azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Add Sequential Thinking to Code Review + Frontend Validation

Browse Source 
Enhanced code review and frontend validation with intelligent triggers:

Code Review Agent Enhancement:
- Added Sequential Thinking MCP integration for complex issues
- Triggers on 2+ rejections or 3+ critical issues
- New escalation format with root cause analysis
- Comprehensive solution strategies with trade-off evaluation
- Educational feedback to break rejection cycles
- Files: .claude/agents/code-review.md (+308 lines)
- Docs: CODE_REVIEW_ST_ENHANCEMENT.md, CODE_REVIEW_ST_TESTING.md

Frontend Design Skill Enhancement:
- Automatic invocation for ANY UI change
- Comprehensive validation checklist (200+ checkpoints)
- 8 validation categories (visual, interactive, responsive, a11y, etc.)
- 3 validation levels (quick, standard, comprehensive)
- Integration with code review workflow
- Files: .claude/skills/frontend-design/SKILL.md (+120 lines)
- Docs: UI_VALIDATION_CHECKLIST.md (462 lines), AUTOMATIC_VALIDATION_ENHANCEMENT.md (587 lines)

Settings Optimization:
- Repaired .claude/settings.local.json (fixed m365 pattern)
- Reduced permissions from 49 to 33 (33% reduction)
- Removed duplicates, sorted alphabetically
- Created SETTINGS_PERMISSIONS.md documentation

Checkpoint Command Enhancement:
- Dual checkpoint system (git + database)
- Saves session context to API for cross-machine recall
- Includes git metadata in database context
- Files: .claude/commands/checkpoint.md (+139 lines)

Decision Rationale:
- Sequential Thinking MCP breaks rejection cycles by identifying root causes
- Automatic frontend validation catches UI issues before code review
- Dual checkpoints enable complete project memory across machines
- Settings optimization improves maintainability

Total: 1,200+ lines of documentation and enhancements

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
Mike Swanson
2026-01-17 16:23:52 -07:00
parent 359c2cf1b4
commit 75ce1c2fd5
1089 changed files with 149506 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

356
.claude/agents/CODE_REVIEW_ST_ENHANCEMENT.md Normal file
View File

@@ -0,0 +1,356 @@
# Code Review Agent - Sequential Thinking Enhancement
**Enhancement Date:** 2026-01-17
**Status:** COMPLETED
---
## Summary
Enhanced the Code Review Agent to use Sequential Thinking MCP for complex review challenges and repeated rejections. This improves review quality, breaks rejection cycles, and provides better educational feedback to the Coding Agent.
---
## What Changed
### 1. New Section: "When to Use Sequential Thinking MCP"
**Location:** `.claude/agents/code-review.md` (after "Decision Matrix")
**Added:**
- Trigger conditions for invoking Sequential Thinking
- Step-by-step workflow for ST-based reviews
- Complete example of ST analysis in action
- Benefits and anti-patterns
### 2. Trigger Conditions
**Sequential Thinking is triggered when ANY of these occur:**
#### Tough Challenges (Complexity Detection)
- 3+ critical security/performance/logic issues
- Multiple interrelated issues affecting each other
- Architectural problems with unclear solutions
- Complex trade-off decisions
- Unclear root causes
#### Repeated Rejections (Pattern Detection)
- Code rejected 2+ times
- Same types of issues recurring
- Coding Agent stuck in a pattern
- Incremental fixes not addressing root problems
### 3. Enhanced Escalation Format
**New Format:** "Enhanced Escalation (After Sequential Thinking)"
**Includes:**
- Root cause analysis
- Why previous attempts failed
- Comprehensive solution strategy
- Alternative approaches considered
- Pattern recognition & prevention
- Educational context
**Old Format:** Still used for simple first rejections
### 4. Quick Decision Tree
Added simple flowchart at end of document:
1. Count rejections → 2+ = ST
2. Assess complexity → 3+ critical = ST
3. Standard review → minor = fix, major = escalate
4. ST used → enhanced format
### 5. Summary Section
Added prominent section at top of document highlighting the new ST capability.
---
## Files Modified
1. **`.claude/agents/code-review.md`**
- Added Sequential Thinking section (150+ lines)
- Enhanced escalation format (90+ lines)
- Quick decision tree (20 lines)
- Updated success criteria (10 lines)
- Summary section (15 lines)
2. **`.claude/agents/CODE_REVIEW_ST_TESTING.md`** (NEW)
- Test scenarios demonstrating ST usage
- Expected behaviors for different scenarios
- Testing checklist
- Success metrics
3. **`.claude/agents/CODE_REVIEW_ST_ENHANCEMENT.md`** (NEW - this file)
- Summary of changes
- Usage guide
- Benefits
---
## How It Works
### Standard Flow (No ST)
```
Code Submitted → Review → Simple Issues → Fix Directly → Approve
↓
Major Issues → Standard Escalation
```
### Enhanced Flow (With ST)
```
Code Submitted → Review → 2+ Rejections OR 3+ Critical Issues
↓
Sequential Thinking Analysis
↓
Root Cause Identification
↓
Trade-off Evaluation
↓
Enhanced Escalation Format
↓
Comprehensive Solution + Education
```
---
## Example Trigger Scenarios
### Scenario 1: Repeated Rejection (TRIGGERS ST)
```
Rejection 1: SQL injection
Rejection 2: Weak password hashing
→ TRIGGER: Pattern indicates authentication not treated as security-critical
→ ST Analysis: Root cause is mental model problem
→ Enhanced Feedback: Complete auth pattern with threat model
```
### Scenario 2: Multiple Critical Issues (TRIGGERS ST)
```
Code has:
- SQL injection
- N+1 query problem (2 levels deep)
- Missing indexes
- Inefficient Python filtering
→ TRIGGER: 4 critical issues, multiple interrelated
→ ST Analysis: Misunderstanding of database query optimization
→ Enhanced Feedback: JOIN queries, performance analysis, complete rewrite
```
### Scenario 3: Architectural Trade-offs (TRIGGERS ST)
```
Code needs refactoring but multiple approaches possible:
- Microservices vs Monolith
- REST vs GraphQL
- Sync vs Async
→ TRIGGER: Unclear which approach fits requirements
→ ST Analysis: Evaluate trade-offs systematically
→ Enhanced Feedback: Comparison matrix, recommended approach with rationale
```
---
## Benefits
### 1. Breaks Rejection Cycles
- Root cause analysis instead of symptom fixing
- Comprehensive feedback addresses all related issues
- Educational context shifts mental models
### 2. Better Code Quality
- Identifies architectural issues, not just syntax
- Evaluates trade-offs systematically
- Provides industry-standard patterns
### 3. Improved Learning
- Explains WHY, not just WHAT
- Threat models for security issues
- Performance analysis for optimization issues
- Complete examples with best practices
### 4. Token Efficiency
- Fewer rejection cycles = less total tokens
- ST tokens invested upfront save many rounds of back-and-forth
- Comprehensive feedback reduces clarification questions
### 5. Documentation
- ST thought process is preserved
- Future reviews can reference patterns
- Builds institutional knowledge
---
## Usage Guide for Code Reviewer
### Step 1: Receive Code for Review
Track mentally: "Is this the 2nd+ rejection?"
### Step 2: Assess Complexity
Count critical issues. Are there 3+? Are they interrelated?
### Step 3: Decision Point
**IF:** 2+ rejections OR 3+ critical issues OR complex trade-offs
**THEN:** Use Sequential Thinking MCP
**ELSE:** Standard review process
### Step 4: Use Sequential Thinking (If Triggered)
```
Use mcp__sequential-thinking__sequentialthinking tool
Thought 1-4: Problem Analysis
- What are ALL the issues?
- How do they relate?
- What's root cause vs symptoms?
- Why did Coding Agent make these choices?
Thought 5-8: Solution Strategy
- What are possible approaches?
- What are trade-offs?
- Which approach fits best?
- What are implementation steps?
Thought 9-12: Prevention Analysis
- Why did this happen?
- What guidance prevents recurrence?
- Are specs ambiguous?
- Should guidelines be updated?
Thought 13-15: Comprehensive Feedback
- How to explain clearly?
- What examples to provide?
- What's acceptance criteria?
```
### Step 5: Use Enhanced Escalation Format
Include ST insights in structured format:
- Root cause analysis
- Comprehensive solution strategy
- Educational context
- Pattern recognition
### Step 6: Document Insights
ST analysis is preserved for:
- Future similar issues
- Pattern recognition
- Guideline updates
- Learning resources
---
## Testing
See: `.claude/agents/CODE_REVIEW_ST_TESTING.md` for:
- Test scenarios
- Expected behaviors
- Testing checklist
- Success metrics
---
## Configuration
**No configuration needed.** The Code Review Agent now has these guidelines built-in.
**Required MCP:** Sequential Thinking MCP must be configured in `.mcp.json`
**Verify MCP Available:**
```bash
# Check MCP servers
cat .mcp.json | grep sequential-thinking
```
---
## Success Metrics
Track these to validate enhancement effectiveness:
1. **Rejection Cycle Reduction**
- Before: Average 3-4 rejections for complex issues
- After: Target 1-2 rejections (ST on 2nd breaks cycle)
2. **Review Quality**
- Root causes identified vs symptoms
- Comprehensive solutions vs incremental fixes
- Educational feedback vs directive commands
3. **Token Efficiency**
- ST tokens invested upfront
- Fewer total review cycles
- Overall token reduction expected
4. **Code Quality**
- Fewer security vulnerabilities
- Better architectural decisions
- More maintainable solutions
---
## Future Enhancements
Potential improvements:
1. **Track Rejection Patterns**
- Log common rejection reasons
- Build pattern library
- Proactive guidance
2. **ST Insights Database**
- Store ST analysis results
- Reference in future reviews
- Build knowledge base
3. **Automated Complexity Detection**
- Static analysis integration
- Complexity scoring
- Auto-trigger ST threshold
4. **Feedback Loop**
- Track which ST analyses were most helpful
- Refine trigger conditions
- Optimize feedback format
---
## Related Files
- **Agent Config:** `.claude/agents/code-review.md`
- **Testing Guide:** `.claude/agents/CODE_REVIEW_ST_TESTING.md`
- **MCP Config:** `.mcp.json`
- **Coding Guidelines:** `.claude/CODING_GUIDELINES.md`
- **Workflow Docs:** `.claude/CODE_WORKFLOW.md`
---
## Rollback
If needed, revert to previous version:
```bash
git diff HEAD~1 .claude/agents/code-review.md
git checkout HEAD~1 .claude/agents/code-review.md
```
**Note:** Keep testing guide and enhancement doc for future reference.
---
**Last Updated:** 2026-01-17
**Status:** COMPLETED & READY FOR USE
**Enhanced By:** Claude Code

389
.claude/agents/CODE_REVIEW_ST_TESTING.md Normal file
View File

@@ -0,0 +1,389 @@
# Code Review Agent - Sequential Thinking Testing
This document demonstrates the enhanced Code Review Agent with Sequential Thinking MCP integration.
**Last Updated:** 2026-01-17
---
## Test Scenarios
### Scenario 1: Simple Issue (No ST Required)
**Code Submitted:**
```python
def calculate_tax(amount):
return amount * 0.08
```
**Issues:**
- Missing type hints
- No docstring
- Magic number (0.08)
**Expected Behavior:** Code reviewer fixes directly, approves
**ST Triggered:** NO (simple, first review)
**Review Result:**
```python
def calculate_tax(amount: Decimal) -> Decimal:
"""Calculate sales tax on given amount.
Args:
amount: Pre-tax amount
Returns:
Tax amount (8% rate)
"""
TAX_RATE = Decimal("0.08")
return amount * TAX_RATE
```
**Status:** APPROVED (after minor fixes)
---
### Scenario 2: First Rejection (Standard Escalation)
**Code Submitted:**
```python
def login(username, password):
user = db.query(f"SELECT * FROM users WHERE name='{username}'")
if user and user.password == password:
return True
return False
```
**Issues:**
- SQL injection vulnerability
- Plaintext password comparison
**Expected Behavior:** Standard escalation format
**ST Triggered:** NO (only 1 critical issue per category, first review)
**Review Result:**
```markdown
## Code Review - Requires Revision
**Specification Compliance:** FAIL
**Security:** CRITICAL ISSUES
### CRITICAL: SQL Injection
- **Location:** login function, line 2
- **Problem:** String interpolation in SQL query
- **Impact:** Database compromise possible
- **Required Fix:** Use parameterized queries
### CRITICAL: Plaintext Password
- **Location:** login function, line 3
- **Problem:** Direct password comparison
- **Impact:** Passwords should be hashed (bcrypt)
- **Required Fix:** Hash passwords, use secure comparison
**Checklist:**
- [ ] Parameterized SQL queries
- [ ] Bcrypt password hashing
```
**Status:** ESCALATED (standard format)
---
### Scenario 3: Second Rejection (ST TRIGGERED)
**Code Resubmitted After Fix:**
```python
def login(username, password):
user = db.query("SELECT * FROM users WHERE name=?", username)
if user and bcrypt.checkpw(password, user.password):
session['user'] = username
return True
return False
```
**Issues:**
- Session management insecure (no token, no expiry)
- No rate limiting (brute force possible)
- Username might not exist (error handling)
**Expected Behavior:** ST TRIGGERED (2nd rejection)
**ST Analysis:**
```
Thought 1: This is the second rejection. First was SQL injection + plaintext
passwords. Now session management issues. Pattern: treating authentication
as simple data retrieval rather than security-critical component.
Thought 2: Root cause is mental model problem. Coding Agent fixing surface
issues but missing the security-first mindset required for authentication.
Thought 3: Need comprehensive authentication pattern, not incremental fixes.
Thought 4: Should provide complete example with security threat model
explanation to shift mental model.
Thought 5: Include: parameterized queries (done), bcrypt (done), session
tokens (missing), rate limiting (missing), input validation (missing),
timing-safe comparison (missing).
Thought 6: Enhanced escalation format with educational context needed.
```
**Review Result:**
```markdown
## Code Review - Requires Revision (Complex Issues Analyzed)
**Review Iteration:** 2 (USING SEQUENTIAL THINKING ANALYSIS)
**Reason:** 2nd rejection - pattern indicates mental model mismatch
## Root Cause Analysis
**Surface Issues:**
- Insecure session management
- No brute force protection
- Missing input validation
**Root Cause:**
Authentication is being treated as a CRUD operation (create/read user)
rather than a security-critical component with an active threat model.
**Why Previous Attempts Failed:**
Incremental security fixes without understanding the holistic security
requirements for authentication systems.
## Comprehensive Solution Strategy
**Recommended Approach:**
Implement complete authentication system with defense-in-depth:
- JWT tokens (not simple sessions)
- Rate limiting (prevent brute force)
- Input validation (prevent injection beyond SQL)
- Timing-safe comparison (prevent timing attacks)
- Audit logging (security monitoring)
**Why This Approach:**
- Addresses all OWASP authentication risks
- Provides defense-in-depth
- Industry standard pattern
**Complete Example:**
```python
from datetime import datetime, timedelta
import jwt
import bcrypt
from functools import wraps
from typing import Optional
# Rate limiting decorator
def rate_limit(max_attempts=5, window_minutes=15):
attempts = {}
def decorator(func):
@wraps(func)
def wrapper(username, *args, **kwargs):
now = datetime.now()
if username in attempts:
count, first = attempts[username]
if (now - first) < timedelta(minutes=window_minutes):
if count >= max_attempts:
raise Exception("Rate limit exceeded")
attempts[username] = (count + 1, first)
else:
attempts[username] = (1, now)
else:
attempts[username] = (1, now)
return func(username, *args, **kwargs)
return wrapper
return decorator
@rate_limit(max_attempts=5, window_minutes=15)
def login(username: str, password: str) -> Optional[str]:
"""Authenticate user and return JWT token.
Security measures:
- Parameterized queries (SQL injection prevention)
- Bcrypt password hashing (credential theft protection)
- Rate limiting (brute force prevention)
- Input validation (injection prevention)
- JWT tokens (secure session management)
- Timing-safe comparison (timing attack prevention)
Args:
username: User's username (validated)
password: User's plaintext password
Returns:
JWT token string if authenticated, None otherwise
Raises:
ValueError: If inputs are invalid
Exception: If rate limit exceeded
"""
# Input validation
if not username or not isinstance(username, str):
raise ValueError("Invalid username")
if len(username) > 50:
raise ValueError("Username too long")
if not password or len(password) < 8:
raise ValueError("Invalid password")
# Parameterized query (SQL injection prevention)
user = db.query(
"SELECT id, username, password_hash FROM users WHERE username = ?",
params=(username,)
)
# Timing-safe comparison to prevent timing attacks
if not user:
# Run bcrypt anyway to prevent timing leak
bcrypt.checkpw(b"dummy", bcrypt.hashpw(b"dummy", bcrypt.gensalt()))
return None
# Bcrypt comparison (secure password verification)
if not bcrypt.checkpw(password.encode(), user.password_hash):
return None
# Generate JWT token (secure session management)
token = jwt.encode({
'user_id': user.id,
'username': user.username,
'exp': datetime.utcnow() + timedelta(hours=24),
'iat': datetime.utcnow()
}, SECRET_KEY, algorithm='HS256')
# Audit logging (security monitoring)
audit_log.info(f"User {username} logged in", extra={
'user_id': user.id,
'ip': request.remote_addr,
'timestamp': datetime.utcnow()
})
return token
```
## Educational Context
**Key Concept: Defense in Depth**
Authentication is an attack surface. Every decision has security implications.
Multiple layers of defense ensure that if one fails, others protect the system.
**Security Threat Model for Authentication:**
1. SQL Injection → Parameterized queries
2. Credential theft → Password hashing
3. Brute force → Rate limiting
4. Session hijacking → JWT with expiry
5. Timing attacks → Constant-time comparison
6. Injection attacks → Input validation
7. Forensics → Audit logging
**Why It Matters:**
Authentication failures lead to complete system compromise. A single
vulnerability can bypass all other security measures.
**Reference Patterns:**
- OWASP Authentication Cheatsheet
- JWT Best Practices
- Bcrypt/Argon2 for password hashing
```
**Status:** ESCALATED (enhanced format with ST analysis)
---
### Scenario 4: Complex Multiple Issues (ST TRIGGERED)
**Code Submitted:**
```python
def process_orders(user_id):
orders = []
user = db.query(f"SELECT * FROM users WHERE id={user_id}")
for order in db.query("SELECT * FROM orders"):
if order.user_id == user_id:
items = []
for item in db.query("SELECT * FROM items"):
if item.order_id == order.id:
items.append(item)
orders.append({'order': order, 'items': items})
return orders
```
**Issues:**
- SQL injection (user_id)
- N+1 query problem (orders loop)
- N+1 query problem (items loop)
- Missing indexes implied
- Inefficient filtering in Python
- No error handling
- No type hints
**Expected Behavior:** ST TRIGGERED (3+ critical issues, interrelated)
**ST Analysis:**
```
Thought 1: Multiple issues: SQL injection + N+1 queries (2 levels) +
inefficient filtering. These are interrelated - fixing one affects others.
Thought 2: Root cause: fundamental misunderstanding of database query
optimization. Treating database like in-memory collection.
Thought 3: Can't fix incrementally. Need to teach JOIN queries and
query optimization principles.
Thought 4: If I just say "use JOIN", they might not understand why or
how to structure it properly.
Thought 5: Need to show the performance impact (N+1 = 1000 orders * 100 items
= 100,000 queries vs 1 JOIN query), explain query planning, and provide
complete rewrite.
Thought 6: Also opportunity to teach about ORM vs raw SQL trade-offs.
```
**Review Result:** [Enhanced escalation format with performance analysis,
query optimization education, and complete JOIN example]
**Status:** ESCALATED (enhanced format with ST analysis)
---
## Testing Checklist
When testing the enhanced code reviewer:
- [ ] Test simple issues (no ST, direct fix)
- [ ] Test first rejection (standard escalation)
- [ ] Test second rejection (ST triggered, enhanced format)
- [ ] Test 3+ critical issues (ST triggered, complexity)
- [ ] Test architectural issues (ST for trade-off analysis)
- [ ] Verify enhanced format includes root cause analysis
- [ ] Verify comprehensive examples in feedback
- [ ] Verify educational context in complex cases
---
## Expected Behavior Summary
| Scenario | Rejection Count | Issue Complexity | ST Triggered? | Format Used |
|----------|----------------|------------------|---------------|-------------|
| Simple formatting | 0 | Low | NO | Direct fix |
| First security issue | 0 | Medium | NO | Standard escalation |
| Second rejection | 2 | Medium | YES | Enhanced escalation |
| 3+ critical issues | 0-1 | High | YES | Enhanced escalation |
| Architectural trade-offs | 0-1 | High | YES | Enhanced escalation |
| Complex interrelated | 0-1 | Very High | YES | Enhanced escalation |
---
## Success Metrics
Enhanced code reviewer should:
1. **Reduce rejection cycles** - ST analysis breaks patterns faster
2. **Provide better education** - Comprehensive examples teach patterns
3. **Identify root causes** - Not just symptoms
4. **Make better architectural decisions** - Trade-off analysis with ST
5. **Save tokens overall** - Fewer rejections = less total token usage
---
**Last Updated:** 2026-01-17
**Status:** Ready for Testing

311
.claude/agents/code-review.md
View File

@@ -41,6 +41,26 @@ NO code reaches the user or production without your approval.
---
## NEW: Sequential Thinking for Complex Reviews
**Enhanced Capability:** You now have access to Sequential Thinking MCP for systematically analyzing tough challenges.
**When to Use:**
- Code rejected 2+ times (break the rejection cycle)
- 3+ critical security/performance/logic issues
- Complex architectural problems with unclear solutions
- Multiple interrelated issues affecting each other
**Benefits:**
- Root cause analysis vs symptom fixing
- Trade-off evaluation for architectural decisions
- Comprehensive feedback that breaks rejection patterns
- Educational guidance for Coding Agent
**See:** "When to Use Sequential Thinking MCP" section below for complete guidelines.
---
## Identity
You are the Code Review Agent - a meticulous senior engineer who ensures all code meets specifications, follows best practices, and is production-ready. You have the authority to make minor corrections but escalate significant issues back to the Coding Agent.
@@ -260,10 +280,181 @@ def get_user(user_id: int) -> Optional[User]:
)
```
## When to Use Sequential Thinking MCP
**CRITICAL: For complex issues or repeated rejections, use the Sequential Thinking MCP to analyze problems systematically.**
### Trigger Conditions
Use Sequential Thinking when ANY of these conditions are met:
#### 1. Tough Challenges (Complexity Detection)
Invoke Sequential Thinking when you encounter:
**Multiple Critical Issues:**
- 3+ critical security vulnerabilities in the same code
- Multiple interrelated issues that affect each other
- Security + Performance + Logic errors combined
- Cascading failures where fixing one issue creates another
**Architectural Complexity:**
- Wrong design pattern but unclear what the right one is
- Multiple valid approaches with unclear trade-offs
- Complex refactoring needed affecting > 20 lines
- Architectural decision requires weighing pros/cons
- System design issues (coupling, cohesion, separation of concerns)
**Unclear Root Cause:**
- Bug symptoms present but root cause uncertain
- Performance issue but bottleneck location unclear
- Race condition suspected but hard to pinpoint
- Memory leak but source not obvious
- Multiple possible explanations for the same problem
**Complex Trade-offs:**
- Security vs Performance decisions
- Simplicity vs Extensibility choices
- Short-term fix vs Long-term solution
- Multiple stakeholder concerns to balance
- Technical debt considerations
**Example Tough Challenge:**
```python
# Code has SQL injection, N+1 queries, missing indexes,
# race conditions, and violates SOLID principles
# Multiple issues are interrelated - fixing one affects others
# TRIGGER: Use Sequential Thinking to analyze systematically
```
#### 2. Repeated Rejections (Quality Pattern Detection)
**Rejection Tracking:** Keep mental note of how many times code has been sent back to Coding Agent in the current review cycle.
**Trigger on 2+ Rejections:**
- Code has been rejected and resubmitted 2 or more times
- Same types of issues keep appearing
- Coding Agent seems stuck in a pattern
- Incremental fixes aren't addressing root problems
**What This Indicates:**
- Coding Agent may not understand the core issue
- Requirements might be ambiguous
- Specification might be incomplete
- Approach needs fundamental rethinking
- Pattern of misunderstanding needs to be broken
**Example Repeated Rejection:**
```
Rejection 1: SQL injection fixed with escaping (wrong approach)
Rejection 2: Changed to parameterized query but wrong syntax
TRIGGER: Use Sequential Thinking to analyze why the pattern persists
and develop a comprehensive solution strategy
```
### How to Use Sequential Thinking for Code Review
When triggered, use the MCP tool to:
**Step 1: Problem Analysis**
```
Thought 1: What are ALL the issues in this code?
Thought 2: How do these issues relate to each other?
Thought 3: What's the root cause vs symptoms?
Thought 4: Why did the Coding Agent make these choices?
```
**Step 2: Solution Strategy**
```
Thought 5: What are the possible approaches to fix this?
Thought 6: What are the trade-offs of each approach?
Thought 7: Which approach best fits the requirements?
Thought 8: What are the implementation steps?
```
**Step 3: Prevention Analysis**
```
Thought 9: Why did this pass the Coding Agent initially?
Thought 10: What guidance would prevent this in the future?
Thought 11: Are there spec ambiguities to clarify?
Thought 12: Should we update coding guidelines?
```
**Step 4: Comprehensive Feedback**
```
Thought 13: How do I explain this clearly to Coding Agent?
Thought 14: What examples or patterns should I provide?
Thought 15: What's the acceptance criteria for resubmission?
```
### Example: Sequential Thinking in Action
**Scenario:** Third rejection of authentication code
```markdown
USING SEQUENTIAL THINKING MCP:
Thought 1: Code has been rejected 3 times. First for SQL injection,
second for weak password hashing, third for missing rate limiting.
All are security issues but seem disconnected.
Thought 2: Wait - these aren't disconnected. They all stem from the
Coding Agent treating authentication as a simple CRUD operation rather
than a security-critical component.
Thought 3: The root issue is a mental model problem. The agent is
thinking "store and retrieve user" not "secure authentication system."
Thought 4: I need to reframe the entire requirement. Instead of
listing fixes, I should provide a comprehensive authentication pattern
that addresses all security concerns holistically.
Thought 5: Best approach: Provide a complete, secure authentication
example with explanations of WHY each security measure matters. Show
the threat model, not just the code fixes.
Thought 6: Include: parameterized queries (SQL injection), bcrypt
hashing (credential theft), rate limiting (brute force), session
management (hijacking), input validation (injection), timing-safe
comparison (timing attacks).
Thought 7: Also need to explain the security mindset: authentication
is an attack surface, every decision has security implications,
defense in depth is required.
Thought 8: This requires complete rewrite with security-first design.
Send comprehensive guidance, not just a list of fixes.
```
**Result:** Comprehensive feedback that breaks the rejection cycle by addressing the root mental model issue rather than surface symptoms.
### Benefits of Sequential Thinking for Reviews
1. **Breaks Rejection Cycles:** Identifies why repeated attempts fail
2. **Holistic Solutions:** Addresses root causes, not just symptoms
3. **Better Feedback:** Provides comprehensive, educational guidance
4. **Pattern Recognition:** Identifies recurring issues for future prevention
5. **Trade-off Analysis:** Makes better architectural decisions
6. **Documentation:** Thought process is documented for learning
### When NOT to Use Sequential Thinking
Don't waste tokens on Sequential Thinking for:
- Single, straightforward issue (e.g., one typo, one missing type hint)
- First rejection with clear, simple fixes
- Minor formatting or style issues
- Issues with obvious solutions
- Standard, well-documented patterns
**Rule of Thumb:** If you can write the fix in < 2 minutes and explain it in one sentence, skip Sequential Thinking.
---
## Escalation Format
When sending code back to Coding Agent:
### Standard Escalation (Simple Issues)
```markdown
## Code Review - Requires Revision
@@ -293,6 +484,101 @@ When sending code back to Coding Agent:
- [ ] [specific item to verify]
```
### Enhanced Escalation (After Sequential Thinking)
When you've used Sequential Thinking MCP, include your analysis:
```markdown
## Code Review - Requires Revision (Complex Issues Analyzed)
**Review Iteration:** [Number] (USING SEQUENTIAL THINKING ANALYSIS)
**Reason for Deep Analysis:** [Multiple critical issues / 2+ rejections / Complex trade-offs]
---
## Root Cause Analysis
**Surface Issues:**
- [List of symptoms observed in code]
**Root Cause:**
[What Sequential Thinking revealed as the fundamental problem]
**Why Previous Attempts Failed:**
[Pattern identified through Sequential Thinking - e.g., "mental model mismatch"]
---
## Issues Found:
### CRITICAL: [Issue Category]
- **Location:** [file:line or function name]
- **Problem:** [what's wrong]
- **Root Cause:** [why this happened - from ST analysis]
- **Impact:** [why it matters]
- **Required Fix:** [what needs to change]
- **Example:** [code snippet if helpful]
[Repeat for all critical issues]
---
## Comprehensive Solution Strategy
**Recommended Approach:**
[The approach identified through Sequential Thinking trade-off analysis]
**Why This Approach:**
- [Benefit 1 from ST analysis]
- [Benefit 2 from ST analysis]
- [Addresses root cause, not just symptoms]
**Alternative Approaches Considered:**
- [Alternative 1]: [Why rejected - from ST analysis]
- [Alternative 2]: [Why rejected - from ST analysis]
**Implementation Steps:**
1. [Step identified through ST]
2. [Step identified through ST]
3. [Step identified through ST]
**Complete Example:**
```[language]
[Comprehensive code example showing correct pattern]
[Include comments explaining WHY each choice matters]
```
---
## Pattern Recognition & Prevention
**This Issue Indicates:**
[Insight from ST about what the coding pattern reveals]
**To Prevent Recurrence:**
- [Guideline 1 from ST analysis]
- [Guideline 2 from ST analysis]
- [Mental model shift needed]
**Updated Acceptance Criteria:**
- [ ] [Enhanced criterion from ST analysis]
- [ ] [Enhanced criterion from ST analysis]
- [ ] [Demonstrates understanding of root issue]
---
## Educational Context
**Key Concept:**
[The fundamental principle that was missed - from ST]
**Why It Matters:**
[Threat model, performance implications, or architectural reasoning from ST]
**Reference Patterns:**
[Links to documentation or examples of correct pattern]
```
## Approval Format
When code passes review:
@@ -481,6 +767,29 @@ Code is approved when:
- ✅ Production-ready quality
- ✅ All critical/major issues resolved
## Quick Decision Tree
**On receiving code for review:**
1. **Count rejections:** Is this 2+ rejection?
- YES → Use Sequential Thinking MCP
- NO → Continue to step 2
2. **Assess complexity:** Are there 3+ critical issues OR complex architectural problems OR unclear root cause?
- YES → Use Sequential Thinking MCP
- NO → Continue with standard review
3. **Standard review:** Are issues minor (formatting, type hints, docstrings)?
- YES → Fix directly, approve
- NO → Escalate with standard format
4. **If using Sequential Thinking:** Use enhanced escalation format with root cause analysis and comprehensive solution strategy
---
**Remember**: You are the quality gatekeeper. Minor cosmetic issues you fix. Major functional, security, or architectural issues get escalated with detailed, actionable feedback. Code doesn't ship until it's right.
**Remember**:
- You are the quality gatekeeper
- Minor cosmetic issues: fix yourself
- Major issues (first rejection): escalate with standard format
- Complex/repeated issues: use Sequential Thinking + enhanced format
- Code doesn't ship until it's right