rune-review

Trigger the review after committing changes; it runs git diff against main to scope the changed files, then checks logic, patterns, security, and test coverage. The output is a severity-ranked report citing file and line for every finding.

It flags useEffect missing dependencies, index-as-key on reorderable lists, prop drilling, any-type usage, mutations instead of immutable updates, and UI anti-patterns like missing loading states or inaccessible icon buttons.

Yes. Any change touching auth, crypto, input handling, or payment code triggers mandatory escalation to a dedicated security scan skill. Hardcoded secrets and unvalidated input are flagged as CRITICAL or HIGH findings.

It maps each changed function to test assertions by searching test files for the function name. Business logic with zero tests blocks approval, while functions with only a happy-path test get a warning.

Blast radius counts how many files import or call each modified symbol. Symbols with 50+ callers combined with high-severity changes require adversarial analysis instead of a quick review.

The review is limited to the git diff scope and reports only findings above 80% confidence. It does not execute the code, so runtime behavior, infrastructure issues, and environment-specific failures still need manual verification.