Back to Details

parallel-code-review

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Parallel Code Review

并行代码审查

Use Cursor’s Task tool to run four 
explore
(read-only) subagents at once. Each subagent only reads code and produces findings for one dimension. The main agent merges results into a single prioritized review — something only a multi-agent setup does efficiently.
使用Cursor的Task工具同时运行四个
explore
（只读）子Agent。每个子Agent仅读取代码并针对一个维度生成审查结果。主Agent会将结果合并为一份优先级明确的审查报告——这是只有多Agent架构才能高效完成的工作。

When to use

使用场景

  • Large diffs or refactors where a single pass misses categories.
  • Security-sensitive changes (auth, payments, parsing untrusted input).
  • Performance-sensitive paths (hot loops, N+1 queries, bundle entry points).
  • 大型代码差异或重构场景，单次审查容易遗漏各类问题。
  • 涉及安全敏感的变更（认证、支付、解析不可信输入等）。
  • 性能敏感路径的变更（热循环、N+1查询、包入口点等）。

Workflow

工作流程

1. Scope the change set

1. 确定变更范围

Prefer a concrete list of files for reviewers:
bash
git diff --name-only origin/main...HEAD
Or paste the PR link and let the main agent list changed files from the branch.
为审查者提供具体的文件列表：
bash
git diff --name-only origin/main...HEAD
或者粘贴PR链接，让主Agent从分支中列出变更文件。

2. Launch four parallel subagents

2. 启动四个并行子Agent

Send one message with four Task invocations, each 
subagent_type: "explore"
and readonly: true, with prompts like:
Security
Read-only review: SECURITY

Changed files:
<list>

Focus: injection (SQL, shell, XSS), authZ/authN gaps, secrets in code, unsafe deserialization, path traversal, SSRF, IDOR, dependency CVEs mentioned in diff.

Output:
- Critical / High / Medium / Low findings
- File:line and short fix recommendation
- "No issues" if nothing material
Performance
Read-only review: PERFORMANCE

Changed files:
<list>

Focus: N+1 queries, missing indexes, accidental O(n²) loops, bundle size impact, unnecessary re-renders, sync I/O on hot paths, unbounded caches.

Output: same severity + location format as above.
Correctness
Read-only review: CORRECTNESS

Changed files:
<list>

Focus: logic bugs, off-by-one, wrong edge cases, race conditions, error handling gaps, breaking API changes, test gaps for new behavior.

Output: same format.
Readability / maintainability
Read-only review: READABILITY

Changed files:
<list>

Focus: naming, duplication, abstraction boundaries, file size, unclear control flow, missing types/docs where they would prevent bugs.

Output: same format; prefer suggestions over nitpicks.
发送一条消息，包含四个Task调用，每个调用设置
subagent_type: "explore"
且readonly: true，提示语如下：
安全维度
只读审查：安全

变更文件：
<列表>

审查重点：注入攻击（SQL、Shell、XSS）、权限管理/authN/authZ漏洞、代码中的密钥、不安全反序列化、路径遍历、SSRF、IDOR、差异中提及的依赖CVE。

输出格式：
- 严重/高/中/低风险问题
- 文件:行号及简短修复建议
- 若无重大问题则输出“无问题”
性能维度
只读审查：性能

变更文件：
<列表>

审查重点：N+1查询、缺失索引、意外的O(n²)循环、包体积影响、不必要的重渲染、热路径上的同步I/O、无界缓存。

输出格式：与上述相同的风险等级+位置格式。
正确性维度
只读审查：正确性

变更文件：
<列表>

审查重点：逻辑错误、差一错误、错误的边界情况、竞态条件、错误处理漏洞、破坏性API变更、新行为的测试覆盖不足。

输出格式：相同格式。
可读性/可维护性维度
只读审查：可读性

变更文件：
<列表>

审查重点：命名规范、代码重复、抽象边界、文件大小、不清晰的控制流、缺失类型/文档（这些内容可预防错误）。

输出格式：相同格式；优先提供建议而非吹毛求疵的细节。

3. Synthesize

3. 结果合并

The main agent should:
  1. De-duplicate findings that appear in multiple dimensions (count once, worst severity).
  2. Order by severity, then by fix cost.
  3. Produce a short executive summary (5 bullets max) and a table or list of actionable items.
主Agent需完成以下操作：
  1. 去重多个维度中重复出现的问题（只计数一次，取最高风险等级）。
  2. 按风险等级排序，其次按修复成本排序。
  3. 生成简短的执行摘要（最多5个要点）以及可操作项的表格或列表。

4. Optional — address findings

4. 可选步骤——处理审查结果

Fix in the main agent or spawn targeted non-readonly follow-up tasks only for approved items.
在主Agent中修复问题，或仅针对已批准的项启动针对性的非只读后续任务。

Notes

注意事项

  • Keep prompts read-only so parallel runs never fight over writes.
  • If the diff is huge, split by directory and run four reviewers per directory in a second wave — do not cram unrelated megadiffs into one pass.
  • This complements human review; it does not replace compliance or security sign-off for regulated environments.
  • 保持提示语为只读模式，避免并行运行时出现写入冲突。
  • 如果代码差异过大，按目录拆分，在第二轮中为每个目录运行四个审查者——不要将无关的大型代码差异塞进一次审查。
  • 此流程是对人工审查的补充，不能替代受监管环境中的合规性或安全审批。