Add Claude automated code review

.github/workflows/claude-review.yml

@@ -0,0 +1,56 @@
+name: Claude Code Review
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  issue_comment:
+    types: [created]
+
+jobs:
+  claude-review:
+    if: >
+      (github.event_name == 'pull_request') ||
+      (github.event_name == 'issue_comment' && github.event.issue.pull_request && contains(github.event.comment.body, '@claude'))
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      actions: read
+      contents: read
+      pull-requests: write
+      issues: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check PR size
+        if: github.event_name == 'pull_request'
+        id: pr-size
+        run: |
+          CHANGED_LINES=$(git diff --stat origin/${{ github.event.pull_request.base.ref }}...origin/${{ github.event.pull_request.head.ref }} | tail -1 | awk '{gsub(/[^0-9]/, " "); print $1 + $2}')
+          CHANGED_LINES=${CHANGED_LINES:-0}
+          echo "changed_lines=$CHANGED_LINES" >> "$GITHUB_OUTPUT"
+          echo "PR has $CHANGED_LINES changed lines"
+
+      - name: Claude Code Review
+        if: >
+          github.event_name == 'issue_comment' ||
+          (github.event_name == 'pull_request' && fromJSON(steps.pr-size.outputs.changed_lines) >= 300)
+        uses: anthropics/claude-code-action@v1
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          trigger_phrase: "@claude"
+          track_progress: true
+          prompt: |
+            Review this PR focusing on:
+            1. Security - no unbounded cache growth, response body size caps, no global fetch patching
+            2. Correctness - BaseTool/BaseResource patterns followed, Zod schemas for all inputs/outputs, httpRequest injected not global fetch
+            3. Conventions - tools registered in toolRegistry.ts, resources in resourceRegistry.ts, .js extensions on imports, no accessToken param on execute()
+            4. Testing - new tools and resources need tests, all HTTP calls mocked with vi.fn(), no real network calls in tests
+            5. Dependencies - avoid adding new dependencies without strong justification; prefer Node 22+ built-ins
+
+            Do NOT suggest switching to Jest, express, axios, or node-fetch.
+            Do NOT suggest adding an accessToken or context parameter to execute().
+
+            Provide detailed inline comments for specific issues.
+          claude_args: '--model claude-opus-4-6 --allowedTools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*),mcp__github_inline_comment__create_inline_comment,Read,Grep,Glob,Bash(git log:*),Bash(git diff:*),Bash(git show:*),Bash(git blame:*),Bash(git rev-parse:*),WebFetch(domain:github.com)"'