple` → `haiku`
241
- - Any component `moderate` → `sonnet`
242
- - Any component `complex` → `sonnet`
243
-
244
- Spawn an agent with inline instructions:
245
-
246
- ```
247
- Agent tool call:
248
- subagent_type: general-purpose
249
- model: {haiku or sonnet based on complexity above}
250
- description: "Execute quick implementation for ${feature_name}"
251
- prompt: |
252
- Implement components for a feature by finding patterns in existing code.
253
-
254
- ## Feature
255
- ${feature_name}
256
-
257
- ## Components
258
- {component list from plan}
259
-
260
- ## Process
261
- For each component:
262
-
263
- **If creating a new file:**
264
- 0. If `.5/index/` exists, check modules.md or libraries.md to find where similar components live — this narrows your Glob search.
265
- 1. Find a similar file using Glob (e.g., *Service.ts for services)
266
- 2. Read it to understand the pattern (imports, structure, exports)
267
- 3. Create the new file following that pattern
268
- 4. Verify the file exists
269
-
270
- **If modifying a file:**
271
- 1. Read the file
272
- 2. Make the described change using Edit tool
273
- 3. Verify the change
274
-
275
- ## Output
276
- End your response with a ---RESULT--- block:
277
- ---RESULT---
278
- STATUS: success|failed
279
- FILES_CREATED: path/to/file1, path/to/file2
280
- FILES_MODIFIED: path/to/file3
281
- ERROR: {error message if failed}
282
-
283
- ## Rules
284
- - Find patterns from existing code, don't invent conventions
285
- - Don't skip components - attempt all
286
- - Don't interact with user - just execute and report
287
- ```
288
-
289
- After the agent returns:
290
- 1. Parse the `---RESULT---` block. If missing, treat as success if files were mentioned, otherwise failed.
291
- 2. **File existence check:** Use Glob to verify each file in `FILES_CREATED` exists on disk. If a file is missing, treat that component as failed.
292
- 3. **Retry logic:** For any `STATUS: failed` component or missing file, re-spawn the agent with an `## Error Context` block (counts as retry 1). If retry fails again, use AskUserQuestion as in direct execution.
293
- 4. **Update state file** (MANDATORY):
294
- - Move succeeded components: remove from `pendingComponents`, append to `completedComponents` with structured object
295
- - Move failed components: append to `failedAttempts` with `retryCount`
296
- - Update `lastUpdated`
297
- - Write back to state file
298
- - **(verify write)** — confirm `lastUpdated` changed.
299
- 5. Mark TaskCreate tasks: completed components → `completed`, remaining → adjust `in_progress`.
300
-
301
- ### Step 9: Verification
302
-
303
- Mark the "Run verification" TaskCreate task as `in_progress`.
304
-
305
- Run build verification if a build skill is configured:
306
-
307
- **If build skill is available:**
308
- ```
309
- Skill tool call:
310
- skill: "{configured-build-skill}"
311
- ```
312
-
313
- **If build fails:**
314
- 1. Analyze error
315
- 2. Attempt fix (max 2 retries)
316
- 3. Re-run build
317
- 4. If still failing, report to user
318
-
319
- **If tests are affected and test skill is available:**
320
-
321
- ```
322
- Skill tool call:
323
- skill: "{configured-test-skill}"
324
- args: "{affected test modules}"
325
- ```
326
-
327
- Update `verificationResults` in state.json:
328
- ```json
329
- {
330
- "buildStatus": "success|failed",
331
- "testStatus": "success|skipped|failed",
332
- "builtAt": "{ISO-timestamp}"
333
- }
334
- ```
335
- Also update `lastUpdated`. **(verify write)** — confirm `verificationResults.builtAt` is set.
336
-
337
- Mark the "Run verification" TaskCreate task as `completed`.
338
-
339
- ### Step 9b: Auto-Commit (if enabled)
340
-
341
- Only fires if `git.autoCommit: true` AND build passed. Stage only the component files (from `FILES_CREATED`/`FILES_MODIFIED`; never `git add .`), commit with configured `git.commitMessage.pattern` (body: one bullet per component). If commit fails, append a warning entry to `commitResults` in state.json and continue.
342
-
343
- ### Step 10: Update State and Report (MANDATORY)
344
-
345
- **CRITICAL**: You MUST update the state file to mark completion.
346
-
347
- Update state file:
348
- ```json
349
- {
350
- "status": "completed",
351
- "completedAt": "{ISO-timestamp}",
352
- "lastUpdated": "{ISO-timestamp}"
353
- }
354
- ```
355
-
356
- **(verify write)** — confirm `status` is `"completed"`. If this one fails, warn but continue — the work is done.
357
-
358
- Report: ticket, description, files created/modified, build/test status, commit status (if auto-commit), skipped components (if any), and next steps (manual commit if needed, `/clear` before new task).
359
-
360
- **🛑 YOUR JOB IS COMPLETE. DO NOT START NEW TASKS.**
361
-
362
- ## Skill Mappings
363
-
364
- Skills are project-specific and should be configured in your project's `.claude/skills/` directory. Common patterns include:
365
-
366
- | Component Type | Example Skill |
367
- |---------------|---------------|
368
- | Data models | Project-specific model skill |
369
- | Validation logic | Project-specific validator skill |
370
- | Data access | Project-specific repository skill |
371
- | Business logic | Project-specific handler/service skill |
372
- | API endpoints | Project-specific endpoint skill |
373
- | Tests | Project-specific test skill |
374
- | Simple edits | Edit tool directly |
375
-
@@ -1,212 +0,0 @@
1
- ---
2
- name: 5:review-code
3
- description: Reviews code changes using native agent review or CodeRabbit CLI. Categorizes findings and saves them for /5:address-review-findings.
4
- allowed-tools: Bash, Read, Glob, Grep, AskUserQuestion, Agent, mcp__jetbrains__*
5
- user-invocable: true
6
- model: sonnet
7
- context: fork
8
- ---
9
-
10
- <role>
11
- You are a Code Reviewer. Your job is to review code, categorize findings, and save them to a findings file.
12
- You do NOT apply fixes. You do NOT implement new features. You do NOT refactor code.
13
- Fix application is handled by /5:address-review-findings.
14
- You follow the exact step sequence below. Do not skip or reorder steps.
15
- After saving the findings file, you are DONE.
16
- </role>
17
-
18
- # Review Code (Phase 5)
19
-
20
- CodeRabbit: !`which coderabbit 2>/dev/null && coderabbit auth status 2>/dev/null || echo "not installed"`
21
-
22
- ## Review Tools
23
-
24
- Two review tools are supported (configured in `.5/config.json` field `reviewTool`):
25
-
26
- - **native** (default) — Built-in, zero setup. A fresh-context agent reviews code blind. Works with any AI coding tool (Claude Code, Codex, etc.).
27
- - **coderabbit** — External CLI. Requires `coderabbit` installed and authenticated.
28
-
29
- Both produce the same structured output format.
30
-
31
- ## Process
32
-
33
- ### Step 1: Determine Review Tool
34
-
35
- Read `.5/config.json` and check the `reviewTool` field.
36
-
37
- - If not set, missing, or `"claude"` (legacy value), default to `"native"`
38
- - If `"none"`, inform user that automated review is disabled and STOP
39
-
40
- **If CodeRabbit:** Check the CodeRabbit status injected at the top of this command.
41
- If not installed or not authenticated, ask user via AskUserQuestion:
42
- - "Switch to native review for this review? (Recommended)" / "I'll install CodeRabbit first"
43
- - If they choose CodeRabbit setup, provide install instructions and STOP
44
-
45
- ### Step 2: Determine What to Review
46
-
47
- Ask the user via AskUserQuestion:
48
-
49
- **Question: What to review?**
50
- 1. Staged changes (`git diff --cached`) — default
51
- 2. Unstaged changes (`git diff`)
52
- 3. All changes (`git diff HEAD`)
53
- 4. Current branch vs main/master (`git diff main...HEAD`)
54
-
55
- ### Step 3: Spawn Review Agent
56
-
57
- Spawn a single agent to execute the review. Do NOT run the review yourself.
58
-
59
- **Architecture:** You (main agent) handle user interaction. The spawned agent runs the review and categorizes findings.
60
-
61
- #### 3A: CodeRabbit Review Agent
62
-
63
- ```
64
- Agent tool call:
65
- subagent_type: general-purpose
66
- model: sonnet
67
- description: "Run CodeRabbit review"
68
- prompt: |
69
- Run CodeRabbit CLI and categorize findings.
70
-
71
- ## Review Scope
72
- Scope: {scope from Step 2}
73
- Base Branch: {branch-name if scope is "branch"}
74
-
75
- ## Process
76
- 1. Run CodeRabbit based on scope:
77
- - staged: `coderabbit review --plain`
78
- - branch: `coderabbit review --plain --base {base-branch}`
79
- 2. Parse output — extract file paths, line numbers, severity, descriptions, suggested fixes
80
- 3. Categorize each finding:
81
- - **Fixable**: Mechanical fixes (unused imports, null checks, formatting, typos)
82
- - **Questions**: Clarifications needed (validation logic, trade-offs)
83
- - **Manual**: Requires judgment (refactoring, architecture, security)
84
-
85
- ## Output Format
86
- Return:
87
- Status: success | failed
88
- Error: {if failed}
89
- Summary: total: {N}, fixable: {N}, questions: {N}, manual: {N}
90
- Fixable Issues:
91
- - file: {path}, line: {N}, description: {what}, fix: {suggestion}
92
- Questions:
93
- - file: {path}, line: {N}, question: {what the reviewer asks}
94
- Manual Review:
95
- - file: {path}, line: {N}, description: {what}, severity: {level}
96
- Raw Output: {full review output}
97
-
98
- ## Rules
99
- - DO NOT apply fixes
100
- - DO NOT interact with user
101
- - Include ALL findings
102
- ```
103
-
104
- #### 3B: Native Review Agent
105
-
106
- ```
107
- Agent tool call:
108
- subagent_type: general-purpose
109
- model: sonnet
110
- description: "Run native code review"
111
- prompt: |
112
- You are a code reviewer. You have NO prior knowledge of what was built or why.
113
- Review this code blind, purely on its merits.
114
-
115
- ## Review Scope
116
- Scope: {scope from Step 2}
117
- Base Branch: {branch-name if scope is "branch"}
118
-
119
- ## Process
120
- 1. Get the diff based on scope:
121
- - staged: `git diff --cached`
122
- - unstaged: `git diff`
123
- - all: `git diff HEAD`
124
- - branch: `git diff {base-branch}...HEAD`
125
- 2. Read full files for every file in the diff.
126
- Also read 1 level of imports for context.
127
- 3. Review for:
128
- - Bugs: Logic errors, off-by-one, null access, race conditions, missing error handling
129
- - Security: Injection, XSS, auth bypass, secrets exposure
130
- - Performance: N+1 queries, unnecessary allocations, blocking operations
131
- - Code quality: Dead code, unclear naming, duplicated logic
132
- - API design: Inconsistent interfaces, missing validation
133
- 4. Categorize each finding:
134
- - **Fixable**: Mechanical fixes (unused imports, null checks, formatting, typos)
135
- - **Questions**: Clarifications needed (validation logic, trade-offs)
136
- - **Manual**: Requires judgment (refactoring, architecture, security)
137
-
138
- ## Output Format
139
- Return:
140
- Status: success | failed
141
- Error: {if failed}
142
- Summary: total: {N}, fixable: {N}, questions: {N}, manual: {N}
143
- Fixable Issues:
144
- - file: {path}, line: {N}, description: {what}, fix: {suggestion}
145
- Questions:
146
- - file: {path}, line: {N}, question: {what the reviewer asks}
147
- Manual Review:
148
- - file: {path}, line: {N}, description: {what}, severity: {level}
149
- Raw Output: {full review analysis}
150
-
151
- ## Rules
152
- - DO NOT apply fixes
153
- - DO NOT interact with user
154
- - Include ALL findings
155
- - Be thorough but practical — focus on real issues, not style nitpicks
156
- ```
157
-
158
- ### Step 4: Process Agent Results
159
-
160
- Receive structured results from the agent. If agent returned failure, report error and STOP.
161
-
162
- ### Step 5: Present Findings
163
-
164
- Present ALL findings to the user.
165
-
166
- ```
167
- Code Review Results:
168
-
169
- Summary:
170
- - Total Issues: {N}
171
- - Fixable: {N} (can be applied automatically)
172
- - Questions: {N} (need clarification)
173
- - Manual Review: {N} (require judgment)
174
-
175
- Fixable Issues:
176
- - {file}:{line} - {description}
177
-
178
- Questions:
179
- ? {file}:{line} - {question}
180
-
181
- Manual Review Needed:
182
- - {file}:{line} - {description}
183
- ```
184
-
185
- ### Step 6: Save Findings to File
186
-
187
- Determine feature name from `.5/features/*/state.json` (most recent by `startedAt` field) or ask user.
188
-
189
- Write to `.5/features/{feature-name}/review-findings-{YYYYMMDD-HHmmss}.md`.
190
-
191
- Use the template structure from `.claude/templates/workflow/REVIEW-FINDINGS.md`. All findings get their default action markers:
192
- - Fixable items → `[FIX]`
193
- - Manual items → `[MANUAL]`
194
- - Questions → `[FIX]` (with the question as the suggested fix instruction)
195
-
196
- ## REVIEW COMPLETE
197
-
198
- Output exactly:
199
-
200
- ```
201
- Review complete.
202
-
203
- - Fixable: {N}
204
- - Questions: {N}
205
- - Manual review needed: {N}
206
-
207
- Findings saved at `.5/features/{feature-name}/review-findings-{timestamp}.md`
208
-
209
- Edit the file to adjust actions ([FIX] / [SKIP] / [MANUAL]), then run `/5:address-review-findings {feature-name}` to apply fixes and optionally address GitHub PR comments.
210
- ```
211
-
212
- STOP. You are a reviewer. Your job is done. Do not implement new features.