diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index ea93273f7..e3bbe891d 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -24,7 +24,7 @@
{
"name": "bitwarden-code-review",
"source": "./plugins/bitwarden-code-review",
- "version": "2.5.0",
+ "version": "2.6.0",
"description": "Comprehensive code review system with organization-wide standards."
},
{
diff --git a/README.md b/README.md
index a0cb25dc8..17babf32e 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,7 @@ A curated collection of plugins for AI-assisted development at Bitwarden. Enable
| [bitwarden-shepherd](plugins/bitwarden-shepherd/) | 1.0.1 | Champion of a technical strategy — shepherds a TSI through evaluation into the funnel, then through to adoption |
| [bitwarden-adr-tools](plugins/bitwarden-adr-tools/) | 1.0.0 | Architecture Decision Record tools: checking designs and plans against the ADR catalog, locating and summarizing ADRs |
| [bitwarden-atlassian-tools](plugins/bitwarden-atlassian-tools/) | 2.7.7 | Atlassian access via MCP server with deep Jira issue research skill and opt-in Jira write tools |
-| [bitwarden-code-review](plugins/bitwarden-code-review/) | 2.5.0 | Autonomous code review agent following Bitwarden engineering standards with GitHub integration |
+| [bitwarden-code-review](plugins/bitwarden-code-review/) | 2.6.0 | Autonomous code review agent following Bitwarden engineering standards with GitHub integration |
| [bitwarden-delivery-tools](plugins/bitwarden-delivery-tools/) | 3.5.2 | Delivery lifecycle skills: initiative funnel navigation, work transitions, architectural judgment, feature flags, commits, PRs, preflight, labeling, Jira ticket filing |
| [bitwarden-designer](plugins/bitwarden-designer/) | 0.1.0 | Product designer persona: Code of Conduct and 30/60/90 critique, critique facilitation; dispatches into bitwarden-design-tools |
| [bitwarden-design-tools](plugins/bitwarden-design-tools/) | 0.1.0 | Design toolkit: content style guide, Figma Dev Mode MCP, Bitwarden brand application, handoff prep, Design System governance, Product and Design Jira |
diff --git a/plugins/bitwarden-code-review/.claude-plugin/plugin.json b/plugins/bitwarden-code-review/.claude-plugin/plugin.json
index f4e13e61e..a58d934b3 100644
--- a/plugins/bitwarden-code-review/.claude-plugin/plugin.json
+++ b/plugins/bitwarden-code-review/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
{
"name": "bitwarden-code-review",
- "version": "2.5.0",
+ "version": "2.6.0",
"description": "Comprehensive code review system with organization-wide standards.",
"author": {
"name": "Bitwarden",
diff --git a/plugins/bitwarden-code-review/CHANGELOG.md b/plugins/bitwarden-code-review/CHANGELOG.md
index 2f11d59db..45ba7b2f7 100644
--- a/plugins/bitwarden-code-review/CHANGELOG.md
+++ b/plugins/bitwarden-code-review/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to the Bitwarden Code Review Plugin will be documented in th
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+## [2.6.0] - 2026-10-23
+
+### Changed
+
+- Inline comments and thread replies on a GitHub pull request end with a `code-review` source line. claude-config-validator's `/validate-ai` posts under the same bot account, so without it a reader cannot tell which review raised a finding
+
## [2.5.0] - 2026-10-23
### Added
diff --git a/plugins/bitwarden-code-review/agents/bitwarden-code-reviewer/AGENT.md b/plugins/bitwarden-code-review/agents/bitwarden-code-reviewer/AGENT.md
index d08e42793..f53c4ae7d 100644
--- a/plugins/bitwarden-code-review/agents/bitwarden-code-reviewer/AGENT.md
+++ b/plugins/bitwarden-code-review/agents/bitwarden-code-reviewer/AGENT.md
@@ -1,6 +1,6 @@
---
name: bitwarden-code-reviewer
-version: 2.5.0
+version: 2.6.0
description: Conducts thorough code reviews following Bitwarden standards. Finds all issues first pass, avoids false positives, respects codebase conventions. Invoke when user mentions "code review", "review code", "review", "PR", or "pull request".
model: opus
skills: avoiding-false-positives, classifying-review-findings, posting-bitwarden-review-comments, posting-review-summary, reviewing-dependency-changes
diff --git a/plugins/bitwarden-code-review/skills/posting-bitwarden-review-comments/SKILL.md b/plugins/bitwarden-code-review/skills/posting-bitwarden-review-comments/SKILL.md
index ad99377aa..0cb5720d5 100644
--- a/plugins/bitwarden-code-review/skills/posting-bitwarden-review-comments/SKILL.md
+++ b/plugins/bitwarden-code-review/skills/posting-bitwarden-review-comments/SKILL.md
@@ -15,7 +15,7 @@ Check destinations **in this order** — use the first match:
| Local target, no GitHub destination | The review target is local changes and no caller declared a GitHub destination | Write to `review-inline-comments.md` in working directory |
| GitHub pull request | Neither of the above | Post via `mcp__github_inline_comment__create_inline_comment` |
-Under either local destination, format every finding exactly as below and write them all to the one file — do not post, whatever comment tools happen to be available.
+Under either local destination, format every finding exactly as below, without the source line, and write them all to the one file — do not post, whatever comment tools happen to be available.
On a GitHub pull request, a finding raised again in an existing thread goes as a reply in that thread, so its history stays in one place. Call `mcp__github_replies__add_reply_to_pull_request_comment` with the `database_id` of the thread's first comment as `commentId`, the owner and repository from the threads data's top-level `repository`, and the pull request number as `pullNumber`, which the tool requires whenever a reply has a body. The reply uses the same finding format as an inline comment. When that tool is unavailable, the thread's first comment has no `database_id`, or the reply call fails, post a new inline comment instead.
@@ -57,8 +57,9 @@ On a GitHub pull request, a finding raised again in an existing thread goes as a
4. Be brief yet clear
5. Use collapsed sections for comments over 5 lines
6. Include both opening `` AND closing ` ` tags
+7. On a GitHub pull request, end with the source line `code-review`, short comments and thread replies included
-**Visibility Rule:** Only severity + one-line description visible; everything else inside `` tags.
+**Visibility Rule:** Only severity + one-line description and, on a GitHub pull request, the source line visible; everything else inside `` tags.
### Template for long comments
@@ -74,6 +75,8 @@ On a GitHub pull request, a finding raised again in an existing thread goes as a
Reference: [docs link if applicable]
+
+code-review
```
## Summary Output
diff --git a/plugins/bitwarden-code-review/tests/TESTING.md b/plugins/bitwarden-code-review/tests/TESTING.md
index d62330c5b..27aaefbef 100644
--- a/plugins/bitwarden-code-review/tests/TESTING.md
+++ b/plugins/bitwarden-code-review/tests/TESTING.md
@@ -41,15 +41,15 @@ claude -p "What Claude Code skill are available in this plugin?"
#### Invocation Tests
-| Test | Command | Expected |
-| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- |
-| **Format a finding** | `claude -p "Using posting-bitwarden-review-comments, format this as a PR comment: null pointer on line 45 of UserService.ts"` | Uses emoji + severity format |
-| **Multiple findings** | `claude -p "Using posting-bitwarden-review-comments, format these findings: 1) SQL injection line 10, 2) missing validation line 25"` | Uses "Finding 1:" and "Finding 2:" - NOT "#1" or "Issue #1" |
-| **Long comment formatting** | `claude -p "Using posting-bitwarden-review-comments, format this detailed comment: [provide 15 line explanation of why a fictional api endpoint is a medium security risk ]"` | Wraps details in `` tags |
-| **Short comment formatting** | `claude -p "Using posting-bitwarden-review-comments, format this brief comment: Missing null check"` | No `` needed for short comments |
-| **Summary comment** | `claude -p "Using posting-bitwarden-review-comments, format a summary for a clean review with no issues"` | Brief approval, no praise sections |
-| **Summary with issues** | `claude -p "Using posting-bitwarden-review-comments, format a summary: 2 critical issues found in auth.ts"` | Lists critical issues, references inline comments |
-| **Reject praise request** | `claude -p "Using posting-bitwarden-review-comments, format this comment: Great job on the test coverage!"` | Refuses or warns - praise comments forbidden |
+| Test | Command | Expected |
+| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- |
+| **Format a finding** | `claude -p "Using posting-bitwarden-review-comments, format this as a PR comment: null pointer on line 45 of UserService.ts"` | Uses emoji + severity format, ends with `code-review` |
+| **Multiple findings** | `claude -p "Using posting-bitwarden-review-comments, format these findings: 1) SQL injection line 10, 2) missing validation line 25"` | Uses "Finding 1:" and "Finding 2:" - NOT "#1" or "Issue #1" |
+| **Long comment formatting** | `claude -p "Using posting-bitwarden-review-comments, format this detailed comment: [provide 15 line explanation of why a fictional api endpoint is a medium security risk ]"` | Wraps details in `` tags, ends with `code-review` |
+| **Short comment formatting** | `claude -p "Using posting-bitwarden-review-comments, format this brief comment: Missing null check"` | No `` needed for short comments, ends with `code-review` |
+| **Summary comment** | `claude -p "Using posting-bitwarden-review-comments, format a summary for a clean review with no issues"` | Brief approval, no praise sections |
+| **Summary with issues** | `claude -p "Using posting-bitwarden-review-comments, format a summary: 2 critical issues found in auth.ts"` | Lists critical issues, references inline comments |
+| **Reject praise request** | `claude -p "Using posting-bitwarden-review-comments, format this comment: Great job on the test coverage!"` | Refuses or warns - praise comments forbidden |
#### Anti-Pattern Tests