/dev-review                      # Review uncommitted changes
/dev-review --staged             # Review staged changes only
/dev-review src/auth/            # Review specific directory
/dev-review UC-AUTH-001          # Review changes for specific UC

undefined

undefined

1. Get changes to review
   → git diff (uncommitted)
   → git diff --staged (staged only)
   → Read specific files

2. Read project conventions
   → plans/scout/README.md (Conventions section)
   → CLAUDE.md
   → .eslintrc, tsconfig.json

3. Read related spec (if UC provided)
   → plans/features/{feature}/specs/{UC}/README.md

1. Understand the change
   - What was added/modified/removed?
   - What is the intent?

2. Check against spec (if available)
   - Does implementation match spec?
   - Any missing requirements?

3. Run through checklists
   - Security
   - Performance
   - Error handling
   - Style/conventions
   - Testing

undefined

**Common Security Issues:**

```typescript
// BAD: SQL injection
const query = `SELECT * FROM users WHERE id = ${userId}`;

// GOOD: Parameterized
const query = `SELECT * FROM users WHERE id = $1`;
await db.query(query, [userId]);

// BAD: XSS vulnerable
element.innerHTML = userInput;

// GOOD: Escaped
element.textContent = userInput;

// BAD: Hardcoded secret
const apiKey = "sk-1234567890";

// GOOD: Environment variable
const apiKey = process.env.API_KEY;

undefined

**Common Quality Issues:**

```typescript
// BAD: N+1 query
const posts = await getPosts();
for (const post of posts) {
  post.author = await getUser(post.authorId); // Query per post!
}

// GOOD: Batch query
const posts = await getPosts({ include: { author: true } });

// BAD: Swallowed error
try {
  await doSomething();
} catch (e) {
  // Nothing - error disappears!
}

// GOOD: Handle or rethrow
try {
  await doSomething();
} catch (e) {
  logger.error('Failed to do something', e);
  throw new AppError('Operation failed', e);
}

// BAD: Magic number
if (retries > 3) { ... }

// GOOD: Named constant
const MAX_RETRIES = 3;
if (retries > MAX_RETRIES) { ... }

undefined

undefined

undefined

undefined

// BAD
"This code is bad"

// GOOD
"This could cause a SQL injection. Consider using parameterized queries:
```sql
SELECT * FROM users WHERE id = $1
```"

// BAD
"Don't use var"

// GOOD
"Use const/let instead of var - var has function scope which can lead to
unexpected behavior. const also signals intent that the value won't change."

// Issue + Solution
"The N+1 query here will cause performance issues with many posts.

Consider using an include/join:
```typescript
const posts = await db.posts.findMany({
  include: { author: true }
});
```"

undefined

undefined

User: /dev-review UC-AUTH-001

Phase 1: Gather
- Get git diff for UC-AUTH-001 files
- Read scout conventions
- Read UC-AUTH-001 spec

Phase 2-6: Analyze
- src/api/auth/login.ts: Clean ✓
- src/components/LoginForm.tsx: 1 issue
- src/lib/api.ts: 1 suggestion

Phase 7: Output

undefined