Agents Reference¶
WuMing routes each changed file to one or more agents based on glob patterns. Agents
run concurrently. A file can be reviewed by multiple agents (e.g. a Python file is
reviewed by both code and security).
Configure which agents run via WUMING_AGENTS — see
Configuration.
code¶
Reviews source code for correctness, logic bugs, missing error handling, and test coverage gaps.
File patterns: *.py, *.go, *.ts, *.tsx, *.js, *.jsx, *.rs, *.java,
*.c, *.cpp, *.h, *.cs
config¶
Reviews configuration and settings files for schema correctness, missing required fields, insecure defaults, exposed secrets, and consistency with documented options.
File patterns: *.toml, *.yaml, *.yml, *.json, *.ini, *.env, *.cfg
docs¶
Reviews documentation files for clarity, accuracy, completeness, broken links, and formatting issues.
File patterns: *.md, *.rst, *.txt
performance¶
Reviews changed source and SQL files for runtime performance regressions.
Looks for:
- N+1 ORM queries: a loop calling an ORM method (.get(), .filter(), .find(),
.objects.get(), .query()) per iteration, where a bulk fetch (select_related,
prefetch_related, WHERE IN, JOIN) would suffice.
- O(n²) complexity: nested loops over the same or related collection; repeated
linear searches (x in list, list.index(), Array.find()) inside a loop over a
large collection.
- I/O inside loops: file reads/writes, HTTP calls, subprocess invocations, or
database queries executed per iteration when they could be hoisted or batched.
- Missing indexes: a new query pattern (filter/order-by/join on a column) with no
corresponding index creation in the same diff.
File patterns: *.py, *.go, *.ts, *.tsx, *.js, *.jsx, *.rs, *.java,
*.c, *.cpp, *.h, *.cs, *.sql
security¶
Reviews code, config, and shell files from an OWASP Top 10 (2021) perspective. Looks for injection flaws, broken authentication, sensitive data exposure, security misconfigurations, use of components with known vulnerabilities, and related issues. Runs alongside the other agents as an additive reviewer, not a replacement.
File patterns: same as code + config + shell combined — *.py, *.go,
*.ts, *.tsx, *.js, *.jsx, *.rs, *.java, *.c, *.cpp, *.h, *.cs,
*.toml, *.yaml, *.yml, *.json, *.ini, *.env, *.cfg, *.sh, *.fish,
Dockerfile, Containerfile, Makefile
shell¶
Reviews shell scripts and infrastructure files for correctness, security risks (injection, exposed secrets), error handling, portability, and CI/CD pipeline correctness.
File patterns: *.sh, *.fish, Dockerfile, Containerfile, Makefile
tests¶
Reviews changed files for test quality issues. Has two concerns:
Test file quality (files matching test_*, *_test.*, *.test.*, *.spec.*,
/tests/, /test/, _test.go):
- Tests added or modified with no assertion statements
- Trivial or tautological assertions (assert True, assertEqual(x, x),
expect(x).to_equal(x)) that can never fail
- Tests that mutate module-level variables, class attributes, or shared fixtures
without restoring state (no teardown, addCleanup, finally, or context manager)
Coverage gap detection (source files not matching test path patterns):
When running tests alongside code, coverage gap detection in tests supersedes the lighter coverage-gap mention in code's scope.
- Flags source files modified in the diff when no corresponding test file appears
anywhere in the same diff. Uses judgment — trivial one-line fixes and auto-generated
files are not flagged.
File patterns: *.py, *.go, *.ts, *.tsx, *.js, *.jsx, *.rs, *.java,
*.c, *.cpp, *.h, *.cs
Per-agent model selection¶
Any agent can use a different model from the rest of the pipeline. Append :model
to the agent name in WUMING_AGENTS:
The DeepSeek and Moonshot backends always raise WUMING_MAX_TOKENS to 16384 — their
models emit reasoning tokens that share the same budget with the answer.
Model names are backend-specific — use the exact model identifier accepted by the
backend you have configured in WUMING_BACKEND. The example above uses DeepSeek model
names; substitute the appropriate identifier for Anthropic, Ollama, or Moonshot backends.