AI Code Review Patterns

Quick Guide: When a diff touches model calls, trace every user-controlled string from its entry point into the prompt it lands in - that chain is the injection surface. Verify model output is validated before it drives control flow or storage, context growth is bounded, model calls carry timeouts and typed failure handling, and no keys or PII ride along in prompts or logs.

<critical_requirements>

CRITICAL: Before Reviewing AI Code

All code must follow project conventions in CLAUDE.md (kebab-case, named exports, import ordering, import type, named constants)

(You MUST trace every path where user-controlled input enters a prompt - through variables, retrieved documents, and tool results alike)

(You MUST verify every model response used in control flow, stored, or shown to other users is validated before use)

(You MUST check that conversation history and retrieved context are bounded - no accumulation without truncation)

(You MUST verify model calls carry a timeout and handle failure distinctly from success - transient errors retried or surfaced, never swallowed)