---

name: code-review description: >- Reviews pull requests and risky changes for the contentstack-cli-content-type plugin. Use when reviewing diffs, security-sensitive edits, dependency upgrades, or changes to compare/diagram/temp-file behavior, ESLint, and tests.

code-review – contentstack-cli-content-type

When to use

• Reviewing a PR or diff before merge.
• Auditing dependency upgrades (axios, diff2html, git-diff, node-graphviz, tmp, cli-ux).
• Changes touching compare HTML, temp files, diagram output, or src/core/contentstack/.

Instructions

Provide consistent security, correctness, and maintainability review for this repository. The plugin handles stack API keys in error messages, opens HTML diffs in a browser, and writes diagram files via Graphviz.

Use Critical / Important / Suggestion when leaving feedback.

Highlights

• Secrets: Never approve logging of tokens, authtoken / authorization values, or raw management tokens.
• Compare / diagram: Changes to src/core/content-type/compare.ts or diagram.ts deserve extra scrutiny (temp files, browser open, paths, binary dependency).
• Dependencies: axios, diff2html, git-diff, node-graphviz, tmp, cli-ux—review changelog and supply-chain for version bumps.
• Quality: TypeScript and eslint-config-oclif-typescript (.eslintrc); behavioral changes should include or update Jest tests where appropriate.

Security and privacy

| Severity | Item | |----------|------| | Critical | No logging or serializing of access tokens, management tokens, or Bearer strings. | | Critical | No new console.log of full API responses that may contain secrets. | | Important | Stack API keys appear in user-facing errors only in line with src/core/contentstack/client.ts (buildError + optional key suffix). |

Correctness

| Severity | Item | |----------|------| | Critical | Command flags and setup(flags) behavior remain consistent; compare-remote still resolves origin vs remote stacks correctly. | | Important | Compare: left/right version logic and warning when versions are equal; HTML output path and browser open behavior unchanged unless intentionally redesigned. | | Important | Diagram: output path validation; Graphviz / DOT paths; orientation and file type flags. | | Suggestion | Edge cases for empty audit logs, missing references, or single-version content types. |

Compare and diagram (touching core)

| Severity | Item | |----------|------| | Critical | compare.ts: temp HTML creation does not write sensitive data beyond the diff; file handling is safe on failure paths. | | Important | diagram.ts: sanitizePath / path usage; large stack models do not cause unbounded memory without consideration. | | Suggestion | User messaging when Graphviz is missing or SVG generation fails. |

Dependencies

| Severity | Item | |----------|------| | Important | axios: security advisories; upgrade notes. | | Important | diff2html, git-diff, tmp, cli-ux: behavior changes affecting compare UX. | | Important | node-graphviz: compatibility with supported Node and system Graphviz. | | Suggestion | moment (if touched): prefer minimal churn; note maintenance status of dependencies. |

Tests and tooling

| Severity | Item | |----------|------| | Important | New behavior in src/core/ or src/utils/ has Jest coverage or a clear reason why not. | | Important | pnpm test and ESLint (pnpm run lint / .eslintrc) pass. | | Suggestion | Tests mock HTTP/SDK boundaries; no accidental live API calls. |

Documentation

| Severity | Item | |----------|------| | Important | If commands or flags change, README (generated via oclif readme) is updated via pnpm run build / version workflow. | | Suggestion | User-facing strings and examples match src/commands/content-type/*.ts examples. |

References

• testing/SKILL.md — test and lint expectations.
• contentstack-cli-content-type/SKILL.md — architecture and risky areas.