In-Session Code Review & Security Review

Review your uncommitted diff for bugs or security issues without leaving the REPL

Review your uncommitted changes for bugs or security issues from inside praisonai code — no separate PR, no writes to your files.

Two slash commands run inside the praisonai code interactive session:

• /code-review [file] [--staged] — reviews the working-tree diff for bugs, logic errors, and edge cases.
• /security-review [file] [--staged] — same pipeline with a security rubric: injection, authz, secrets, deserialization, path traversal, SSRF, and crypto.

The review runs on the shipped read-only review agent preset. Its tool set excludes write and command-execution tools, so the command cannot touch your files even if the model tries.

Quick Start

1. Launch a session

   Start praisonai code in a git repository with uncommitted changes:

   praisonai code

2. Review the working-tree diff

   Type /code-review — the agent reads your uncommitted diff and reports findings:

   ❯ /code-review
   ❯ /code-review --staged
   ❯ /code-review src/auth/login.py

3. Audit for security issues

   Swap in the security rubric with /security-review:

   ❯ /security-review
   ❯ /security-review --staged src/auth/login.py

The review agent is a plain composition of existing parts. The equivalent programmatic form uses a standard Agent with read-only instructions:

from praisonaiagents import Agent

# The /code-review and /security-review commands run a preset built like this:
# a read-only reviewer that inspects a diff and never writes files.
reviewer = Agent(
    name="Reviewer",
    instructions=(
        "You are a code reviewer. Review ONLY the diff you are given for "
        "bugs, logic errors, edge cases, and error-handling gaps. "
        "Do NOT modify any files."
    ),
)

diff = """diff --git a/app.py b/app.py
+def login(user, pw):
+    query = f"SELECT * FROM users WHERE name = '{user}'"
+    return db.execute(query)
"""

reviewer.start(f"Review this diff:\n\n```diff\n{diff}\n```")

How It Works

/code-review collects the diff, wraps it in a review rubric, and runs it against the read-only agent — findings come straight back to the REPL.

| Run review | The prompt routes through the same `_queue_or_execute` path as `/plan`, so session/queue rules apply. |
| Report | Each finding lists severity (high/medium/low), the `file:line`, and a short rationale. |

Common Patterns

Review before you stage. Run /code-review on the working tree, apply fixes, then re-check:

❯ /code-review

Review only what you’re about to commit. Use --staged to scope the review to staged changes:

❯ /code-review --staged

Focus on one file. Pass a path to review a single file’s changes:

❯ /security-review src/auth/login.py

Quoted paths survive — args are parsed with shlex, so /code-review "src/my dir/app.py" works. Multiple positional paths are rejected with a usage message.

User Interaction Flow

A typical loop: finish an edit, review, fix, then security-check before staging.

1. Finish an edit

   Make your changes in the session as usual.

2. Review for bugs

   Type /code-review — the agent reports logic errors and edge cases with file:line locations.

3. Apply fixes

   Address the findings, then re-run /code-review to confirm they’re gone.

4. Security-check before staging

   Type /security-review — the agent audits the same diff against the security rubric before you commit.

Use the decision guide to pick the right tool:

Best Practices

Related