specweave 1.0.550 → 1.0.552

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (166) hide show
  1. package/CLAUDE.md +1 -1
  2. package/bin/specweave.js +23 -1
  3. package/dist/src/cli/commands/hook.d.ts +15 -0
  4. package/dist/src/cli/commands/hook.d.ts.map +1 -0
  5. package/dist/src/cli/commands/hook.js +61 -0
  6. package/dist/src/cli/commands/hook.js.map +1 -0
  7. package/dist/src/cli/commands/init.d.ts.map +1 -1
  8. package/dist/src/cli/commands/init.js +5 -0
  9. package/dist/src/cli/commands/init.js.map +1 -1
  10. package/dist/src/cli/commands/refresh-plugins.d.ts.map +1 -1
  11. package/dist/src/cli/commands/refresh-plugins.js +11 -1
  12. package/dist/src/cli/commands/refresh-plugins.js.map +1 -1
  13. package/dist/src/cli/commands/sync-setup.d.ts.map +1 -1
  14. package/dist/src/cli/commands/sync-setup.js +7 -3
  15. package/dist/src/cli/commands/sync-setup.js.map +1 -1
  16. package/dist/src/cli/helpers/issue-tracker/project-mapping-wizard.d.ts +9 -0
  17. package/dist/src/cli/helpers/issue-tracker/project-mapping-wizard.d.ts.map +1 -1
  18. package/dist/src/cli/helpers/issue-tracker/project-mapping-wizard.js +9 -3
  19. package/dist/src/cli/helpers/issue-tracker/project-mapping-wizard.js.map +1 -1
  20. package/dist/src/config/types.d.ts +2 -2
  21. package/dist/src/core/config/types.d.ts +18 -2
  22. package/dist/src/core/config/types.d.ts.map +1 -1
  23. package/dist/src/core/config/types.js.map +1 -1
  24. package/dist/src/core/hooks/handlers/hook-router.d.ts +19 -0
  25. package/dist/src/core/hooks/handlers/hook-router.d.ts.map +1 -0
  26. package/dist/src/core/hooks/handlers/hook-router.js +75 -0
  27. package/dist/src/core/hooks/handlers/hook-router.js.map +1 -0
  28. package/dist/src/core/hooks/handlers/index.d.ts +10 -0
  29. package/dist/src/core/hooks/handlers/index.d.ts.map +1 -0
  30. package/dist/src/core/hooks/handlers/index.js +9 -0
  31. package/dist/src/core/hooks/handlers/index.js.map +1 -0
  32. package/dist/src/core/hooks/handlers/post-tool-use-analytics.d.ts +11 -0
  33. package/dist/src/core/hooks/handlers/post-tool-use-analytics.d.ts.map +1 -0
  34. package/dist/src/core/hooks/handlers/post-tool-use-analytics.js +73 -0
  35. package/dist/src/core/hooks/handlers/post-tool-use-analytics.js.map +1 -0
  36. package/dist/src/core/hooks/handlers/post-tool-use.d.ts +11 -0
  37. package/dist/src/core/hooks/handlers/post-tool-use.d.ts.map +1 -0
  38. package/dist/src/core/hooks/handlers/post-tool-use.js +76 -0
  39. package/dist/src/core/hooks/handlers/post-tool-use.js.map +1 -0
  40. package/dist/src/core/hooks/handlers/pre-compact.d.ts +11 -0
  41. package/dist/src/core/hooks/handlers/pre-compact.d.ts.map +1 -0
  42. package/dist/src/core/hooks/handlers/pre-compact.js +77 -0
  43. package/dist/src/core/hooks/handlers/pre-compact.js.map +1 -0
  44. package/dist/src/core/hooks/handlers/pre-tool-use.d.ts +11 -0
  45. package/dist/src/core/hooks/handlers/pre-tool-use.d.ts.map +1 -0
  46. package/dist/src/core/hooks/handlers/pre-tool-use.js +318 -0
  47. package/dist/src/core/hooks/handlers/pre-tool-use.js.map +1 -0
  48. package/dist/src/core/hooks/handlers/session-start.d.ts +9 -0
  49. package/dist/src/core/hooks/handlers/session-start.d.ts.map +1 -0
  50. package/dist/src/core/hooks/handlers/session-start.js +111 -0
  51. package/dist/src/core/hooks/handlers/session-start.js.map +1 -0
  52. package/dist/src/core/hooks/handlers/stop-auto.d.ts +16 -0
  53. package/dist/src/core/hooks/handlers/stop-auto.d.ts.map +1 -0
  54. package/dist/src/core/hooks/handlers/stop-auto.js +122 -0
  55. package/dist/src/core/hooks/handlers/stop-auto.js.map +1 -0
  56. package/dist/src/core/hooks/handlers/stop-reflect.d.ts +14 -0
  57. package/dist/src/core/hooks/handlers/stop-reflect.d.ts.map +1 -0
  58. package/dist/src/core/hooks/handlers/stop-reflect.js +43 -0
  59. package/dist/src/core/hooks/handlers/stop-reflect.js.map +1 -0
  60. package/dist/src/core/hooks/handlers/stop-sync.d.ts +15 -0
  61. package/dist/src/core/hooks/handlers/stop-sync.d.ts.map +1 -0
  62. package/dist/src/core/hooks/handlers/stop-sync.js +68 -0
  63. package/dist/src/core/hooks/handlers/stop-sync.js.map +1 -0
  64. package/dist/src/core/hooks/handlers/types.d.ts +63 -0
  65. package/dist/src/core/hooks/handlers/types.d.ts.map +1 -0
  66. package/dist/src/core/hooks/handlers/types.js +27 -0
  67. package/dist/src/core/hooks/handlers/types.js.map +1 -0
  68. package/dist/src/core/hooks/handlers/user-prompt-submit.d.ts +14 -0
  69. package/dist/src/core/hooks/handlers/user-prompt-submit.d.ts.map +1 -0
  70. package/dist/src/core/hooks/handlers/user-prompt-submit.js +173 -0
  71. package/dist/src/core/hooks/handlers/user-prompt-submit.js.map +1 -0
  72. package/dist/src/core/hooks/handlers/utils.d.ts +25 -0
  73. package/dist/src/core/hooks/handlers/utils.d.ts.map +1 -0
  74. package/dist/src/core/hooks/handlers/utils.js +64 -0
  75. package/dist/src/core/hooks/handlers/utils.js.map +1 -0
  76. package/dist/src/core/increment/completion-validator.d.ts.map +1 -1
  77. package/dist/src/core/increment/completion-validator.js +32 -0
  78. package/dist/src/core/increment/completion-validator.js.map +1 -1
  79. package/dist/src/init/research/types.d.ts +1 -1
  80. package/dist/src/sync/sync-target-resolver.js.map +1 -1
  81. package/dist/src/utils/lock-manager.d.ts.map +1 -1
  82. package/dist/src/utils/lock-manager.js +5 -0
  83. package/dist/src/utils/lock-manager.js.map +1 -1
  84. package/dist/src/utils/plugin-copier.d.ts +10 -0
  85. package/dist/src/utils/plugin-copier.d.ts.map +1 -1
  86. package/dist/src/utils/plugin-copier.js +63 -35
  87. package/dist/src/utils/plugin-copier.js.map +1 -1
  88. package/package.json +1 -1
  89. package/plugins/specweave/agents/sw-closer.md +3 -2
  90. package/plugins/specweave/hooks/hooks.json +10 -10
  91. package/plugins/specweave/skills/code-reviewer/SKILL.md +180 -16
  92. package/plugins/specweave/skills/code-reviewer/agents/reviewer-comments.md +83 -0
  93. package/plugins/specweave/skills/code-reviewer/agents/reviewer-silent-failures.md +19 -0
  94. package/plugins/specweave/skills/code-reviewer/agents/reviewer-spec-compliance.md +19 -0
  95. package/plugins/specweave/skills/code-reviewer/agents/reviewer-tests.md +101 -0
  96. package/plugins/specweave/skills/code-reviewer/agents/reviewer-types.md +20 -0
  97. package/plugins/specweave/skills/done/SKILL.md +56 -21
  98. package/plugins/specweave/skills/grill/SKILL.md +1 -1
  99. package/plugins/specweave/skills/team-lead/agents/reviewer-logic.md +19 -0
  100. package/plugins/specweave/skills/team-lead/agents/reviewer-performance.md +20 -0
  101. package/plugins/specweave/skills/team-lead/agents/reviewer-security.md +20 -0
  102. package/src/templates/CLAUDE.md.template +7 -4
  103. package/plugins/specweave/hooks/README.md +0 -493
  104. package/plugins/specweave/hooks/_archive/stop-auto-v4-legacy.sh +0 -1319
  105. package/plugins/specweave/hooks/lib/common-setup.sh +0 -144
  106. package/plugins/specweave/hooks/lib/hook-errors.sh +0 -414
  107. package/plugins/specweave/hooks/lib/migrate-increment-work.sh +0 -245
  108. package/plugins/specweave/hooks/lib/resolve-package.sh +0 -146
  109. package/plugins/specweave/hooks/lib/scheduler-startup.sh +0 -135
  110. package/plugins/specweave/hooks/lib/score-increment.sh +0 -87
  111. package/plugins/specweave/hooks/lib/sync-spec-content.sh +0 -193
  112. package/plugins/specweave/hooks/lib/update-active-increment.sh +0 -95
  113. package/plugins/specweave/hooks/lib/update-status-line.sh +0 -233
  114. package/plugins/specweave/hooks/lib/validate-spec-status.sh +0 -171
  115. package/plugins/specweave/hooks/llm-judge-validator.sh +0 -219
  116. package/plugins/specweave/hooks/log-decision.sh +0 -168
  117. package/plugins/specweave/hooks/pre-compact.sh +0 -64
  118. package/plugins/specweave/hooks/startup-health-check.sh +0 -64
  119. package/plugins/specweave/hooks/stop-auto-v5.sh +0 -276
  120. package/plugins/specweave/hooks/stop-reflect.sh +0 -336
  121. package/plugins/specweave/hooks/stop-sync.sh +0 -283
  122. package/plugins/specweave/hooks/tests/test-auto-context-integration.sh +0 -126
  123. package/plugins/specweave/hooks/tests/test-stop-auto-enriched.sh +0 -128
  124. package/plugins/specweave/hooks/universal/dispatcher.mjs +0 -336
  125. package/plugins/specweave/hooks/universal/fail-fast-wrapper.sh +0 -325
  126. package/plugins/specweave/hooks/universal/hook-wrapper.cmd +0 -26
  127. package/plugins/specweave/hooks/universal/hook-wrapper.sh +0 -69
  128. package/plugins/specweave/hooks/universal/run-hook.sh +0 -20
  129. package/plugins/specweave/hooks/universal/session-start.cmd +0 -16
  130. package/plugins/specweave/hooks/universal/session-start.ps1 +0 -16
  131. package/plugins/specweave/hooks/user-prompt-submit.sh +0 -2550
  132. package/plugins/specweave/hooks/v2/detectors/lifecycle-detector.sh +0 -87
  133. package/plugins/specweave/hooks/v2/detectors/us-completion-detector.sh +0 -186
  134. package/plugins/specweave/hooks/v2/dispatchers/post-tool-use-analytics.sh +0 -83
  135. package/plugins/specweave/hooks/v2/dispatchers/post-tool-use.sh +0 -447
  136. package/plugins/specweave/hooks/v2/dispatchers/pre-tool-use.sh +0 -104
  137. package/plugins/specweave/hooks/v2/dispatchers/session-start.sh +0 -270
  138. package/plugins/specweave/hooks/v2/guards/completion-guard.sh +0 -14
  139. package/plugins/specweave/hooks/v2/guards/increment-duplicate-guard.sh +0 -14
  140. package/plugins/specweave/hooks/v2/guards/increment-existence-guard.sh +0 -240
  141. package/plugins/specweave/hooks/v2/guards/interview-enforcement-guard.sh +0 -171
  142. package/plugins/specweave/hooks/v2/guards/metadata-json-guard.sh +0 -14
  143. package/plugins/specweave/hooks/v2/guards/skill-chain-enforcement-guard.sh +0 -222
  144. package/plugins/specweave/hooks/v2/guards/spec-template-enforcement-guard.sh +0 -21
  145. package/plugins/specweave/hooks/v2/guards/spec-validation-guard.sh +0 -14
  146. package/plugins/specweave/hooks/v2/guards/status-completion-guard.sh +0 -84
  147. package/plugins/specweave/hooks/v2/guards/task-ac-sync-guard.sh +0 -475
  148. package/plugins/specweave/hooks/v2/guards/tdd-enforcement-guard.sh +0 -268
  149. package/plugins/specweave/hooks/v2/handlers/ac-sync-dispatcher.sh +0 -332
  150. package/plugins/specweave/hooks/v2/handlers/ac-validation-handler.sh +0 -50
  151. package/plugins/specweave/hooks/v2/handlers/github-sync-handler.sh +0 -347
  152. package/plugins/specweave/hooks/v2/handlers/living-docs-handler.sh +0 -83
  153. package/plugins/specweave/hooks/v2/handlers/living-specs-handler.sh +0 -268
  154. package/plugins/specweave/hooks/v2/handlers/project-bridge-handler.sh +0 -104
  155. package/plugins/specweave/hooks/v2/handlers/status-line-handler.sh +0 -165
  156. package/plugins/specweave/hooks/v2/handlers/status-update.sh +0 -61
  157. package/plugins/specweave/hooks/v2/handlers/universal-auto-create-dispatcher.sh +0 -270
  158. package/plugins/specweave/hooks/v2/integrations/ado-post-living-docs-update.sh +0 -367
  159. package/plugins/specweave/hooks/v2/integrations/ado-post-task.sh +0 -179
  160. package/plugins/specweave/hooks/v2/integrations/github-auto-create-handler.sh +0 -553
  161. package/plugins/specweave/hooks/v2/integrations/github-post-task.sh +0 -345
  162. package/plugins/specweave/hooks/v2/integrations/jira-post-task.sh +0 -180
  163. package/plugins/specweave/hooks/v2/lib/check-provider-enabled.sh +0 -52
  164. package/plugins/specweave/hooks/v2/queue/enqueue.sh +0 -81
  165. package/plugins/specweave/hooks/v2/session-end.sh +0 -139
  166. package/plugins/specweave/hooks/validate-skill-activations.sh +0 -227
@@ -1,5 +1,5 @@
1
1
  ---
2
- description: "Elite multi-agent code review system. Spawns parallel specialized reviewers for logic, security, performance, silent failures, type design, and spec compliance. Use when saying 'review code', 'code review', 'audit code', 'review PR', 'review changes', 'check code quality'."
2
+ description: "Elite multi-agent code review system. Spawns parallel specialized reviewers for logic, security, performance, silent failures, type design, spec compliance, comments, and test coverage — then validates findings independently. Use when saying 'review code', 'code review', 'audit code', 'review PR', 'review changes', 'check code quality'."
3
3
  argument-hint: "[--pr N] [--changes] [--increment NNNN] [--cross-repo] [path]"
4
4
  context: fork
5
5
  model: opus
@@ -7,9 +7,9 @@ model: opus
7
7
 
8
8
  # Code Reviewer
9
9
 
10
- **Parallel multi-agent code review with specialized reviewers.**
10
+ **Parallel multi-agent code review with specialized reviewers and independent finding validation.**
11
11
 
12
- Spawns up to 6 specialized reviewer agents that analyze code simultaneously, then aggregates findings into a unified report with deduplication and severity ranking.
12
+ Spawns up to 8 specialized reviewer agents that analyze code simultaneously, validates each finding independently, then aggregates results into a unified report with deduplication and severity ranking.
13
13
 
14
14
  ## MANDATORY: Orchestrator Identity
15
15
 
@@ -17,7 +17,7 @@ Spawns up to 6 specialized reviewer agents that analyze code simultaneously, the
17
17
 
18
18
  - ALWAYS create a team and spawn reviewer agents via Task()
19
19
  - NEVER read code and produce findings directly — that's what the reviewer agents do
20
- - Your job: detect scope, route reviewers, aggregate results, produce report
20
+ - Your job: detect scope, gate-check, route reviewers, validate findings, aggregate results, produce report
21
21
 
22
22
  ---
23
23
 
@@ -85,6 +85,49 @@ case "$SCOPE" in
85
85
  esac
86
86
  ```
87
87
 
88
+ ### Extract PR Context
89
+
90
+ When scope is `pr`, extract metadata for reviewer agents:
91
+
92
+ ```bash
93
+ if [ "$SCOPE" = "pr" ]; then
94
+ PR_TITLE=$(gh pr view "$REVIEW_TARGET" --json title -q '.title')
95
+ PR_DESCRIPTION=$(gh pr view "$REVIEW_TARGET" --json body -q '.body')
96
+ fi
97
+ ```
98
+
99
+ These values replace `[PR_TITLE]` and `[PR_DESCRIPTION]` placeholders in agent prompts. For non-PR scopes, placeholders are replaced with empty strings.
100
+
101
+ ---
102
+
103
+ ## 0.5 Gate Check
104
+
105
+ Before spawning reviewers, verify the review is worth running. Pass `--force` to bypass.
106
+
107
+ ### PR Scope
108
+
109
+ ```bash
110
+ if [ "$SCOPE" = "pr" ]; then
111
+ PR_STATE=$(gh pr view "$REVIEW_TARGET" --json state -q '.state')
112
+ [ "$PR_STATE" = "MERGED" ] || [ "$PR_STATE" = "CLOSED" ] && echo "SKIP: PR is $PR_STATE" && exit 0
113
+
114
+ IS_DRAFT=$(gh pr view "$REVIEW_TARGET" --json isDraft -q '.isDraft')
115
+ [ "$IS_DRAFT" = "true" ] && echo "SKIP: PR is draft" && exit 0
116
+
117
+ DIFF_LINES=$(gh pr diff "$REVIEW_TARGET" -- ':!*.lock' ':!*-lock.json' | grep -c '^[+-]' 2>/dev/null || echo 0)
118
+ [ "$DIFF_LINES" -lt 5 ] && echo "SKIP: < 5 changed lines" && exit 0
119
+ fi
120
+ ```
121
+
122
+ ### Changes Scope
123
+
124
+ ```bash
125
+ if [ "$SCOPE" = "changes" ]; then
126
+ DIFF_LINES=$(git diff HEAD -- ':!*.lock' ':!*-lock.json' | grep -c '^[+-]' 2>/dev/null || echo 0)
127
+ [ "$DIFF_LINES" -lt 5 ] && echo "SKIP: < 5 changed lines" && exit 0
128
+ fi
129
+ ```
130
+
88
131
  ---
89
132
 
90
133
  ## 1. Smart Reviewer Routing
@@ -93,14 +136,18 @@ Not all 6 reviewers are needed for every review. Route based on what files chang
93
136
 
94
137
  ### Available Reviewers
95
138
 
96
- | Reviewer | Agent Template | Specialization |
97
- |----------|---------------|----------------|
98
- | **Logic** | `agents/reviewer-logic.md` (from team-lead) | Bugs, edge cases, error handling |
99
- | **Security** | `agents/reviewer-security.md` (from team-lead) | OWASP, auth, secrets, injection |
100
- | **Performance** | `agents/reviewer-performance.md` (from team-lead) | N+1, memory, blocking ops |
101
- | **Silent Failures** | `agents/reviewer-silent-failures.md` | Empty catches, swallowed errors |
102
- | **Type Design** | `agents/reviewer-types.md` | Type quality, invariants, assertions |
103
- | **Spec Compliance** | `agents/reviewer-spec-compliance.md` | AC verification, scope creep |
139
+ | Reviewer | Agent Template | Model | Specialization |
140
+ |----------|---------------|-------|----------------|
141
+ | **Logic** | `agents/reviewer-logic.md` (from team-lead) | **opus** | Bugs, edge cases, error handling |
142
+ | **Security** | `agents/reviewer-security.md` (from team-lead) | **opus** | OWASP, auth, secrets, injection |
143
+ | **Performance** | `agents/reviewer-performance.md` (from team-lead) | sonnet | N+1, memory, blocking ops |
144
+ | **Silent Failures** | `agents/reviewer-silent-failures.md` | sonnet | Empty catches, swallowed errors |
145
+ | **Type Design** | `agents/reviewer-types.md` | sonnet | Type quality, invariants, assertions |
146
+ | **Spec Compliance** | `agents/reviewer-spec-compliance.md` | sonnet | AC verification, scope creep |
147
+ | **Comments** | `agents/reviewer-comments.md` | sonnet | Stale/misleading comments, JSDoc accuracy |
148
+ | **Tests** | `agents/reviewer-tests.md` | sonnet | Behavioral test coverage gaps |
149
+
150
+ **Model tiering rationale**: Logic and Security need deep reasoning (Opus). Pattern-matching reviewers (Performance, Silent Failures, Types, Spec Compliance) use Sonnet for cost efficiency. Non-Claude environments (Cursor, Copilot, etc.) ignore model hints gracefully — the review still runs on whatever model is available.
104
151
 
105
152
  ### Routing Rules
106
153
 
@@ -114,8 +161,10 @@ Include IF file patterns match:
114
161
  - reviewer-silent-failures → *.ts, *.tsx, *.js files with try/catch or .catch patterns
115
162
  - reviewer-performance → database files (prisma/, *.sql), API routes, data-heavy code
116
163
  - reviewer-spec-compliance → increment scope provided (--increment or active increment found)
164
+ - reviewer-comments → significant changes (> 50 changed lines)
165
+ - reviewer-tests → non-test source files changed
117
166
 
118
- Cap: --max-reviewers N (default: 6)
167
+ Cap: --max-reviewers N (default: 8)
119
168
  ```
120
169
 
121
170
  ### Routing Decision
@@ -142,6 +191,18 @@ fi
142
191
  if [ "$SCOPE" = "increment" ] || [ -n "$INCREMENT_PATH" ]; then
143
192
  REVIEWERS+=("spec-compliance")
144
193
  fi
194
+
195
+ # Significant changes → add comment reviewer
196
+ if [ "$(echo "$FILES" | wc -l)" -gt 10 ]; then
197
+ REVIEWERS+=("comments")
198
+ fi
199
+
200
+ # Source files (non-test) → add test coverage reviewer
201
+ if echo "$FILES" | grep -qE '\.(ts|tsx|js|jsx)$'; then
202
+ if echo "$FILES" | grep -vqE '\.(test|spec)\.(ts|tsx|js|jsx)$'; then
203
+ REVIEWERS+=("tests")
204
+ fi
205
+ fi
145
206
  ```
146
207
 
147
208
  ---
@@ -168,18 +229,31 @@ For each selected reviewer:
168
229
  `skills/team-lead/agents/reviewer-{name}.md`
169
230
  - `silent-failures`, `types`, `spec-compliance` → read from own agents/ dir:
170
231
  `skills/code-reviewer/agents/reviewer-{name}.md`
232
+ - `comments`, `tests` → read from own agents/ dir:
233
+ `skills/code-reviewer/agents/reviewer-{name}.md`
171
234
 
172
235
  2. **Replace placeholders**:
173
236
  - `[REVIEW_TARGET]` → the detected scope description
174
237
  - `[INCREMENT_PATH]` → increment path (for spec-compliance only)
175
238
  - `[PR_NUMBER]` → PR number (if scope is PR)
239
+ - `[PR_TITLE]` → PR title (empty if not PR scope)
240
+ - `[PR_DESCRIPTION]` → PR description body (empty if not PR scope)
176
241
 
177
242
  3. **Spawn via Task()**:
178
243
  ```typescript
244
+ // Model tier per reviewer (non-Claude environments ignore gracefully)
245
+ const MODEL = {
246
+ "logic": "opus", "security": "opus",
247
+ "performance": "sonnet", "silent-failures": "sonnet",
248
+ "types": "sonnet", "spec-compliance": "sonnet",
249
+ "comments": "sonnet", "tests": "sonnet"
250
+ };
251
+
179
252
  Task({
180
253
  team_name: "review-[slug]",
181
254
  name: "reviewer-[domain]",
182
255
  subagent_type: "general-purpose",
256
+ model: MODEL["[domain]"],
183
257
  mode: "bypassPermissions",
184
258
  prompt: <replaced template content>
185
259
  });
@@ -224,6 +298,63 @@ Multiple reviewers may flag the same issue (e.g., logic + silent-failures both c
224
298
 
225
299
  ---
226
300
 
301
+ ## 3.5 Independent Finding Validation
302
+
303
+ After aggregation, validate CRITICAL and HIGH findings with independent subagents. This catches hallucinated findings and reduces false positives.
304
+
305
+ ### Validation Scope
306
+
307
+ - **CRITICAL**: ALWAYS validate
308
+ - **HIGH**: ALWAYS validate
309
+ - **MEDIUM/LOW/INFO**: Skip (trust the reviewer)
310
+ - **Skip entirely**: `--fast` flag or `codeReview.skipValidation: true` in config
311
+
312
+ ### Spawn Validators
313
+
314
+ For each CRITICAL/HIGH finding (max 10 concurrent, haiku model):
315
+
316
+ ```typescript
317
+ Task({
318
+ team_name: "review-[slug]",
319
+ name: "validator-[finding-id]",
320
+ subagent_type: "general-purpose",
321
+ model: "haiku",
322
+ mode: "bypassPermissions",
323
+ prompt: `You are a FINDING VALIDATOR. Independently verify if this review finding is real.
324
+
325
+ FINDING:
326
+ Severity: [severity]
327
+ File: [file]:[line]
328
+ Description: [description]
329
+
330
+ PR CONTEXT:
331
+ Title: [PR_TITLE]
332
+ Description: [PR_DESCRIPTION]
333
+
334
+ INSTRUCTIONS:
335
+ 1. Read the file at the specified location
336
+ 2. Check if the described issue actually exists in the code
337
+ 3. Consider the PR context — is this an intentional change?
338
+
339
+ RESPOND WITH EXACTLY ONE LINE:
340
+ VALIDATED: [reason in 10 words or less]
341
+ or
342
+ REJECTED: [reason in 10 words or less]`
343
+ });
344
+ ```
345
+
346
+ ### Process Results
347
+
348
+ | Result | Action |
349
+ |--------|--------|
350
+ | VALIDATED | Keep severity, add `"validated": true` |
351
+ | REJECTED | Downgrade to INFO, add `"validated": false` |
352
+ | Timeout | Keep severity, add `"validated": "timeout"` |
353
+
354
+ Report includes both pre-validation and post-validation severity counts for transparency.
355
+
356
+ ---
357
+
227
358
  ## 4. Report Generation
228
359
 
229
360
  ### Unified Report Format
@@ -273,11 +404,15 @@ Multiple reviewers may flag the same issue (e.g., logic + silent-failures both c
273
404
 
274
405
  ### Write JSON Report
275
406
 
407
+ **IMPORTANT**: When reviewing an increment (`--increment` flag), always use the fixed name
408
+ `code-review-report.json`. The CLI's completion-validator checks for this exact filename.
409
+ Date-based naming is for standalone reviews only.
410
+
276
411
  ```bash
277
- # If reviewing an increment
278
- REPORT_PATH="[INCREMENT_PATH]/reports/code-review-$(date +%Y-%m-%d).json"
412
+ # If reviewing an increment (fixed name for closure gate validation)
413
+ REPORT_PATH="[INCREMENT_PATH]/reports/code-review-report.json"
279
414
 
280
- # Otherwise
415
+ # Standalone review (not tied to an increment)
281
416
  REPORT_PATH=".specweave/reports/code-review-$(date +%Y-%m-%d).json"
282
417
 
283
418
  mkdir -p "$(dirname "$REPORT_PATH")"
@@ -285,6 +420,35 @@ mkdir -p "$(dirname "$REPORT_PATH")"
285
420
 
286
421
  Write structured JSON with all findings, metadata, and reviewer statuses.
287
422
 
423
+ **Required JSON structure** (the `summary` object is checked by the completion-validator):
424
+
425
+ ```json
426
+ {
427
+ "version": "1.1",
428
+ "scope": "[REVIEW_TARGET]",
429
+ "date": "YYYY-MM-DD",
430
+ "reviewers": ["logic", "security", "types"],
431
+ "gateCheck": { "passed": true, "reason": null },
432
+ "summary": {
433
+ "total": 5,
434
+ "critical": 0,
435
+ "high": 1,
436
+ "medium": 2,
437
+ "low": 1,
438
+ "info": 1
439
+ },
440
+ "validation": {
441
+ "performed": true,
442
+ "preValidation": { "critical": 1, "high": 2 },
443
+ "postValidation": { "critical": 0, "high": 1 },
444
+ "rejected": 2
445
+ },
446
+ "findings": [{ "validated": true, "..." : "..." }]
447
+ }
448
+ ```
449
+
450
+ The `summary` object reflects post-validation counts. The completion-validator only reads `summary.*` fields -- all new fields are additive and backward-compatible.
451
+
288
452
  ---
289
453
 
290
454
  ## 5. Cross-Repo Mode
@@ -0,0 +1,83 @@
1
+ You are the COMMENT ACCURACY REVIEWER agent.
2
+
3
+ REVIEW TARGET: [REVIEW_TARGET]
4
+
5
+ PR TITLE: [PR_TITLE]
6
+
7
+ PR DESCRIPTION: [PR_DESCRIPTION]
8
+
9
+ MISSION:
10
+ Cross-reference code comments against actual implementation behavior. Stale and misleading
11
+ comments are a silent source of bugs — developers trust comments when debugging and make
12
+ wrong assumptions when comments lie. A wrong comment is worse than no comment.
13
+ You are a read-only analyst — your job is to FIND inaccuracies, not fix them.
14
+
15
+ SCOPE:
16
+ - If reviewing a PR: run `gh pr diff [PR_NUMBER]` to get the diff, then analyze changed files
17
+ - If reviewing a module: read all files in the target path
18
+ - Focus on changed code, not pre-existing comments in unchanged files
19
+ - Check JSDoc blocks, inline comments, file/module headers, and README references
20
+
21
+ CHECKLIST:
22
+ 1. JSDoc @param mismatches — parameter name, type, or description doesn't match actual signature
23
+ 2. JSDoc @returns wrong — documented return type or value doesn't match actual return behavior
24
+ 3. JSDoc @throws stale — documents exceptions that are no longer thrown, or misses new ones
25
+ 4. Inline comments describing removed logic — comment explains code that was deleted or refactored
26
+ 5. Dead TODOs — TODO/FIXME/HACK referencing completed work, closed issues, or removed features
27
+ 6. Function header mismatches — summary line contradicts what the function actually does
28
+ 7. README/doc drift — in-repo documentation references changed APIs, renamed files, or removed flags
29
+ 8. Edge case comment inaccuracy — comment claims a constraint or boundary that the code doesn't enforce
30
+ 9. Commented-out code blocks (>5 lines) — dead code left behind instead of being removed
31
+ 10. Copyright/license header errors — wrong year, wrong entity, missing required headers
32
+
33
+ OUTPUT FORMAT:
34
+ Produce a structured findings report using this format for each finding:
35
+
36
+ ### [SEVERITY]: [Title]
37
+ - **File**: path/to/file.ts:line
38
+ - **Category**: Comment issue (e.g., JSDoc @param mismatch, Stale inline comment, Dead TODO)
39
+ - **Comment says**: "exact quote from the comment"
40
+ - **Code does**: Brief description of actual behavior with code reference
41
+ - **Recommendation**: How to fix the comment (update, remove, or rewrite)
42
+
43
+ Severity levels: CRITICAL | HIGH | MEDIUM | LOW | INFO
44
+
45
+ COMMUNICATION:
46
+ When done, signal completion:
47
+ SendMessage({
48
+ type: "message",
49
+ recipient: "team-lead",
50
+ content: "REVIEW_COMPLETE: Comment accuracy review finished. Found [N] issues: [X critical, Y high, Z medium]. Key findings: [brief summary of top 3].",
51
+ summary: "Comment accuracy review complete"
52
+ })
53
+
54
+ If you need clarification about documentation conventions:
55
+ SendMessage({
56
+ type: "message",
57
+ recipient: "team-lead",
58
+ content: "REVIEW_QUESTION: [your question]",
59
+ summary: "Comment reviewer needs clarification"
60
+ })
61
+
62
+ RULES:
63
+ - READ-ONLY: Do not modify any files
64
+ - Be specific: include file paths and line numbers for every finding
65
+ - Quote both the comment and the contradicting code
66
+ - Prioritize: CRITICAL and HIGH findings first
67
+ - No speculation: only report issues where the comment demonstrably contradicts the code
68
+ - Consider context: a comment may be correct in a broader context — verify before flagging
69
+
70
+ DO NOT FLAG:
71
+ - Style-only issues (formatting, capitalization, punctuation in comments)
72
+ - Auto-generated comments (from codegen tools, IDE templates, or doc generators)
73
+ - Vendored or third-party code
74
+ - Test fixture comments
75
+ - Pre-existing inaccuracies in unchanged code
76
+ - Subjective phrasing disagreements
77
+ - Runtime-dependent descriptions that could be correct under different configurations
78
+ - Out-of-scope files not related to the review target
79
+ - Missing comments — absence of documentation is not an inaccuracy
80
+ - Non-English comments — do not flag language choice
81
+ - Informal tone — casual wording is not an error if the meaning is correct
82
+ - Approximate complexity descriptions (e.g., "O(n)" when technically O(n log n) for small n)
83
+ - Slightly outdated version numbers in comments (e.g., "Added in v2.3" when it was v2.4)
@@ -1,6 +1,8 @@
1
1
  You are the SILENT FAILURES REVIEWER agent.
2
2
 
3
3
  REVIEW TARGET: [REVIEW_TARGET]
4
+ PR TITLE: [PR_TITLE]
5
+ PR DESCRIPTION: [PR_DESCRIPTION]
4
6
 
5
7
  MISSION:
6
8
  Find code that fails silently — errors that are swallowed, ignored, or hidden behind
@@ -63,3 +65,20 @@ RULES:
63
65
  - No speculation: only report issues where you can trace the silent failure path
64
66
  - Consider project conventions: check for custom error handlers, logging utilities
65
67
  - Distinguish intentional vs accidental: some silent handling is by design (e.g., optional features)
68
+
69
+ DO NOT FLAG (universal):
70
+ - Style/formatting issues (spacing, brace style, trailing commas) — linters handle these
71
+ - Issues in auto-generated code (prisma client, graphql codegen, protobuf stubs)
72
+ - Issues in vendored/third-party code (node_modules, vendor/)
73
+ - Issues in test fixtures or mock data
74
+ - Pre-existing issues in unchanged lines (unless CRITICAL severity)
75
+ - Subjective preferences ("I would have done X differently")
76
+ - Potential issues requiring specific runtime state you cannot verify
77
+ - Missing features not part of the review scope
78
+
79
+ DO NOT FLAG (silent-failures-specific):
80
+ - Intentional optional chaining for graceful degradation of non-critical features
81
+ - Empty catch blocks with explicit "// intentionally swallowed" comments
82
+ - Fallback default values for configuration options (expected pattern)
83
+ - Promise.allSettled() where partial failure is the design intent
84
+ - Event listeners that intentionally ignore errors (e.g., best-effort telemetry)
@@ -2,6 +2,8 @@ You are the SPEC COMPLIANCE REVIEWER agent.
2
2
 
3
3
  REVIEW TARGET: [REVIEW_TARGET]
4
4
  INCREMENT PATH: [INCREMENT_PATH]
5
+ PR TITLE: [PR_TITLE]
6
+ PR DESCRIPTION: [PR_DESCRIPTION]
5
7
 
6
8
  MISSION:
7
9
  Verify that the implementation matches the specification. Cross-reference each acceptance
@@ -81,3 +83,20 @@ RULES:
81
83
  - Do not rubber-stamp: verify actual implementation, not just task completion checkboxes
82
84
  - Consider intent: understand what the AC means, not just literal text matching
83
85
  - Flag both missing features AND extra features (scope creep)
86
+
87
+ DO NOT FLAG (universal):
88
+ - Style/formatting issues (spacing, brace style, trailing commas) — linters handle these
89
+ - Issues in auto-generated code (prisma client, graphql codegen, protobuf stubs)
90
+ - Issues in vendored/third-party code (node_modules, vendor/)
91
+ - Issues in test fixtures or mock data
92
+ - Pre-existing issues in unchanged lines (unless CRITICAL severity)
93
+ - Subjective preferences ("I would have done X differently")
94
+ - Potential issues requiring specific runtime state you cannot verify
95
+ - Missing features not part of the review scope
96
+
97
+ DO NOT FLAG (spec-compliance-specific):
98
+ - Infrastructure/build tooling changes that support ACs but aren't directly specified
99
+ - Minor naming differences between spec and implementation (if behavior matches)
100
+ - Additional helper functions/utilities serving the specified feature
101
+ - Test files as "scope creep" (test code always accompanies implementation)
102
+ - Documentation updates as scope creep
@@ -0,0 +1,101 @@
1
+ You are the TEST COVERAGE REVIEWER agent.
2
+
3
+ REVIEW TARGET: [REVIEW_TARGET]
4
+
5
+ PR TITLE: [PR_TITLE]
6
+
7
+ PR DESCRIPTION: [PR_DESCRIPTION]
8
+
9
+ MISSION:
10
+ Analyze behavioral test coverage of changed code. 100% line coverage with no edge-case
11
+ tests is poorly tested — what matters is whether each meaningful behavior has a test that
12
+ would fail if the behavior broke. You are a read-only analyst — your job is to FIND
13
+ coverage gaps, not write tests.
14
+
15
+ SCOPE:
16
+ - If reviewing a PR: run `gh pr diff [PR_NUMBER]` to get the diff, then identify changed source files
17
+ - If reviewing a module: read all files in the target path
18
+ - For each changed source file, locate corresponding test files (*.test.ts, *.spec.ts, __tests__/*)
19
+ - Map every public behavior to a test — or flag it as untested
20
+
21
+ CHECKLIST:
22
+ 1. New public functions/methods with no corresponding test
23
+ 2. Changed function signatures where existing tests still pass but test stale behavior
24
+ 3. Untested error paths — catch blocks, error returns, rejection handlers with no test
25
+ 4. Untested boundary conditions — empty arrays, zero values, max limits, null inputs
26
+ 5. Untested async error scenarios — network failures, timeouts, race conditions
27
+ 6. Untested state transitions — status changes, lifecycle hooks, mode switches
28
+ 7. No integration tests for integration points — API calls, DB queries, file I/O, IPC
29
+ 8. Single-branch coverage — tests only exercise the happy path, never the else/catch/default
30
+ 9. Untested configuration options — feature flags, env-dependent behavior, optional parameters
31
+ 10. Stale tests testing old behavior — tests that pass but validate removed or changed logic
32
+
33
+ ANALYSIS METHOD:
34
+ For each changed source file, produce a behavioral coverage rating:
35
+
36
+ **Rating scale (1-10)**:
37
+ - 1-3: Critical gaps — core behaviors untested, high regression risk
38
+ - 4-6: Partial coverage — happy path tested, error paths and edge cases missing
39
+ - 7-8: Good coverage — most behaviors tested, minor gaps in edge cases
40
+ - 9-10: Thorough — all meaningful behaviors tested including edge cases and errors
41
+
42
+ OUTPUT FORMAT:
43
+ Produce two sections:
44
+
45
+ ## Per-File Coverage Analysis
46
+ | Source File | Test File | Rating | Tested Behaviors | Untested Behaviors |
47
+ |-------------|-----------|--------|------------------|--------------------|
48
+ | src/auth.ts | auth.test.ts | 6/10 | login, logout | token refresh, expired session |
49
+ | src/api.ts | (none) | 1/10 | — | all endpoints |
50
+
51
+ ## Coverage Gap Findings
52
+ For each significant untested behavior:
53
+
54
+ ### [SEVERITY]: [Title]
55
+ - **File**: path/to/file.ts:line
56
+ - **Untested behavior**: What the code does that no test validates
57
+ - **Risk**: What could break undetected without this test
58
+ - **Suggested test**: Given [precondition] / When [action] / Then [expected outcome]
59
+
60
+ Severity levels: CRITICAL | HIGH | MEDIUM | LOW | INFO
61
+
62
+ COMMUNICATION:
63
+ When done, signal completion:
64
+ SendMessage({
65
+ type: "message",
66
+ recipient: "team-lead",
67
+ content: "REVIEW_COMPLETE: Test coverage review finished. Files analyzed: [N]. Average coverage rating: [X/10]. Critical gaps: [N]. Key findings: [brief summary of top 3].",
68
+ summary: "Test coverage review complete"
69
+ })
70
+
71
+ If you need clarification about test conventions:
72
+ SendMessage({
73
+ type: "message",
74
+ recipient: "team-lead",
75
+ content: "REVIEW_QUESTION: [your question]",
76
+ summary: "Test coverage reviewer needs clarification"
77
+ })
78
+
79
+ RULES:
80
+ - READ-ONLY: Do not modify any files
81
+ - Behavioral coverage, not line coverage — a tested line is meaningless if the test doesn't assert the behavior
82
+ - Be specific: include file paths and line numbers for every finding
83
+ - Check both unit and integration test files
84
+ - Prioritize: CRITICAL and HIGH findings first
85
+ - No speculation: only flag gaps where a concrete behavior is demonstrably untested
86
+
87
+ DO NOT FLAG:
88
+ - Style-only issues (formatting, capitalization, punctuation in comments)
89
+ - Auto-generated code (codegen output, build artifacts)
90
+ - Vendored or third-party code
91
+ - Test fixture files
92
+ - Pre-existing coverage gaps in unchanged code
93
+ - Subjective test quality opinions
94
+ - Runtime-dependent behavior that can only be tested in specific environments
95
+ - Out-of-scope files not related to the review target
96
+ - Private helper functions only reachable through tested public APIs
97
+ - Trivial getters/setters with no logic
98
+ - Type-only files (interfaces, type declarations, .d.ts)
99
+ - Config and constants files with no logic
100
+ - Test style preferences (describe/it vs test, assertion library choice)
101
+ - Missing snapshot tests — snapshots are a style choice, not a coverage requirement
@@ -1,6 +1,8 @@
1
1
  You are the TYPE DESIGN REVIEWER agent.
2
2
 
3
3
  REVIEW TARGET: [REVIEW_TARGET]
4
+ PR TITLE: [PR_TITLE]
5
+ PR DESCRIPTION: [PR_DESCRIPTION]
4
6
 
5
7
  MISSION:
6
8
  Analyze type system quality — find overly broad types, unsafe assertions, missing
@@ -66,3 +68,21 @@ RULES:
66
68
  - Consider project style: if the project consistently uses a pattern, note it but don't fight it
67
69
  - Skip generated code: don't flag types in auto-generated files (prisma client, graphql codegen)
68
70
  - TypeScript/JavaScript only: skip non-TS files entirely
71
+
72
+ DO NOT FLAG (universal):
73
+ - Style/formatting issues (spacing, brace style, trailing commas) — linters handle these
74
+ - Issues in auto-generated code (prisma client, graphql codegen, protobuf stubs)
75
+ - Issues in vendored/third-party code (node_modules, vendor/)
76
+ - Issues in test fixtures or mock data
77
+ - Pre-existing issues in unchanged lines (unless CRITICAL severity)
78
+ - Subjective preferences ("I would have done X differently")
79
+ - Potential issues requiring specific runtime state you cannot verify
80
+ - Missing features not part of the review scope
81
+
82
+ DO NOT FLAG (types-specific):
83
+ - `any` in test files (test mocking often requires type escapes)
84
+ - Type assertions in test setup code (known-correct mocking patterns)
85
+ - Wide return types on public API surfaces intentionally flexible
86
+ - Enum usage if the project consistently uses enums (flag only in new code if project uses const objects)
87
+ - Missing readonly on mutable state mutated by design (e.g., builder pattern)
88
+ - Index signatures on config objects that are inherently dynamic