
Product
Socket Firewall Now Blocks Malicious VS Code and Open VSX Extensions
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.
@howaboua/pi-subagent-review
Advanced tools
Pi extension that adds /review via an isolated review subagent.
@howaboua/pi-subagent-review is a Pi extension that adds one slash command:
/review/review loopIt runs an isolated review subagent against your current repo, optionally prepares a compact conversation-context summary first, injects the findings back into the session as a user message, and asks the main agent to triage those advisory findings before deciding what to address. It is modelled after Codex CLI's /review command.
/review:
HEAD/review loop starts a review loop. It sets a review-specific marker at the current conversation point, strips the loop word from the review guidance, and then runs the normal review.
The first /review in a session branch also adds a visible advisory preface without starting an agent turn. The preface tells the main agent not to treat review findings as a TODO list, and to summarize and triage them against session context and the current implementation before changing code.
After that, plain /review detects the active review marker, summarizes the work since that marker back into a compact review-fix increment, advances the review marker, and then runs the next isolated review pass from the compacted point. If the stored marker is gone, /review simply behaves like a normal review.
The review marker is separate from @howaboua/pi-auto-trees' generic /marker, so both extensions can be used in the same session.
While /review is running, the extension shows a small review widget above the editor with one of two states:
Preparing review context…Reviewing changes…The widget is UI-only and is cleared when the command finishes, fails, or is cancelled.
The command chooses the base branch automatically:
main, master, or dev, it reviews against devdev exists, it falls back to main, then masterdev, it reviews against main, then mastermain or master, it prefers dev when availableThis means you usually never need to specify the diff base manually.
Anything after /review is treated as extra review guidance.
If the first word is loop in any casing, it starts review-loop mode and that word is removed from the review guidance.
Examples:
/review
/review loop
/review LoOp focus extra attention on migrations and tests
/review focus extra attention on migrations and tests
/review assess whether we introduced new UI elements instead of reusing established components and existing CSS patterns
On first load, the extension creates:
~/.pi/agent/pi-subagent-review.jsonIf Pi is using a custom agent directory via PI_CODING_AGENT_DIR, the file is created there instead.
Edit that file to change the default review model or thinking level, and the model used to summarize conversation context before review:
{
"model": "openai-codex/gpt-5.5",
"thinking": "medium",
"summary": {
"enabled": true,
"model": "openai/gpt-5.4-mini",
"thinking": "low"
}
}
The summary model uses the same provider/model string format as the reviewer model. The generated summary is injected into the isolated review task as branch-style context; raw conversation turns are not sent to the review subagent. If the configured review or summary model is not available for the user, /review falls back to the current session model automatically. If conversation summarization still fails, /review continues with a diff-only review.
Existing config files from older versions are migrated on load. If a config has model and thinking but no summary block, the extension adds one using the same model and low thinking:
{
"summary": {
"enabled": true,
"model": "<existing review model>",
"thinking": "low"
}
}
If a summary block already exists, it is left unchanged.
Installation methods:
pi install /absolute/path/to/pi-subagent-review
pi install npm:@howaboua/pi-subagent-review
pi install git:github.com/IgorWarzocha/pi-subagent-review
Then reload or restart Pi.
/review./review unless you intentionally want that command collision.FAQs
Pi extension that adds /review via an isolated review subagent.
The npm package @howaboua/pi-subagent-review receives a total of 238 weekly downloads. As such, @howaboua/pi-subagent-review popularity was classified as not popular.
We found that @howaboua/pi-subagent-review demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.

Research
More than 140 Mastra npm packages were compromised in a supply chain attack that used a typosquatted dependency to deliver a cross-platform infostealer during installation.

Research
/Security News
A new npm package tests AI malware scanners with prompt injection, safety-triggering comments, context flooding, and obfuscated JavaScript.