Reviewing Coding Agent Changes Line by Line

Start by establishing the intended change boundary

A line-by-line review begins before you read the first line. Read the task, issue, acceptance criteria, and agent summary, then state the expected outcome in one sentence. For example, the expected outcome might be that an API client retries transient failures without changing authentication, response parsing, or public method signatures. This boundary prevents a common failure mode: approving code that appears clean but solves a broader, narrower, or different problem.

Next, inspect the changed-file list. Ask whether every file belongs to the stated task and whether an expected file is missing. A retry feature may reasonably touch the client, its tests, and configuration documentation. It should not quietly rewrite unrelated formatting, rename broad abstractions, or alter dependency versions without a clear reason. If the coding agent made opportunistic cleanup changes, request that they be separated from the functional change.

Read the diff in execution order first

Do not begin by judging style. Trace the path a real request takes through the diff: input, validation, decision points, side effects, output, and error handling. For each changed line, ask what data can reach it, what assumptions it makes, and what happens when those assumptions are false. This approach reveals defects that conventional visual scanning misses, such as a retry counter incremented after a return or an exception converted into a misleading success result.

Pay particular attention to added conditionals. Confirm that the condition is complete, that its branches are mutually appropriate, and that the default branch is safe. Then inspect each early return, throw, catch, and cleanup block. A coding agent can generate plausible control flow that handles the happy path well while skipping resource cleanup or swallowing context needed for diagnosis.

• Check whether new variables have a single, understandable meaning.
• Check whether mutations are visible to later code and tests.
• Check whether asynchronous calls are awaited, cancelled, or bounded correctly.
• Check whether errors preserve useful messages and causes.

Verify every changed line against surrounding contracts

A diff rarely contains all of the rules that matter. Open the caller, callee, interface, schema, and nearby tests when a changed line relies on a contract. If an agent changes a function from returning null to throwing an error, inspect every call site rather than trusting the local implementation. If it adds a field to a request object, verify the server, serializer, validation layer, and logs agree on the field name and meaning.

Types deserve the same scrutiny. A type assertion may silence the compiler without proving runtime validity. Optional fields, empty arrays, zero values, time zones, Unicode input, and pagination boundaries often expose gaps between generated code and production behavior. Treat comments as claims to verify, especially when they explain security behavior, compatibility guarantees, or performance decisions.

Examine tests as evidence rather than decoration

Tests should demonstrate the new behavior and protect the important failure modes. Read them line by line after reviewing the implementation, because tests can reveal what the agent assumed. Verify that a test would fail before the change, fails for the intended reason when you deliberately break the behavior, and does not merely mock away the relevant logic.

For the retry example, test a transient failure followed by success, exhausted retries, a non-retryable failure, and the configured delay or backoff policy. Also check that the test asserts observable behavior rather than private implementation details. Snapshot updates require special care: inspect every changed snapshot line and confirm it reflects an intentional product outcome, not a newly accepted regression.

Use tools to validate claims made by the diff

Run the narrowest meaningful checks first: targeted unit tests, type checking, linting, and a small manual scenario. Then run broader validation when the change affects shared code, deployment behavior, concurrency, or user-facing contracts. Record commands and outcomes in the review so another engineer can reproduce the evidence.

This discipline matters when agents operate through different model backends. BestRelay is a quality-first API relay that forwards each request to the official model named in it without substitution, supports tools such as Claude Code, Codex, Gemini CLI, and OpenAI SDK clients, and uses https://api.bestapirelay.com as its API base. Its pay-as-you-go billing follows provider-reported token counts, with cache reads and writes priced separately. A team may use Claude Sonnet 5.5 for an agent task, but the reviewer still owns validation; model output is an input to review, not proof of correctness.

Finish reviews with actionable decisions and follow-ups

Classify findings by impact and explain the concrete consequence. Prefer comments such as, “This catch block treats a timeout as an empty response, so callers may cache incomplete data,” over vague requests to “handle errors better.” Distinguish blocking correctness issues from optional readability improvements, and avoid requesting refactors that do not reduce a real risk.

Before approving, reread the original acceptance criteria and compare them with the final diff and test evidence. Confirm that generated files are intentional, secrets are absent, observability remains useful, and rollback is feasible. Create a BestRelay account if you want a straightforward relay option for your coding-agent workflow. A careful final pass turns line-by-line review into an engineering decision backed by scope, contracts, tests, and evidence.