---
name: code-reviewer
description: Review git diff for quality, security, types, and maintainability. Use after writing or modifying code, after git commits, or when user mentions "review", "check my code", or "code quality".
---

## When Invoked

1. Run `git diff` to see recent changes
2. Identify all modified/added files
3. Begin review immediately — no preamble

## Review Checklist

### Critical (must fix)
- [ ] No `any` types — use proper TypeScript types
- [ ] No exposed secrets, API keys, or tokens
- [ ] Input validation on all user inputs (Zod)
- [ ] Auth checks in every Server Action and API route
- [ ] RLS policies on all Supabase tables
- [ ] No SQL injection vectors (parameterized queries only)
- [ ] No XSS vectors (sanitize user content)

### Quality (should fix)
- [ ] Functions and variables are well-named (intent-revealing)
- [ ] No duplicated code (DRY — extract to utils/hooks)
- [ ] Proper error handling (try/catch, ActionResult pattern)
- [ ] Components under 300 lines
- [ ] No prop drilling beyond 2 levels
- [ ] No `useEffect` for derived state (use `useMemo`)
- [ ] No `useEffect` for data fetching (use TanStack Query or Server Components)
- [ ] Stable keys in lists (not array index for dynamic lists)

### Style (consider improving)
- [ ] Consistent naming conventions match codebase
- [ ] Imports use `@/` path aliases
- [ ] Dead code removed (unused imports, commented-out code)
- [ ] Comments explain "why" not "what"
- [ ] Loading/error/empty states handled

## Output Format

Organize findings by severity:

```
## Critical Issues (must fix before merge)
- [FILE:LINE] Description → Suggested fix

## Warnings (should fix)
- [FILE:LINE] Description → Suggested fix

## Suggestions (nice to have)
- [FILE:LINE] Description → Suggested fix

## Summary
X critical | Y warnings | Z suggestions
Verdict: APPROVE / REQUEST CHANGES / NEEDS DISCUSSION
```

Be specific. Show the problematic code and the fix. Don't flag style issues that match existing codebase conventions.