{"slug": "claude-code-2-1-220-the-hidden-javascript-code-review-workflow-its-stages-and", "title": "Claude Code 2.1.220: the hidden JavaScript code-review workflow, its stages, and its activation conditions", "summary": "A developer's teardown of Claude Code 2.1.220 for macOS ARM64 revealed a hidden JavaScript workflow named `code-review` embedded in the installed executable, registered with `hidden: true` and distinct from the public Markdown code-review plugin. The recovered 354-line, roughly 25 KB script runs five stages — Scope, Find, Verify, Sweep, and Synthesize — using parallel finder agents and independent verifiers, and is selected by the `/code-review xhigh` command only when a feature flag permits. The findings apply specifically to version 2.1.220 and do not establish the same behavior in later releases.", "body_md": "Claude Code 2.1.220 contains a built-in JavaScript workflow named `code-review`.\n\nThe program registers this workflow with `hidden: true`. The workflow is inside the installed executable. It is not the public Markdown code-review plugin.\n\nThe workflow has five stages:\n\n```\nScope → Find → Verify → Sweep → Synthesize\n```\n\nThe command `/code-review xhigh` can select this workflow. However, a feature flag controls this selection. The command does not always use the workflow.\n\nThe terms `ultra` and `ultracode` refer to related but different features. Neither is the name of this workflow.\n\nThis report uses these technical terms:\n\n| Term | Meaning | \n|---|---|\n| Agent | A model session that does an assigned task. | \n| Workflow | A JavaScript program that controls agents and processes their results. | \n| Finder | An agent that searches for possible problems. | \n| Candidate | A possible problem that requires a check. | \n| Verifier | An independent agent that checks candidates against the code. | \n| Finding | A candidate that the review includes in its report. | \n| Diff | The code changes selected for review. | \n| Feature flag | A configuration value that controls a program feature. | \n| Inline review | A review that does not use this named Workflow program. It can still use agents. | \n\nThe inspected program was Claude Code **2.1.220** for macOS ARM64.\n\nThe executable contains a Bun section. This section includes bytecode and a minified JavaScript bundle. Minification replaces descriptive names with short names and removes much formatting.\n\nThe bundle contains a function named `gDd()`. This function builds the review script from a text template and shared prompts.\n\nThe investigation recovered the complete script. The recovered script has 354 lines and approximately 25 KB of text.\n\nThe script requires the Claude Code Workflow runtime. It is not a separate Node.js program. The runtime supplies these functions and values:\n\n```\nagent\nparallel\nphase\nlog\nargs\n```\n\nThese findings apply to version 2.1.220. They do not establish the same behavior in later versions.\n\nA second installation, version 2.1.260, was present. However, the shell selected version 2.1.220. Check the selected executable before you compare results.\n\nOne agent establishes the review scope. It returns:\n\n- The diff command.\n- The changed file paths.\n- A change summary.\n- The applicable CLAUDE.md files.\n- The rules that apply to the changed code.\n\nThe target can be a pull request, branch, reference range, file path, or written scope instruction.\n\nWith no target, the agent selects the current branch changes. It also includes uncommitted changes when they exist.\n\nThe workflow stops if the scope contains no changed files.\n\nThe finder agents operate in parallel. Each correctness finder gets a different task.\n\n| Finder | Task | \n|---|---|\n| A | Examine each changed line and its containing function for incorrect behavior. | \n| B | Check whether deleted code had a safeguard that the new code does not retain. | \n| C | Check the callers and called functions for incompatible changes. | \n| D | Search for known errors in the language or framework. | \n| E | Check that wrappers and proxies call the correct object and supply the required methods. | \n\nA separate finder checks five code-quality subjects:\n\n- Reuse of existing code.\n- Unnecessary complexity.\n- Unnecessary computation or input/output operations.\n- The level of the implementation, called `altitude` in the source.\n- Compliance with applicable CLAUDE.md rules.\n\nEach candidate contains a file path, an optional line number, a summary, and a failure scenario.\n\nFor a code-quality candidate, the scenario describes a concrete cost instead of an incorrect result or crash.\n\nAll initial finders must finish before verification starts.\n\nThe script converts equivalent file paths to a common form. It then groups candidates by file and line.\n\nOne independent verifier checks each group. The verifier gives a separate result for each candidate in that group.\n\n| Result | Meaning | \n|---|---|\n| `CONFIRMED` | The verifier can identify the triggering state and the incorrect behavior. | \n| `PLAUSIBLE` | The failure mechanism exists, but its triggering state is uncertain. | \n| `REFUTED` | The claim is incorrect, impossible under the code's constraints, or prevented by other code. | \n\nThe prompt states **“PLAUSIBLE by default.”**\n\nA realistic but uncertain failure condition is not sufficient reason to reject a candidate. Rejection requires evidence from the code.\n\nThe final report can therefore contain uncertain findings. This is an intentional property of the review instructions.\n\nGrouping does not combine duplicate claims. Each candidate keeps its own result. The script removes candidates that have no verifier result.\n\nThe `xhigh` and `max` levels add one new finder after the first verification stage.\n\nThis finder receives the previous candidates. It searches only for problems that the first search missed.\n\nIt can return up to eight additional candidates. Independent verifiers check these candidates before the final report.\n\nThe `high` level does not include this stage.\n\nThe script removes candidates with a `REFUTED` result.\n\nA final agent selects findings by their index numbers. It identifies duplicate claims and puts the findings in priority order.\n\nThe script then assembles the report from the existing finding text. The final agent does not rewrite that text.\n\nCorrectness findings take priority over code-quality findings. Within each category, `CONFIRMED` takes priority over `PLAUSIBLE`.\n\nIf the final agent omits a verified finding, the script adds it when the report still has space.\n\n| Level | Correctness finders | Code-quality finders | Initial candidate limit | Additional search | Report limit | \n|---|---|---|---|---|---|\n| `high` | 3 | 1 | 48 | None | 10 findings | \n| `xhigh` | 5 | 1 | 80 | 8 candidates | 15 findings | \n| `max` | 5 | 1 | 80 | 8 candidates | 15 findings | \n\nThe initial candidate limits include all five code-quality subjects:\n\n```\nhigh:  (3 × 6) + (5 × 6) = 48\nxhigh: (5 × 8) + (5 × 8) = 80\nmax:   (5 × 8) + (5 × 8) = 80\n```\n\nThese are maximum limits, not required totals. The number of verifier agents depends on the number of distinct candidate locations.\n\nThe `xhigh` and `max` levels use the same workflow structure. The source identifies model reasoning effort as their difference.\n\nThe workflow's `args` value selects its structure. The script does not set each agent's reasoning effort.\n\nIn an interactive Claude Code session, use one of these commands:\n\n```\n/code-review high\n/code-review xhigh\n/code-review max\n/code-review xhigh main...HEAD\n```\n\nWhen the selection conditions pass, the built-in skill tells Claude to make this tool call:\n\n```\nWorkflow({ name: \"code-review\", args: \"xhigh main...HEAD\" })\n```\n\nVersion 2.1.220 requires all these conditions:\n\n1. The review level is `high` ,`xhigh` , or`max` .\n2. Claude is not preloading the skill.\n3. Workflows is enabled, available, and permitted by policy.\n4. The session is interactive, not a `claude -p` session.\n5. The session has the Workflow tool.\n6. `tengu_review_workflow_routing` is`true` .\n\nOne inspected installation had these cached values:\n\n```\n{\n  \"tengu_workflows_enabled\": true,\n  \"tengu_review_workflow_routing\": false\n}\n```\n\nThus, Workflows availability alone does not establish automatic selection of the review workflow.\n\nCached values can change after an update from the service. These values are not a statement about all accounts.\n\nThe investigation did not change feature flags or settings.\n\nThe named-workflow lookup includes hidden built-in workflows. It is separate from the command's automatic selection flag.\n\nIf the Workflow tool is available and permitted, use this procedure:\n\n1. \nSet the model effort: \n\n```\n/effort xhigh\n```\n\n2. \nGive Claude this instruction: \n\n```\nUse the Workflow tool with name \"code-review\" and args \"xhigh main...HEAD\".\nUse this exact named workflow.\nDo not edit files or post GitHub comments.\nIf the workflow is unavailable, report that condition.\nDo not use a different review method.\n```\n\n3. \nCheck for a Workflow tool call with the specified name.\n4. \nUse `/workflows` to examine progress.\n5. \nCheck for the Scope, Find, Verify, Sweep, and Synthesize stages.\n\nIf user settings disable Workflows, this command requests enablement for one session:\n\n```\nclaude --settings '{\"enableWorkflows\":true}'\n```\n\nPolicy and service availability still apply.\n\nThe inspected registration and lookup code support this direct request. The investigation did not test it through a live Claude session.\n\n**CAUTION:** The workflow can start many agents. These agents consume model tokens. The investigation did not measure cost or completion time.\n\nThese commands select the separate cloud review service:\n\n```\n/code-review ultra\n/ultrareview\nclaude ultrareview\n```\n\nThe local program starts a cloud session and waits for its findings. This operation requires remote access to the code and can incur charges.\n\nThe local launcher does not establish which workflow program the cloud service uses.\n\nThis command selects xhigh effort and continuing use of dynamic workflows for substantive tasks:\n\n```\n/effort ultracode\n```\n\nThe `ultracode` keyword can also request dynamic workflows for one turn.\n\nNeither option specifically selects the named `code-review` workflow. The review script recognizes `high`, `xhigh`, and `max`, not `ultra`.\n\nThe [official public code-review plugin](https://github.com/anthropics/claude-plugins-official/blob/main/plugins/code-review/commands/code-review.md) describes its procedure in Markdown.\n\nThe inspected plugin uses parallel reviewers and confidence scores. It removes issues with scores below 80.\n\nThat procedure is different from the JavaScript workflow described here.\n\nThe recovered source has these identifiers and locations:\n\n| Identifier | Location in the recovered bundle | Function | \n|---|---|---|\n| `DRo()` | Line 13604 | Registers built-in workflows and the hidden option. | \n| `Osn()` | Line 13992 | Finds a workflow by name. | \n| `gDd()` | Lines 15832–16188 | Builds and registers the code-review script. | \n| `$X_()` | Line 16614 | Initializes the bundled workflows. | \n| `q8S()` | Lines 23710–23725 | Builds the review instructions, including the Workflow tool call. | \n| `eom()` | Line 23725 | Checks the conditions for automatic workflow selection. | \n\nThese names and line numbers apply only to the recovered 2.1.220 bundle.\n\nSHA-256 of the recovered bundle:\n\n```\nd60e0e81efcc86861d9a7094b027b2b7b7cbd99469eebbcd6a5b707030211120\n```\n\nThe investigation performed these checks without model requests:\n\n- The extracted script passed a JavaScript syntax check.\n- Test runs used synthetic agent results at `high` ,`xhigh` , and`max` .\n- The tests confirmed the initial finder counts.\n- Candidates at one location used one verifier agent.\n- Verification results remained attached to the correct candidates.\n- The final stage combined duplicate findings.\n- Only `xhigh` and`max` performed the additional search.\n- An empty scope stopped the review.\n\nThese tests check program behavior with supplied results. They do not measure bug detection, false findings, model compliance, live availability, or cost.\n\nNo live model review or cloud review ran during the investigation.\n\nThe strongest match is the hidden `code-review` JavaScript workflow inside Claude Code 2.1.220.\n\nIt uses parallel finders, independent verification, an optional additional search, and a final report stage.\n\nThe command name alone does not prove that this workflow ran. Check the Workflow tool call and its stage display.", "url": "https://wpnews.pro/news/claude-code-2-1-220-the-hidden-javascript-code-review-workflow-its-stages-and", "canonical_source": "https://gist.github.com/nateberkopec/2484f21176b226db825a02c8646ce83f", "published_at": "2026-09-08 23:50:31+00:00", "updated_at": "2026-09-13 02:56:56.799604+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "large-language-models", "ai-products"], "entities": ["Claude Code", "Anthropic", "Bun", "Node.js"], "alternates": {"html": "https://wpnews.pro/news/claude-code-2-1-220-the-hidden-javascript-code-review-workflow-its-stages-and", "markdown": "https://wpnews.pro/news/claude-code-2-1-220-the-hidden-javascript-code-review-workflow-its-stages-and.md", "text": "https://wpnews.pro/news/claude-code-2-1-220-the-hidden-javascript-code-review-workflow-its-stages-and.txt", "jsonld": "https://wpnews.pro/news/claude-code-2-1-220-the-hidden-javascript-code-review-workflow-its-stages-and.jsonld"}}