# Review Pull Requests Automatically in an Express API

Yes. An agent checks out the pull request, runs npm test (Jest) in its own sandbox, and posts one review citing file and line for each finding.

[Run this on Rush](https://cloud.getrush.ai/run/review-pull-requests/express/), in a Project that has your repository.

## What the agent does

The agent starts from the repository's own declarations. In hagopj13/node-express-boilerplate it reads `package.json`: the package is `create-nodejs-express-app` at 1.7.0, `engines` asks for Node >=12, and `npm test` runs `jest -i --colors --verbose --detectOpenHandles`, the `-i` flag running the files in band so the suite does not fight over the in-memory MongoDB server each test file spins up. Lint is `eslint .`, formatting is `prettier --check **/*.js`.

The code is thin routes over services. Routes live under `src/routes/v1` and delegate to `src/services`: `auth.service.js` for login and registration, `token.service.js` for the JWT and refresh-token documents, `user.service.js` for database queries, with Mongoose models behind them and Joi validating request bodies. The agent checks out the pull request branch, runs `npm install`, then `npm test`, and reads the Jest output file by file.

It reads the diff in the auth and user routes together with the services they call. A route that validates a body with Joi but then ignores one of the validated fields, a service method that returns a document with the password hash still attached, an async handler whose rejection never reaches the central error middleware: findings like these cite the route or service file and the exact line.

One GitHub review comes back per run. The summary quotes the Jest result, separates blocking issues from suggestions, and each finding carries its file and line. The prompt forbids pushing commits, and the run pushes none.

## Start it with one API call

`POST https://api.prix.dev/o/{org}/sessions`

```json
{
  "agent": "claude",
  "input": "Review this pull request. Check it out, install dependencies with npm, run `npm test`, and read the diff with the surrounding code in the auth and user routes. Post one GitHub review that cites file and line for every finding, separates blocking issues from suggestions, and includes the test result. Do not push commits.",
  "resources": [
    {
      "url": "https://github.com/your-org/your-app/pull/42"
    }
  ]
}
```

1. **Get an API key.** In the console, open Settings, then API keys, and create a key for your org. Send it in the Authorization header as a Bearer token.
2. **Send the request.** POST the body in request.json to https://api.prix.dev/o/{org}/sessions, with your repository as the resources URL. The run starts in its own cloud sandbox.
3. **Read what came back.** Follow the run on its live stream or wait for the run.completed webhook, then read the result and its trajectory.

## What comes back

What comes back is a review on the pull request. The summary quotes the `npm test` result with the per-file Jest output, lists the findings with file and line, and states which ones block merge and which are suggestions. Inline comments sit on the cited lines, so the conversation reads in place.

The session's trajectory keeps the install, the test run and the files the agent opened while tracing each route into its service. When a finding says a validated field is ignored, the trajectory shows the Joi schema and the handler side by side.

Before merging, a reviewer reproduces the blocking findings with `npm test` on the branch and checks that each cited line matches the comment. Suggestions are marked and can be dismissed without holding the merge.

## Run it on every pull request opened

Create an automation with a GitHub trigger on `pull_request.opened` and `pull_request.synchronize`, scoped to the base branch your API merges to, and this prompt. Each pull request then gets its own run in its own sandbox, and the review lands on the pull request without a developer checking out the branch and waiting for Jest.

Set a webhook URL on the API key and Rush POSTs `run.completed` when each run's turn finishes, with the session URL. Your server can post the review link to the channel that watches the API's pull requests. A key runs at most `max_concurrent` sessions at once, 4 by default, and answers `429` past that, so raise the limit before a launch that opens many pull requests.

## Why run it on Rush?

An Express review on a laptop starts with checking out someone else's branch and installing dependencies before the first line of review can be written. On Rush the agent does that in its own sandbox, runs `npm test` there and keeps every command and its output in the trajectory, so the review is backed by an executed Jest suite rather than a read of the diff.

One sandbox per pull request keeps the reviews parallel when the API has several open at once, each with its own install, its own suite and its own review. The author keeps their working tree, the reviewer keeps their time, and the result is a review that quotes the tests it ran.

## Frequently asked questions

### Does the suite need a running MongoDB?

No. The test files start an in-memory MongoDB server of their own, which is why the `test` script passes `-i` to Jest. The sandbox provides Node and nothing else; no external service is required.

### Will it run lint and Prettier too?

The repository has `lint` and `prettier` scripts next to `test`. Name them in the prompt and the review quotes their output alongside the Jest result, still citing file and line for anything they flag.

### Can it review pull requests that change the Joi validation schemas?

Yes, and those are where it earns its keep: it checks the schema against how the handler uses the validated value, which is where a schema update the route ignores, or a field the schema dropped that the service still needs, shows up.

### What happens when the suite fails on the pull request?

The review still posts. The summary quotes the failing tests, the findings are listed separately from the suite state, and a blocking finding is not confused with a red suite.