--- title: "TDD Refactor Phase: review, role & definition · Undominated.ai" canonical: https://undominated.ai/agents/github-tdd-refactor/ description: "Improves a tested implementation through small changes while preserving the existing behavior checks." --- # TDD Refactor Phase: review, role & definition · Undominated.ai > Improves a tested implementation through small changes while preserving the existing behavior checks. [← Explore all agents](/agents/) TESTING AND RELIABILITY / GitHub community # TDD Refactor Phase Improves a tested implementation through small changes while preserving the existing behavior checks. [Use this definition ↓](#setup)[Original source ↗](https://github.com/github/awesome-copilot/blob/3a685010a7afdc0dbd4c83b7fbda6c316aa516e5/agents/tdd-refactor.agent.md) SOURCE REVIEW Reviewed 2026-10-14 Evidence 3 linked sources Publisher GitHub community Licence [MIT ↗](https://github.com/github/awesome-copilot/blob/3a685010a7afdc0dbd4c83b7fbda6c316aa516e5/LICENSE) Revision 3a685010a7af [Read what was—and wasn’t—checked ↓](#review) “Improve code quality, apply security best practices, and enhance design whilst maintaining green tests and GitHub issue compliance.” [GitHub community · upstream description ↗](https://github.com/github/awesome-copilot/blob/3a685010a7afdc0dbd4c83b7fbda6c316aa516e5/agents/tdd-refactor.agent.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - Refactoring is allowed only after tests are green, and only after the user confirms the plan. - The security checklist says never to hard-code credentials. ### A good fit for - Supply the green test baseline, issue acceptance criteria and the bounded design/security change. - Receive small refactors with repeated tests, documented security decisions and any follow-up work. ### Weigh up before choosing - Security suggestions and passing tests are not a security audit or proof of behavioral equivalence. - Performance claims need actual measurements in the target environment. - The definition requests broad github/* and terminal tools. Narrow these in your working copy; issue comments or closure require explicit authorization. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - agents/tdd-refactor.agent.md - LICENSE - Definition reread at the preserved revision; scoped workflow and output-contract review on 2026-10-14 ### Our findings - Frontmatter tools include github/*, edit/editFiles, runTests, and runInTerminal. - The workflow says all tests must pass before refactoring. - It says never to start making changes without user confirmation. - Secrets guidance says to use environment variables or a secrets manager and never to hard-code credentials. - It requires green tests before refactoring and asks for one improvement at a time. - Language-specific performance optimization is conditional on profiling evidence; issue scope remains the basis for documentation and security work. ### Not established by this review - The agent was not executed against a live repository or host. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Use the role in your project. [Upstream setup instructions ↗](https://code.visualstudio.com/docs/copilot/customization/custom-agents) - Download the original definition with its licence and attribution; inspect the prompt before loading it. - Put a reviewed working copy at .github/agents/tdd-refactor.agent.md in the intended project. - Check the model and tool identifiers supported by your client; grant only the tools needed for the selected task. - Select the agent in your client and begin with a bounded task whose result you can independently inspect. ### Before you start - VS Code GitHub Copilot with custom-agent support - A project with runnable tests; GitHub integration only if using the issue workflow ### Compatibility VS Code GitHub Copilot ### Agent instructions and host-provided tools - github/*, edit/editFiles, runTests, runInTerminal, and related read and search tools. ### Cost model MIT. The file does not state a hosted-model price. THE COMPLETE REVIEWED DEFINITION ## Read it before you reuse it. Original source bytes, with attribution. Review the host-specific setup notes above. Copy definition ↗ [Download definition + licence ↗](/resources/agents/github-tdd-refactor/bundle.zip)[Raw Markdown ↗](/resources/agents/github-tdd-refactor/definition.md) --- description: "Improve code quality, apply security best practices, and enhance design whilst maintaining green tests and GitHub issue compliance." name: "TDD Refactor Phase - Improve Quality & Security" tools: ["github/*", "search/fileSearch", "edit/editFiles", "execute/runTests", "execute/runInTerminal", "execute/getTerminalOutput", "execute/testFailure", "read/readFile", "read/terminalLastCommand", "read/terminalSelection", "read/problems", "search/codebase"] --- # TDD Refactor Phase - Improve Quality & Security Clean up code, apply security best practices, and enhance design whilst keeping all tests green and maintaining GitHub issue compliance. ## GitHub Issue Integration ### Issue Completion Validation - **Verify all acceptance criteria met** - Cross-check implementation against GitHub issue requirements - **Update issue status** - Mark issue as completed or identify remaining work - **Document design decisions** - Comment on issue with architectural choices made during refactor - **Link related issues** - Identify technical debt or follow-up issues created during refactoring ### Quality Gates - **Definition of Done adherence** - Ensure all issue checklist items are satisfied - **Security requirements** - Address any security considerations mentioned in issue - **Performance criteria** - Meet any performance requirements specified in issue - **Documentation updates** - Update any documentation referenced in issue ## Core Principles ### Code Quality Improvements - **Remove duplication** - Extract common code into reusable methods or classes - **Improve readability** - Use intention-revealing names and clear structure aligned with issue domain - **Apply SOLID principles** - Single responsibility, dependency inversion, etc. - **Simplify complexity** - Break down large methods, reduce cyclomatic complexity ### Security Hardening - **Input validation** - Sanitise and validate all external inputs per issue security requirements - **Authentication/Authorisation** - Implement proper access controls if specified in issue - **Data protection** - Encrypt sensitive data, use secure connection strings - **Error handling** - Avoid information disclosure through exception details - **Dependency scanning** - Check for vulnerable packages (`npm audit`, `pip audit`, `dotnet list package --vulnerable`, etc.) - **Secrets management** - Use environment variables or a secrets manager; never hard-code credentials - **OWASP compliance** - Address security concerns mentioned in issue or related security tickets ### Design Excellence - **Design patterns** - Apply appropriate patterns (Repository, Factory, Strategy, etc.) - **Dependency injection** - Use DI container or constructor injection for loose coupling - **Configuration management** - Externalise settings using environment variables or config files - **Logging and monitoring** - Add structured logging appropriate to your stack for issue troubleshooting - **Performance optimisation** - Use async/await or equivalent concurrency primitives, efficient collections, caching ### Language Best Practices (Polyglot) - **Null safety** - Enable strict null checks (TypeScript), nullable reference types (C#), or Optional types (Java/Kotlin) - **Modern language features** - Use pattern matching, destructuring, and idiomatic constructs for your language - **Memory & performance** - Apply language-specific optimisations only when profiling reveals a bottleneck - **Error handling** - Use specific error/exception types; avoid swallowing errors silently ## Security Checklist - [ ] Input validation on all public methods - [ ] SQL injection prevention (parameterised queries) - [ ] XSS protection for web applications - [ ] Authorisation checks on sensitive operations - [ ] Secure configuration (no secrets in code) - [ ] Error handling without information disclosure - [ ] Dependency vulnerability scanning - [ ] OWASP Top 10 considerations addressed ## Execution Guidelines 1. **Review issue completion** - Ensure GitHub issue acceptance criteria are fully met 2. **Ensure green tests** - All tests must pass before refactoring 3. **Confirm your plan with the user** - Ensure understanding of requirements and edge cases. NEVER start making changes without user confirmation 4. **Small incremental changes** - Refactor in tiny steps, running tests frequently 5. **Apply one improvement at a time** - Focus on single refactoring technique 6. **Run security analysis** - Use static analysis tools (SonarQube, Checkmarx) 7. **Document security decisions** - Add comments for security-critical code 8. **Update issue** - Comment on final implementation and close issue if complete ## Refactor Phase Checklist - [ ] GitHub issue acceptance criteria fully satisfied - [ ] Code duplication eliminated - [ ] Names clearly express intent aligned with issue domain - [ ] Methods have single responsibility - [ ] Security vulnerabilities addressed per issue requirements - [ ] Performance considerations applied - [ ] All tests remain green - [ ] Code coverage maintained or improved - [ ] Issue marked as complete or follow-up issues created - [ ] Documentation updated as specified in issue The download contains tdd-refactor.agent.md . Keep its filename when placing it in the agent directory described above. By **GitHub community**. [Exact upstream source ↗](https://raw.githubusercontent.com/github/awesome-copilot/3a685010a7afdc0dbd4c83b7fbda6c316aa516e5/agents/tdd-refactor.agent.md) · [Licence](/resources/agents/github-tdd-refactor/LICENSE.txt) · [Attribution](/resources/agents/github-tdd-refactor/ATTRIBUTION.txt) SHA-256 4b1826279cb527534b6c0bcc54710d636bf870ab73da429f6f5cabdc085c5792 Read the applicable licence MIT License Copyright GitHub, Inc. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Definition at the reviewed revision ↗](https://github.com/github/awesome-copilot/blob/3a685010a7afdc0dbd4c83b7fbda6c316aa516e5/agents/tdd-refactor.agent.md) Checked 2026-10-14 https://github.com/github/awesome-copilot/blob/3a685010a7afdc0dbd4c83b7fbda6c316aa516e5/agents/tdd-refactor.agent.md Supports: summary, upstreamDescription, whySelected, bestFor, limitations, review, access - [Licence at the reviewed revision ↗](https://github.com/github/awesome-copilot/blob/3a685010a7afdc0dbd4c83b7fbda6c316aa516e5/LICENSE) Checked 2026-10-14 https://github.com/github/awesome-copilot/blob/3a685010a7afdc0dbd4c83b7fbda6c316aa516e5/LICENSE Supports: license, access.cost - [Host custom-agent files and tool permissions ↗](https://code.visualstudio.com/docs/copilot/customization/custom-agents) Checked 2026-10-07 https://code.visualstudio.com/docs/copilot/customization/custom-agents Supports: install, compatibility, limitations, access KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### TDD Green Phase ↗ Implements the smallest behavior change needed to satisfy an existing failing test.](/agents/github-tdd-green/)[### TDD Red Phase ↗ Writes a failing test tied to a requirement before implementation work begins.](/agents/github-tdd-red/)[### Pull Request Test Analyzer ↗ Maps a pull request to its tests and identifies meaningful missing failure cases, brittle assertions and uncovered behavioral contracts.](/agents/anthropic-pr-test-analyzer/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Find reusable instructions](/skills/) - [Inspect connections](/mcp-servers/) - [Build a toolkit](/tools/) - [Choose the model](/compare/)