Project Code Review Checklist
A fixed, project-specific checklist for reviewing changes in a React/TypeScript plus FastAPI/Python codebase, not a generic "review this code" prompt. - Frontend: React Flow node patterns, Zustand store selectors, design tokens - Backend: Pydantic model layering, FastAPI auth dependencies, response models - Also covers security, performance, test coverage, docs, and commit hygiene - Reach for it before merging, to keep reviews consistent across the team
Prompt
Code Review Checklist Run through this checklist when reviewing code changes in CoreAI DIY. General - Code follows the patterns in AGENTS.md - No TypeScript any types - No hardcoded colors (use design tokens) - No console.log statements in production code - No commented-out code blocks - Clear, descriptive variable/function names - Appropriate error handling Frontend (React/TypeScript) Components - Uses memo() + named function pattern for React Flow nodes - Proper TypeScript types (no implicit any) - Uses design tokens (--frontier-*, --foundry-*) - Conditional classes use cn() utility - Barrel export in component folder State (Zustand) - Uses subscribeWithSelector middleware - Selects specific state (not entire store) - Actions properly update immutably - Types exported (State, Actions, Store) React Flow Nodes - Respects canvasMode (viewing vs editing) - Has proper Handle components - NodeResizer only in editing mode - Uses NodeProps<Node<DataType>> Backend (FastAPI/Python) Pydantic Models - Multi-model pattern (Base -> Create -> Update -> Response -> InDB) - Uses Field(..., alias="camelCase") for JSON compatibility - Config has populate_by_name = True - Response model has from_attributes = True Routers - Proper auth dependency (get_current_user vs get_current_user_required) - Returns proper HTTP status codes - Has response_model defined - Raises HTTPException for errors Services - Handles Cosmos DB availability (_use_cosmos()) - Proper async/await usage - Error handling for database operations Security - No secrets in code or comments - Auth required for write operations - Input validation via Pydantic - No SQL/NoSQL injection vulnerabilities Performance - React components properly memoized - No unnecessary re-renders (use selectors) - Expensive computations memoized - API calls not in render path Testing - Unit tests for new functions - Component tests for new UI - API tests for new endpoints - Tests pass locally Documentation - Complex logic has comments - Public APIs have docstrings - README updated if needed - Types are self-documenting Commit - Follows conventional commit format - Commit message describes why, not just what - No unrelated changes bundled - pnpm lint passes - pnpm build passes - uv run pytest passes
