@mechanai/deepreview 2.2.0 → 2.2.1

package/.opencode/agents/deepreview-applier.md

@@ -6,6 +6,10 @@ permission:
   edit: allow
   bash:
     "git diff*": allow
+    "mise run fmt*": allow
+    "mise run lint*": allow
+    "mise run check*": allow
+    "mise run test*": allow
     "*": deny
 ---
 
@@ -30,6 +34,24 @@ For each fix in the plan, in the order specified by the "Order of Operations" se
 
 If a fix cannot be applied (file doesn't exist, code doesn't match what was expected), skip it and note the failure.
 
+## Scope rules
+
+- Apply ONLY what the plan specifies. Do not add defensive validation, optimize adjacent code, or improve coverage beyond what the fix requires.
+- If the plan's code change seems incomplete or wrong, apply it anyway and note the concern — do not improvise a "better" fix.
+
+## Verification (after all fixes are applied)
+
+After applying all fixes, run verification if `mise.toml` exists in the project root:
+
+1. Run `mise run fmt` (auto-fix formatting — this is expected to modify files)
+2. Run `mise run lint` or `mise run check` (whichever exists)
+3. Run `mise run test`
+
+If lint/check/test fails:
+
+- Include the error output in your response
+- Mark the relevant fix as FAILED with the error
+
 ## Response contract
 
 Your ONLY response must be a list of files modified, one per line, in this format:
@@ -37,6 +59,8 @@ Your ONLY response must be a list of files modified, one per line, in this forma
 ```
 APPLIED: path/to/file.ts — [one-line description of change]
 SKIPPED: path/to/other.ts — [reason it couldn't be applied]
+FAILED: path/to/broken.ts — [lint/test error message]
+VERIFICATION: [PASS | FAIL — summary of fmt/lint/test results]
 ```
 
 Do not include any other text.

package/.opencode/agents/deepreview-architecture.md

@@ -36,6 +36,11 @@ Your prompt may also begin with framing directives (e.g., novelty-seeking instru
 
 Use `git log` on changed files to understand the evolution of the code.
 
+## Scope constraints
+
+- **Only flag issues attributable to the diff under review.** Pre-existing problems in unchanged code are out of scope unless the diff makes them actively worse.
+- Focus on structural and design issues, not cosmetic ones.
+
 ## Output format
 
 Write your review to the output path provided. Use this format for each finding:

package/.opencode/agents/deepreview-compatibility.md

@@ -38,6 +38,10 @@ Your prompt may also begin with framing directives (e.g., novelty-seeking instru
 
 Use `git log` and `git show` to check if removed/changed items had external consumers.
 
+## Scope constraints
+
+- **Only flag issues attributable to the diff under review.** Pre-existing compatibility concerns in unchanged code are out of scope unless the diff makes them actively worse.
+
 ## Output format
 
 Write your review to the output path provided. Use this format for each finding:

package/.opencode/agents/deepreview-correctness.md

@@ -38,6 +38,11 @@ Your prompt may also begin with framing directives (e.g., novelty-seeking instru
 
 Use `git blame` and `git log` on changed files to understand intent when unclear.
 
+## Scope constraints
+
+- **Only flag issues attributable to the diff under review.** Pre-existing bugs in unchanged code are out of scope unless the diff makes them actively worse.
+- Focus on correctness of the new/changed code, not unrelated pre-existing issues.
+
 ## Output format
 
 Write your review to the output path provided. Use this format for each finding:

package/.opencode/agents/deepreview-docs.md

@@ -49,10 +49,16 @@ Write your review to the output path provided. Use this format for each finding:
 
 Severity guide:
 
-- **critical:** Doc/comment claims something false about the code (will mislead developers or users)
+- **critical:** Doc/comment claims something false that would cause an implementer to build the wrong thing or misuse an API. Stale wording that is obviously outdated (and thus unlikely to mislead) is NOT critical.
 - **warning:** Duplicate or stale content that wastes reader attention
 - **suggestion:** Verbose text that could be tightened
 
+## Scope constraints
+
+- **Only flag issues attributable to the diff under review.** Pre-existing documentation problems in unchanged code are out of scope unless the diff makes them actively worse.
+- **ADRs (Architecture Decision Records) are historical documents.** Do not flag them for being "stale" — they record the decision at the time it was made. Only flag ADRs if the diff explicitly modifies them and introduces inconsistencies.
+- **Test code cosmetics** (test function names, test descriptions) are suggestions at most, never warnings or critical.
+
 If you find no issues, write: "No documentation issues found."
 
 Be concise. No preamble or filler. Each finding should be actionable in 3-5 lines. If you find no issues in a category, say so in one line.

package/.opencode/agents/deepreview-planner.md

@@ -23,6 +23,12 @@ You will receive a path to a synthesis file. Read it.
 2. For each finding, read ONLY the specific function or block referenced (use the Read tool with offset/limit to read ~50 lines around the referenced line — do NOT read entire files)
 3. Write exact code changes for each fix
 
+## Quality rules
+
+- **One clean solution per fix.** Do not include your reasoning process, rejected approaches, or self-corrections in the output. If you are unsure which approach is best, pick the simplest one and add a one-line "Alternative:" note.
+- **Stay within scope.** Only fix what the synthesis identifies. Do not add defensive validation, optimize adjacent code, or improve test coverage beyond what the findings require.
+- **Concrete, not aspirational.** Every code change must be copy-pasteable. No pseudocode, no "something like this", no TODOs.
+
 ## Output format
 
 Write your implementation plan to the output path provided. Use this structure:

package/.opencode/agents/deepreview-security.md

@@ -36,6 +36,11 @@ Your prompt may also begin with framing directives (e.g., novelty-seeking instru
 
 Use `git blame` and `git log` on changed files to understand intent when unclear.
 
+## Scope constraints
+
+- **Only flag issues attributable to the diff under review.** Pre-existing security or performance issues in unchanged code are out of scope unless the diff makes them actively worse.
+- **Test code patterns** (test fixtures, test helpers, deliberate test doubles) should only be flagged if they could leak into production or mask real bugs. `std::mem::forget` in a test to keep a tempdir alive is not a security concern.
+
 ## Output format
 
 Write your review to the output path provided. Use this format for each finding:

package/.opencode/agents/deepreview-validator.md

@@ -14,26 +14,38 @@ permission:
     "*": deny
 ---
 
-You are a skeptical senior engineer. Your job is to cross-validate code review findings by checking every claim against the actual source code. You are not here to agree — you are here to disprove.
+You are a skeptical senior engineer. Your job is to cross-validate code review findings by checking every claim against the actual source code. You are not here to agree — you are here to disprove. Your default stance is rejection; a finding must earn its place with verifiable evidence.
 
 ## Input
 
-You will receive paths to 3 review files and a perspective label (correctness, security, or architecture). Read all 3 review files.
+You will receive paths to review files and a perspective label. Read all review files.
 
 ## Process
 
-For each finding in all 3 reviews:
+For each finding in all reviews:
 
 1. Read the source file and line referenced in the finding
-2. Determine if the claimed issue actually exists in the code
-3. If the finding makes claims about external tool behavior (CLI flags, API parameters, library methods), **verify those claims**. Run `--help`, check man pages, or use WebFetch to check documentation. If the claimed behavior doesn't exist, classify as disproved.
-4. Check if the issue is already handled elsewhere (error handling, validation, guards)
-5. Classify the finding:
-   - **confirmed** (high confidence): you verified the issue exists in the code
+2. **Verify the reference exists.** If the finding claims something exists at a specific file:line (a function, a reference, a pattern), confirm that thing actually exists at that location. If it doesn't, classify as disproved.
+3. Determine if the claimed issue actually exists in the code
+4. If the finding makes claims about external tool behavior (CLI flags, API parameters, library methods), **verify those claims**. Run `--help`, check man pages, or use WebFetch to check documentation. If the claimed behavior doesn't exist, classify as disproved.
+5. Check if the issue is already handled elsewhere (error handling, validation, guards)
+6. **Assess severity proportionality.** If the finding's severity is more than one level above what the evidence supports (e.g., a stale comment rated "critical" when it's clearly a "suggestion"), downgrade it or classify as trivial.
+7. Classify the finding:
+   - **confirmed** (high confidence): you verified the issue exists in the code and the severity is proportionate
    - **plausible** (medium confidence): the issue might exist but you cannot fully verify
-   - **disproved** (low confidence): the code already handles this, the claim is wrong, or the finding assumes external tool/API behavior that doesn't exist
+   - **trivial**: the issue technically exists but is not worth fixing — severity is inflated, the fix is cosmetic, or the finding is a style preference rather than an objective defect
+   - **disproved** (low confidence): the code already handles this, the claim is wrong, the referenced location doesn't contain what's claimed, or the finding assumes external tool/API behavior that doesn't exist
 
-Discard all low-confidence (disproved) findings entirely.
+Discard all **disproved** and **trivial** findings entirely.
+
+## Rejection criteria (discard the finding if ANY apply)
+
+- The referenced file:line does not contain what the finding claims
+- The finding flags a pre-existing issue in unchanged code that the diff does not make worse
+- The severity is inflated by more than one level (e.g., a typo in a comment rated "critical")
+- The finding is a design opinion or stylistic preference, not an objective defect
+- The finding duplicates another reviewer's finding on the same file:line (note the overlap, keep only one)
+- The finding references a historical document (ADR, changelog) as "stale" when the document is intentionally historical
 
 ## Output format
 

package/.opencode/commands/deepreview-loop.md

@@ -44,9 +44,20 @@ Dispatch the applier automatically — do NOT ask the user for permission.
 Use the Task tool with subagent_type="deepreview-applier":
 "Read the implementation plan at $SESSION_DIR/implementation-plan.md. Apply the fixes."
 
-Wait for the applier to return.
+Wait for the applier to return. Parse the applier's response for VERIFICATION status.
 
-STEP 5: INCREMENT AND RE-REVIEW (lightweight — NO cross-validation)
+STEP 4b: HANDLE VERIFICATION RESULTS
+If the applier reports VERIFICATION: FAIL:
+
+- Show the user the error summary from the applier's response
+- Ask: "Applied fixes failed verification (lint/test). Options: revert and skip failing fix, continue anyway, or stop?"
+- If revert: run `git checkout -- .` to undo all changes from this iteration, note which fix failed, add it to a SKIP_LIST, and re-run the planner+applier without that fix.
+- If continue: proceed to STEP 5 (the next iteration's reviewers will likely catch the introduced error).
+- If stop: STOP.
+
+If the applier reports VERIFICATION: PASS (or no verification was possible): proceed to STEP 5.
+
+STEP 5: INCREMENT AND RE-REVIEW
 Set ITERATION = ITERATION + 1
 
 If ITERATION > 5:
@@ -68,36 +79,47 @@ Prepare fresh input:
 
 Check if input.txt is empty. If empty, tell user "Nothing to review — all changes resolved." and STOP.
 
-STEP 5a: BUILD PRIOR CONTEXT
+STEP 5a: DIFF SIZE DIVERGENCE CHECK
+Compare the size of the new input.txt to the previous iteration's input.txt (in bytes or lines).
+If the new input is more than 50% larger than the previous iteration's input:
+
+- Tell the user: "Divergence warning: diff grew from ~N to ~M lines (X% increase). The applier may be adding more code than it's fixing."
+- Ask: "Continue with the larger diff, or revert last iteration's changes?"
+- If revert: run `git checkout -- .`, STOP.
+- If continue: proceed.
+
+STEP 5b: BUILD PRIOR CONTEXT
 Accumulate findings from ALL previous iterations into PRIOR_CONTEXT so no finding is re-reported.
 
-To build this, dispatch a helper task that reads ALL previous syntheses:
+To build this, dispatch a helper task that reads ALL previous syntheses AND implementation plans:
 NOTE: Interpolate the actual directory paths from ALL_SESSION_DIRS into this task string — the subagent cannot access your variables.
 Task — Use the Task tool with subagent_type="general":
-"Read the synthesis files from these directories: [LIST EACH PATH FROM ALL_SESSION_DIRS EXCLUDING CURRENT]. If any synthesis file does not exist, skip it. Extract ALL findings across them as a deduplicated Markdown list in this exact format:
+"Read the synthesis files AND implementation plan files from these directories: [LIST EACH PATH FROM ALL_SESSION_DIRS EXCLUDING CURRENT]. If any file does not exist, skip it. Extract:
 
 ## Prior Findings (already reported — do not re-report or verify)
 
 - [Short Issue Title] ([category]) — [file:line]
 
+## Applied Fixes (changes made by previous iterations — new bugs here are regressions)
+
+- [Fix title from implementation plan] — [file:line] (applied in iter N)
+
 ## Covered Regions (already examined — prioritize elsewhere)
 
 - [file:line-range] (pad each finding's file:line by 20 lines in each direction)
 
-Deduplicate findings that appear in multiple syntheses. Return ONLY these two sections, nothing else."
+Deduplicate findings that appear in multiple syntheses. Return ONLY these three sections, nothing else."
 
 Set PRIOR_CONTEXT to the returned text. Validate that it contains "## Prior Findings" — if not, warn the user ("Helper returned malformed prior context — proceeding without deduplication") and set PRIOR_CONTEXT="". If CONTEXT_FILE exists, prepend:
 "## Design Decisions (intentional — do not flag)\nThe following are deliberate design choices. Do NOT flag these as issues or suggest alternatives.\n`\n" + contents of CONTEXT_FILE + "\n`\n\n"
 
-NOW RUN A LIGHTWEIGHT REVIEW (Stages 1, 3, 4 only — NO cross-validation):
-
-The key difference: iteration 2+ skips cross-validation. This prevents validators from filtering out new issues introduced by fixes.
+STEP 5c: RUN REVIEW WITH CROSS-VALIDATION
 
 Stage 1 — DISPATCH 5 PARALLEL REVIEWERS:
 Each reviewer prompt MUST include PRIOR_CONTEXT and the novelty-seeking framing below.
 
 The REVIEWER_PREAMBLE for all iter2+ reviewers is:
-"Your goal is to find issues that PREVIOUS reviewers missed. Do NOT re-report, verify, or comment on prior findings.
+"Your goal is to find issues that PREVIOUS reviewers missed. Do NOT re-report, verify, or comment on prior findings. If you find a bug in code listed under 'Applied Fixes', flag it as a regression.
 
 $PRIOR_CONTEXT
 
@@ -130,14 +152,39 @@ Read the content at $SESSION_DIR/input.txt. Write your review to $SESSION_DIR/re
 
 Wait for all 5. Record which succeeded.
 
-Stage 3 (skip Stage 2) — DISPATCH SYNTHESIZER DIRECTLY ON RAW REVIEWS:
-Task 6 — Use the Task tool with subagent_type="deepreview-synthesizer":
-"Read the reviews at: $SESSION_DIR/review-correctness.md, $SESSION_DIR/review-security.md, $SESSION_DIR/review-architecture.md, $SESSION_DIR/review-docs.md, $SESSION_DIR/review-compatibility.md. Write the synthesis to $SESSION_DIR/synthesis.md."
+STEP 5d: VERIFY REVIEWER OUTPUT
+Check how many review files were actually written. Run: `ls $SESSION_DIR/review-*.md 2>/dev/null | wc -l`
+
+- If 0 files exist: Tell the user "All reviewers failed to produce output. This usually means the diff is too large for subagent context windows or there was an infrastructure failure." STOP.
+- If 1-2 files exist: Warn the user "Only N/5 reviewers produced output. Proceeding with partial results." Continue with what exists.
+- If 3+ files exist: Proceed normally.
+
+Stage 2 — DISPATCH 5 PARALLEL VALIDATORS (cross-validation):
+Task 6 — Use the Task tool with subagent_type="deepreview-validator":
+"Your perspective: correctness. Read all review files at: $SESSION_DIR/review-correctness.md, $SESSION_DIR/review-security.md, $SESSION_DIR/review-architecture.md, $SESSION_DIR/review-docs.md, $SESSION_DIR/review-compatibility.md. Also read the original input at $SESSION_DIR/input.txt for context. Write your validated review to $SESSION_DIR/validated-correctness.md."
+
+Task 7 — Use the Task tool with subagent_type="deepreview-validator":
+"Your perspective: security. Read all review files at: $SESSION_DIR/review-correctness.md, $SESSION_DIR/review-security.md, $SESSION_DIR/review-architecture.md, $SESSION_DIR/review-docs.md, $SESSION_DIR/review-compatibility.md. Also read the original input at $SESSION_DIR/input.txt for context. Write your validated review to $SESSION_DIR/validated-security.md."
+
+Task 8 — Use the Task tool with subagent_type="deepreview-validator":
+"Your perspective: architecture. Read all review files at: $SESSION_DIR/review-correctness.md, $SESSION_DIR/review-security.md, $SESSION_DIR/review-architecture.md, $SESSION_DIR/review-docs.md, $SESSION_DIR/review-compatibility.md. Also read the original input at $SESSION_DIR/input.txt for context. Write your validated review to $SESSION_DIR/validated-architecture.md."
+
+Task 9 — Use the Task tool with subagent_type="deepreview-validator":
+"Your perspective: docs. Read all review files at: $SESSION_DIR/review-correctness.md, $SESSION_DIR/review-security.md, $SESSION_DIR/review-architecture.md, $SESSION_DIR/review-docs.md, $SESSION_DIR/review-compatibility.md. Also read the original input at $SESSION_DIR/input.txt for context. Write your validated review to $SESSION_DIR/validated-docs.md."
+
+Task 10 — Use the Task tool with subagent_type="deepreview-validator":
+"Your perspective: compatibility. Read all review files at: $SESSION_DIR/review-correctness.md, $SESSION_DIR/review-security.md, $SESSION_DIR/review-architecture.md, $SESSION_DIR/review-docs.md, $SESSION_DIR/review-compatibility.md. Also read the original input at $SESSION_DIR/input.txt for context. Write your validated review to $SESSION_DIR/validated-compatibility.md."
+
+Wait for all 5 to return.
+
+Stage 3 — DISPATCH SYNTHESIZER:
+Task 11 — Use the Task tool with subagent_type="deepreview-synthesizer":
+"Read the validated reviews at: $SESSION_DIR/validated-correctness.md, $SESSION_DIR/validated-security.md, $SESSION_DIR/validated-architecture.md, $SESSION_DIR/validated-docs.md, $SESSION_DIR/validated-compatibility.md (skip any that don't exist). Write the synthesis to $SESSION_DIR/synthesis.md."
 
 Record the stats line.
 
 Stage 4 — DISPATCH PLANNER:
-Task 7 — Use the Task tool with subagent_type="deepreview-planner":
+Task 12 — Use the Task tool with subagent_type="deepreview-planner":
 "Read the synthesis at $SESSION_DIR/synthesis.md. Write the implementation plan to $SESSION_DIR/implementation-plan.md."
 
 Record the summary line.
@@ -160,8 +207,9 @@ IMPORTANT RULES:
 - Use ONLY the file paths and stats/summary lines returned by subagents.
 - Apply ALL findings (critical, warning, AND suggestion) — the goal is a clean review.
 - Do NOT ask the user for permission to apply fixes. Apply automatically.
-- DO ask the user if iteration limit is hit or deadlock is detected.
-- Iteration 2+ MUST skip cross-validation, MUST include PRIOR_CONTEXT, and MUST use novelty-seeking framing.
+- DO ask the user if: iteration limit is hit, deadlock is detected, verification fails, or diff size diverges.
+- Iteration 2+ MUST include cross-validation, MUST include PRIOR_CONTEXT, and MUST use novelty-seeking framing.
 - Iteration 2+ MUST NOT tell reviewers to "verify" or "check status of" prior findings.
 - Each iteration uses a NEW session directory — never reuse a previous one.
 - If --context file is provided, include its contents under "Design Decisions" in PRIOR_CONTEXT for ALL iterations (including iter1).
+- If all reviewers produce zero output files, STOP immediately — do not continue to synthesis.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mechanai/deepreview",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "description": "Multi-agent parallel code/spec review for OpenCode",
   "license": "MIT",
   "repository": {