Build a Long-Running Code Review Agent with Claude Fable 5 and TypeScript

npx tsx review-agent.ts ./my-project

mkdir fable5-reviewer && cd fable5-reviewer
npm init -y
npm install @anthropic-ai/sdk dotenv
npm install -D typescript tsx @types/node

{
  "compilerOptions": {
    "target": "ES2022",
    "module": "NodeNext",
    "moduleResolution": "NodeNext",
    "outDir": "./dist",
    "strict": true,
    "esModuleInterop": true
  }
}

// stream-test.ts
import Anthropic from '@anthropic-ai/sdk';
import 'dotenv/config';
 
const client = new Anthropic();
 
async function main(): Promise<void> {
  const stream = client.messages.stream({
    model: 'claude-fable-5',
    max_tokens: 512,
    messages: [
      {
        role: 'user',
        content: 'List 5 things to check in a TypeScript security audit. Be brief.',
      },
    ],
  });
 
  for await (const chunk of stream) {
    if (
      chunk.type === 'content_block_delta' &&
      chunk.delta.type === 'text_delta'
    ) {
      process.stdout.write(chunk.delta.text);
    }
  }
 
  const final = await stream.finalMessage();
  console.log(
    `\n\nTokens: ${final.usage.input_tokens} in / ${final.usage.output_tokens} out`
  );
}
 
main();

npx tsx stream-test.ts

// tools.ts
import { readFileSync, readdirSync, statSync } from 'fs';
import { join, extname } from 'path';
import type Anthropic from '@anthropic-ai/sdk';
 
const ALLOWED_EXTENSIONS = new Set([
  '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs',
  '.json', '.md', '.yaml', '.yml', '.toml', '.env.example',
]);
 
export const toolDefinitions: Anthropic.Tool[] = [
  {
    name: 'list_directory',
    description: 'List files and directories at a given path.',
    input_schema: {
      type: 'object' as const,
      properties: {
        path: { type: 'string', description: 'Directory path to list' },
        recursive: { type: 'boolean', description: 'Recurse into subdirectories' },
      },
      required: ['path'],
    },
  },
  {
    name: 'read_file',
    description: 'Read the text content of a source file.',
    input_schema: {
      type: 'object' as const,
      properties: {
        path: { type: 'string', description: 'Absolute or relative file path' },
      },
      required: ['path'],
    },
  },
  {
    name: 'search_pattern',
    description: 'Search for a regex pattern across all source files in a directory. Returns matching lines with file and line number.',
    input_schema: {
      type: 'object' as const,
      properties: {
        pattern: { type: 'string', description: 'Regex pattern to search for' },
        directory: { type: 'string', description: 'Root directory to search' },
        maxResults: {
          type: 'number',
          description: 'Maximum lines to return (default 50)',
        },
      },
      required: ['pattern', 'directory'],
    },
  },
];
 
function walkDir(dir: string, recursive: boolean): string[] {
  const results: string[] = [];
  for (const name of readdirSync(dir)) {
    if (name.startsWith('.') || name === 'node_modules' || name === 'dist') continue;
    const full = join(dir, name);
    const stat = statSync(full);
    if (stat.isDirectory()) {
      results.push(`${full}/`);
      if (recursive) results.push(...walkDir(full, true));
    } else {
      results.push(full);
    }
  }
  return results;
}
 
function grepFiles(pattern: string, dir: string, maxResults: number): string[] {
  const regex = new RegExp(pattern, 'gi');
  const matches: string[] = [];
  const files = walkDir(dir, true).filter(
    (f) => !f.endsWith('/') && ALLOWED_EXTENSIONS.has(extname(f))
  );
  for (const file of files) {
    if (matches.length >= maxResults) break;
    try {
      const lines = readFileSync(file, 'utf-8').split('\n');
      for (let i = 0; i < lines.length; i++) {
        if (regex.test(lines[i])) {
          matches.push(`${file}:${i + 1}: ${lines[i].trim()}`);
          if (matches.length >= maxResults) break;
        }
      }
    } catch {
      // skip unreadable files
    }
  }
  return matches;
}
 
export function executeTool(
  name: string,
  input: Record<string, unknown>
): string {
  try {
    if (name === 'list_directory') {
      const path = input.path as string;
      const recursive = (input.recursive as boolean) ?? false;
      const entries = walkDir(path, recursive);
      return entries.slice(0, 300).join('\n') || '(empty directory)';
    }
 
    if (name === 'read_file') {
      const path = input.path as string;
      if (!ALLOWED_EXTENSIONS.has(extname(path))) {
        return `Skipped: extension ${extname(path)} is not in the allow-list.`;
      }
      const content = readFileSync(path, 'utf-8');
      // Truncate files larger than 50k chars to protect the context budget
      return content.length > 50_000
        ? content.slice(0, 50_000) + '\n\n[file truncated — over 50 000 characters]'
        : content;
    }
 
    if (name === 'search_pattern') {
      const pattern = input.pattern as string;
      const directory = input.directory as string;
      const maxResults = (input.maxResults as number) ?? 50;
      const hits = grepFiles(pattern, directory, maxResults);
      return hits.length > 0 ? hits.join('\n') : 'No matches found.';
    }
 
    return `Unknown tool: ${name}`;
  } catch (err) {
    return `Tool error: ${(err as Error).message}`;
  }
}

// agent-loop.ts
import Anthropic from '@anthropic-ai/sdk';
import { toolDefinitions, executeTool } from './tools.js';
 
const client = new Anthropic();
 
const SYSTEM = `You are a senior software engineer performing a thorough, systematic code review.
 
Workflow:
1. Call list_directory on the project root (recursive: true) to understand the structure.
2. Read key config files first: package.json, tsconfig.json, .eslintrc, next.config.js.
3. Read each major source file in turn.
4. Use search_pattern to look for common security issues: eval, dangerouslySetInnerHTML, SQL string building, hardcoded secrets, process.env without validation.
5. After reading all relevant files, write a structured report.
 
Report format:
## Critical Issues
## High Priority
## Medium Priority  
## Recommendations`;
 
export async function runReviewAgent(projectPath: string): Promise<void> {
  const messages: Anthropic.MessageParam[] = [
    {
      role: 'user',
      content: `Perform a comprehensive code review of the project at: ${projectPath}
 
Review everything — security, correctness, TypeScript quality, error handling, and architecture. Start by exploring the project structure.`,
    },
  ];
 
  let iteration = 0;
  const maxIterations = 40;
 
  console.log(`\nFable 5 code review — ${projectPath}\n${'─'.repeat(60)}\n`);
 
  while (iteration < maxIterations) {
    iteration++;
 
    const response = await client.messages.create({
      model: 'claude-fable-5',
      max_tokens: 8192,
      system: SYSTEM,
      tools: toolDefinitions,
      messages,
    });
 
    // Add the assistant turn before processing
    messages.push({ role: 'assistant', content: response.content });
 
    const toolResults: Anthropic.ToolResultBlockParam[] = [];
 
    for (const block of response.content) {
      if (block.type === 'text' && block.text) {
        process.stdout.write(block.text);
      } else if (block.type === 'tool_use') {
        const input = block.input as Record<string, unknown>;
        console.log(`\n  [${block.name}] ${JSON.stringify(input).slice(0, 80)}`);
        const result = executeTool(block.name, input);
        toolResults.push({
          type: 'tool_result',
          tool_use_id: block.id,
          content: result,
        });
      }
    }
 
    if (toolResults.length > 0) {
      messages.push({ role: 'user', content: toolResults });
      continue;
    }
 
    if (response.stop_reason === 'end_turn') {
      console.log(`\n${'─'.repeat(60)}\nDone — ${iteration} iterations`);
      break;
    }
 
    console.warn(`\nUnexpected stop_reason: ${response.stop_reason}`);
    break;
  }
 
  if (iteration >= maxIterations) {
    console.warn('Max iterations reached — review may be incomplete.');
  }
}

// deep-review.ts
import Anthropic from '@anthropic-ai/sdk';
import { toolDefinitions, executeTool } from './tools.js';
 
const client = new Anthropic();
 
export async function runDeepSecurityAudit(projectPath: string): Promise<void> {
  const messages: Anthropic.MessageParam[] = [
    {
      role: 'user',
      content: `Perform a deep security audit of ${projectPath}.
 
Focus on:
- Injection vulnerabilities (SQL, command, path traversal)
- Authentication and authorization flaws
- Sensitive data exposure and secrets in code
- Insecure deserialization
- Vulnerable dependencies in package.json
 
Examine all source files carefully, then provide a detailed security report.`,
    },
  ];
 
  let iteration = 0;
 
  while (iteration < 30) {
    iteration++;
 
    const response = await client.messages.create({
      model: 'claude-fable-5',
      max_tokens: 16000,
      tools: toolDefinitions,
      messages,
      thinking: {
        type: 'enabled',
        budget_tokens: 8000, // Allow up to 8k tokens of private reasoning per turn
      },
    });
 
    messages.push({ role: 'assistant', content: response.content });
    const toolResults: Anthropic.ToolResultBlockParam[] = [];
 
    for (const block of response.content) {
      if (block.type === 'thinking') {
        // You can display or omit thinking blocks — they are never billed at output rates
        console.log(`\n  [thinking — ${block.thinking.length} chars]`);
      } else if (block.type === 'text' && block.text) {
        process.stdout.write(block.text);
      } else if (block.type === 'tool_use') {
        console.log(`\n  [${block.name}]`);
        const result = executeTool(
          block.name,
          block.input as Record<string, unknown>
        );
        toolResults.push({
          type: 'tool_result',
          tool_use_id: block.id,
          content: result,
        });
      }
    }
 
    if (toolResults.length > 0) {
      messages.push({ role: 'user', content: toolResults });
      continue;
    }
    if (response.stop_reason === 'end_turn') break;
  }
}

// cached-agent.ts
import Anthropic from '@anthropic-ai/sdk';
import { readFileSync } from 'fs';
import { toolDefinitions, executeTool } from './tools.js';
 
const client = new Anthropic();
 
export async function runCachedReview(projectPath: string): Promise<void> {
  // Read package.json once — it will be cached across all subsequent turns
  let packageJson = '(no package.json)';
  try {
    packageJson = readFileSync(`${projectPath}/package.json`, 'utf-8');
  } catch { /* not found */ }
 
  // System prompt with a cacheable block for the large reference content
  const systemContent: Anthropic.TextBlockParam[] = [
    {
      type: 'text',
      text: `You are a code security and quality reviewer.\n\nproject package.json:\n\`\`\`json\n${packageJson}\n\`\`\`\n\nReference this when analysing dependencies.`,
      cache_control: { type: 'ephemeral' }, // Cache this large block for 5 minutes
    },
    {
      type: 'text',
      text: 'Use the provided tools to read source files. Report issues by severity.',
      // Shorter blocks are not worth caching
    },
  ];
 
  const messages: Anthropic.MessageParam[] = [
    {
      role: 'user',
      content: `Review all TypeScript files in ${projectPath} for security and code quality issues.`,
    },
  ];
 
  let iteration = 0;
  let cachedTokensSaved = 0;
 
  while (iteration < 30) {
    iteration++;
 
    const response = await client.messages.create({
      model: 'claude-fable-5',
      max_tokens: 8192,
      system: systemContent,
      tools: toolDefinitions,
      messages,
    });
 
    const usage = response.usage as Anthropic.Usage & {
      cache_read_input_tokens?: number;
    };
    if (usage.cache_read_input_tokens) {
      cachedTokensSaved += usage.cache_read_input_tokens;
    }
 
    messages.push({ role: 'assistant', content: response.content });
    const toolResults: Anthropic.ToolResultBlockParam[] = [];
 
    for (const block of response.content) {
      if (block.type === 'text') process.stdout.write(block.text);
      else if (block.type === 'tool_use') {
        const result = executeTool(
          block.name,
          block.input as Record<string, unknown>
        );
        toolResults.push({
          type: 'tool_result',
          tool_use_id: block.id,
          content: result,
        });
      }
    }
 
    if (toolResults.length > 0) {
      messages.push({ role: 'user', content: toolResults });
      continue;
    }
 
    if (response.stop_reason === 'end_turn') {
      // 9/10 of cached tokens cost nothing compared to standard input rate
      const savedUsd = ((cachedTokensSaved * 9) / 10 / 1_000_000) * 10;
      console.log(
        `\n\nCache saved ~$${savedUsd.toFixed(4)} (${cachedTokensSaved.toLocaleString()} tokens at 90% discount)`
      );
      break;
    }
  }
}

// review-agent.ts
import 'dotenv/config';
import { runCachedReview } from './cached-agent.js';
 
const projectPath = process.argv[2];
 
if (!projectPath) {
  console.error('Usage: npx tsx review-agent.ts <path>');
  process.exit(1);
}
 
console.log('Claude Fable 5 Code Reviewer');
console.log(`Path   : ${projectPath}`);
console.log('Model  : claude-fable-5');
console.log('Context: 1M tokens  |  Max output: 128k tokens\n');
 
runCachedReview(projectPath).catch((err) => {
  console.error('\nAgent error:', err.message);
  process.exit(1);
});

npx tsx review-agent.ts ./src