Code Review

Diagnoses why an HTTP API sold over x402 v2 cannot be paid by standard buyer agents or never appears in the Coinbase CDP Bazaar catalog, using an ordered checklist and a decision tree over the pasted 402 response, headers and symptoms. Names the exact field that is wrong or missing and how to prove the fix. Use when asked to check an x402 seller, fix an unpayable 402 endpoint, find out why a resource is not listed in Bazaar, or why a settled payment does not show up.

Finds the loops behind a bill spike or an unexpected bill. Reviews a web app's code and config for loops and repeats that run up the bill on their own on Vercel, Turso, Cloudflare Workers and D1 and paid AI APIs. Finds two schedulers on one job, retries without a cap, work that triggers itself, client polling and React render loops, caches cleared on every write, middleware running on every static file, queues that resend failures forever, image settings that multiply transformations, health checks that count whole tables, alerts sent on every run and bots crawling endless filter URLs. Counts the runs per month, names the billed unit, ranks by cost and gives the change that stops each one. Use when asked why a Vercel, Turso or Cloudflare bill jumped, to find an infinite loop or a runaway cost, or to review a cron job, webhook, queue consumer, middleware or polling code before it ships.

Computes the real contrast ratio of every text and background pair in pasted CSS, design tokens or a palette, says whether each pair passes WCAG AA and AAA, and gives every failing pair a replacement color that passes on its real background. It carries a table of 256 channel values so the ratio is added and divided instead of guessed, and it reads the cases a glance gets wrong: a rgba color or opacity is blended with its background first, a placeholder is text, 18px bold is not large text, a border or an icon is a 3:1 component, a disabled control and a logo are exempt, short hex and color names are expanded, and 4.48 is never rounded up to 4.5. One line per pair, then a Verdict line. Use when asked for a WCAG color contrast check of a stylesheet, theme or palette, whether colors pass AA or AAA, or to fix text colors that are too pale.

Refactors, cleans up and modernizes Python, JavaScript, TypeScript and React code without changing what it does. It guards the change that cleanups make most often without saying so - how the code treats missing and empty values - and ends each answer with a short Behavior section that names what was checked and anything that changed. Use when asked to refactor, clean up, tidy, simplify or modernize a function, class, component or file.

Reviews pasted application code, scripts and config for the four ways a secret leaks from the code that uses it, and lists only those, one line each with a fixed code, the place, who can then read the secret and the fix - or exactly No findings. It catches a secret value written to a log or printed (the key itself, an object or environment dump that contains it), a secret placed in a URL query string, a secret typed into source or a committed file, and a server secret sent to the browser through a public environment prefix or a prop of a client component. It leaves out the safe look-alikes: printing only that a key is present, its length or its last four characters, a publishable key that is public by design, and a secret read from the environment on the server. Use to review code that calls an API with a key, to check a Next.js or Vite project before release, or to gate a pull request that touches credentials.