Review an Agent’s Diff Without Losing an Afternoon
Review an Agent’s Diff Without Losing an Afternoon
A coding agent can finish a patch before you finish your coffee. Reviewing it is the expensive part: unfamiliar helpers, unrelated formatting, and tests that confidently verify the wrong behavior. My fix is a bounded review: establish scope, inspect risk, run focused checks, and stop when the evidence supports a decision.
I use Fluxo to keep the connection consistent across Claude Code, Codex, Gemini CLI, and any OpenAI SDK. One key and one base URL, https://api.fluxorelay.com, cover Claude, GPT, Gemini, DeepSeek, Kimi, GLM, Qwen, Grok, and more. Whether the patch came from Claude Sonnet 5.5 or GPT-6.1 Sol, the review stays the same.
1. Freeze the patch before reading it
Start with the agent’s branch checked out. These commands assume Bash, an origin remote, and main as the target branch. First inspect the working tree:
git status --short — If anything appears, stop. Have the agent commit its intended changes, or preserve unrelated work separately. The commands below review committed changes only; silently ignoring an unstaged fix gives you a misleading result.
git fetch origin main — REVIEW_HEAD=$(git rev-parse HEAD)
REVIEW_BASE=$(git merge-base origin/main "$REVIEW_HEAD") — git log --oneline "$REVIEW_BASE..$REVIEW_HEAD"
Recording commit IDs freezes the comparison even if the agent keeps working. The merge base isolates branch changes rather than including unrelated updates on main.
2. Inventory files before inspecting implementation
Write one sentence describing the requested behavior. For example: “Retry transient upstream failures twice, but never retry authentication failures.” Then run:
git diff --stat "$REVIEW_BASE" "$REVIEW_HEAD" — git diff --name-status "$REVIEW_BASE" "$REVIEW_HEAD"
git diff --check "$REVIEW_BASE" "$REVIEW_HEAD" — The last command catches whitespace errors and introduced conflict markers, not correctness bugs. Use the inventory to challenge scope before reading hundreds of lines.
- Every changed file should support the requested behavior directly.
- Dependency updates need justification beyond making installation work locally.
- Deleted tests deserve inspection before replacement tests earn trust.
If a retry fix also rewrites logging and updates dependencies, request a smaller patch. Splitting unrelated work is usually faster than reviewing around it.
3. Read risky paths before reading new helpers
Read the complete patch first, with enough surrounding context to understand branches: — git diff --find-renames --unified=20 "$REVIEW_BASE" "$REVIEW_HEAD"
For a noisy patch, inspect tracked source changes separately:
git diff --unified=20 "$REVIEW_BASE" "$REVIEW_HEAD" -- src/
Replace src/ with your repository’s source directory. Trace inputs through validation, authorization, side effects, and error handling. For retries, check the attempt count, timeout budget, cancellation, and whether repeating the operation can duplicate a charge or write.
Ask the agent for one explanation: “Identify the changed failure paths and the tests proving each one.” Treat its answer as navigation, not evidence. Open the referenced lines yourself.
4. Run the patch outside your working checkout
Create a detached worktree at the recorded commit. Choose another destination if this directory already exists: — git worktree add --detach ../fluxo-agent-review "$REVIEW_HEAD"
Inspect dependency and script changes before executing anything:
git diff "$REVIEW_BASE" "$REVIEW_HEAD" -- package.json package-lock.json
For an npm project with a committed lockfile and test and build scripts, run:
(cd ../fluxo-agent-review && npm ci --ignore-scripts && npm test && npm run build)
A worktree isolates files, not hostile execution. Run unfamiliar patches in a disposable environment without credentials. Ignoring installation scripts reduces one risk; tests and builds still execute code. If legitimate setup requires scripts, inspect them before enabling them.
Add one focused regression check for the original failure. Passing existing tests cannot prove coverage of behavior they never exercised.
5. End with evidence, not another rewrite
Leave feedback naming the file, observed behavior, and expected outcome. Request the smallest correction, then review the follow-up diff rather than restarting everything. Remove the worktree when finished:
git worktree remove ../fluxo-agent-review — Fluxo bills per real token, including cache reads and writes, with no monthly fee; keeping follow-ups narrow makes their cost easier to reason about. If this fits your terminal workflow, consider creating a Fluxo account. Users also earn a referral share when people they invite pay. Neither billing nor model choice replaces the final check: does this exact patch satisfy the request without expanding its blast radius?