From 54ee06bcde6ba189f759d86d5206961c97c5f49e Mon Sep 17 00:00:00 2001 From: Patrick Honkonen Date: Thu, 22 Oct 2026 15:23:54 -0400 Subject: [PATCH 1/3] llm(bitwarden-code-review): label inline comments with their source --- .claude-plugin/marketplace.json | 2 +- README.md | 2 +- plugins/bitwarden-code-review/.claude-plugin/plugin.json | 2 +- plugins/bitwarden-code-review/CHANGELOG.md | 6 ++++++ .../agents/bitwarden-code-reviewer/AGENT.md | 2 +- .../skills/posting-bitwarden-review-comments/SKILL.md | 4 +++- 6 files changed, 13 insertions(+), 5 deletions(-) diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 30b3417f..659dff92 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -24,7 +24,7 @@ { "name": "bitwarden-code-review", "source": "./plugins/bitwarden-code-review", - "version": "2.4.0", + "version": "2.5.0", "description": "Comprehensive code review system with organization-wide standards." }, { diff --git a/README.md b/README.md index 5a937a40..50feb307 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ A curated collection of plugins for AI-assisted development at Bitwarden. Enable | [bitwarden-shepherd](plugins/bitwarden-shepherd/) | 1.0.1 | Champion of a technical strategy — shepherds a TSI through evaluation into the funnel, then through to adoption | | [bitwarden-adr-tools](plugins/bitwarden-adr-tools/) | 1.0.0 | Architecture Decision Record tools: checking designs and plans against the ADR catalog, locating and summarizing ADRs | | [bitwarden-atlassian-tools](plugins/bitwarden-atlassian-tools/) | 2.7.7 | Atlassian access via MCP server with deep Jira issue research skill and opt-in Jira write tools | -| [bitwarden-code-review](plugins/bitwarden-code-review/) | 2.4.0 | Autonomous code review agent following Bitwarden engineering standards with GitHub integration | +| [bitwarden-code-review](plugins/bitwarden-code-review/) | 2.5.0 | Autonomous code review agent following Bitwarden engineering standards with GitHub integration | | [bitwarden-delivery-tools](plugins/bitwarden-delivery-tools/) | 3.5.2 | Delivery lifecycle skills: initiative funnel navigation, work transitions, architectural judgment, feature flags, commits, PRs, preflight, labeling, Jira ticket filing | | [bitwarden-designer](plugins/bitwarden-designer/) | 0.1.0 | Product designer persona: Code of Conduct and 30/60/90 critique, critique facilitation; dispatches into bitwarden-design-tools | | [bitwarden-design-tools](plugins/bitwarden-design-tools/) | 0.1.0 | Design toolkit: content style guide, Figma Dev Mode MCP, Bitwarden brand application, handoff prep, Design System governance, Product and Design Jira | diff --git a/plugins/bitwarden-code-review/.claude-plugin/plugin.json b/plugins/bitwarden-code-review/.claude-plugin/plugin.json index 53334c7a..f4e13e61 100644 --- a/plugins/bitwarden-code-review/.claude-plugin/plugin.json +++ b/plugins/bitwarden-code-review/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "bitwarden-code-review", - "version": "2.4.0", + "version": "2.5.0", "description": "Comprehensive code review system with organization-wide standards.", "author": { "name": "Bitwarden", diff --git a/plugins/bitwarden-code-review/CHANGELOG.md b/plugins/bitwarden-code-review/CHANGELOG.md index 9a6b73c0..11511543 100644 --- a/plugins/bitwarden-code-review/CHANGELOG.md +++ b/plugins/bitwarden-code-review/CHANGELOG.md @@ -5,6 +5,12 @@ All notable changes to the Bitwarden Code Review Plugin will be documented in th The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [2.5.0] - 2026-10-22 + +### Changed + +- Inline comments and thread replies end with a `code-review` source line. claude-config-validator's `/validate-ai` posts under the same bot account, so without it a reader cannot tell which review raised a finding + ## [2.4.0] - 2026-10-12 ### Added diff --git a/plugins/bitwarden-code-review/agents/bitwarden-code-reviewer/AGENT.md b/plugins/bitwarden-code-review/agents/bitwarden-code-reviewer/AGENT.md index 6519934f..d08e4279 100644 --- a/plugins/bitwarden-code-review/agents/bitwarden-code-reviewer/AGENT.md +++ b/plugins/bitwarden-code-review/agents/bitwarden-code-reviewer/AGENT.md @@ -1,6 +1,6 @@ --- name: bitwarden-code-reviewer -version: 2.4.0 +version: 2.5.0 description: Conducts thorough code reviews following Bitwarden standards. Finds all issues first pass, avoids false positives, respects codebase conventions. Invoke when user mentions "code review", "review code", "review", "PR", or "pull request". model: opus skills: avoiding-false-positives, classifying-review-findings, posting-bitwarden-review-comments, posting-review-summary, reviewing-dependency-changes diff --git a/plugins/bitwarden-code-review/skills/posting-bitwarden-review-comments/SKILL.md b/plugins/bitwarden-code-review/skills/posting-bitwarden-review-comments/SKILL.md index ad99377a..919f6f4e 100644 --- a/plugins/bitwarden-code-review/skills/posting-bitwarden-review-comments/SKILL.md +++ b/plugins/bitwarden-code-review/skills/posting-bitwarden-review-comments/SKILL.md @@ -58,7 +58,7 @@ On a GitHub pull request, a finding raised again in an existing thread goes as a 5. Use collapsed sections for comments over 5 lines 6. Include both opening `
` AND closing `
` tags -**Visibility Rule:** Only severity + one-line description visible; everything else inside `
` tags. +**Visibility Rule:** Only severity + one-line description and the source line visible; everything else inside `
` tags. ### Template for long comments @@ -74,6 +74,8 @@ On a GitHub pull request, a finding raised again in an existing thread goes as a Reference: [docs link if applicable]
+ +code-review ``` ## Summary Output From 7a37d89c9b9dcb2078474a9aa64e4bbbaca8e51a Mon Sep 17 00:00:00 2001 From: Patrick Honkonen Date: Thu, 22 Oct 2026 16:53:44 -0400 Subject: [PATCH 2/3] Require the source line on every inline comment and expect it in the format tests --- .../posting-bitwarden-review-comments/SKILL.md | 1 + plugins/bitwarden-code-review/tests/TESTING.md | 18 +++++++++--------- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/plugins/bitwarden-code-review/skills/posting-bitwarden-review-comments/SKILL.md b/plugins/bitwarden-code-review/skills/posting-bitwarden-review-comments/SKILL.md index 919f6f4e..0544a579 100644 --- a/plugins/bitwarden-code-review/skills/posting-bitwarden-review-comments/SKILL.md +++ b/plugins/bitwarden-code-review/skills/posting-bitwarden-review-comments/SKILL.md @@ -57,6 +57,7 @@ On a GitHub pull request, a finding raised again in an existing thread goes as a 4. Be brief yet clear 5. Use collapsed sections for comments over 5 lines 6. Include both opening `
` AND closing `
` tags +7. End with the source line `code-review`, short comments and thread replies included **Visibility Rule:** Only severity + one-line description and the source line visible; everything else inside `
` tags. diff --git a/plugins/bitwarden-code-review/tests/TESTING.md b/plugins/bitwarden-code-review/tests/TESTING.md index d62330c5..27aaefbe 100644 --- a/plugins/bitwarden-code-review/tests/TESTING.md +++ b/plugins/bitwarden-code-review/tests/TESTING.md @@ -41,15 +41,15 @@ claude -p "What Claude Code skill are available in this plugin?" #### Invocation Tests -| Test | Command | Expected | -| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- | -| **Format a finding** | `claude -p "Using posting-bitwarden-review-comments, format this as a PR comment: null pointer on line 45 of UserService.ts"` | Uses emoji + severity format | -| **Multiple findings** | `claude -p "Using posting-bitwarden-review-comments, format these findings: 1) SQL injection line 10, 2) missing validation line 25"` | Uses "Finding 1:" and "Finding 2:" - NOT "#1" or "Issue #1" | -| **Long comment formatting** | `claude -p "Using posting-bitwarden-review-comments, format this detailed comment: [provide 15 line explanation of why a fictional api endpoint is a medium security risk ]"` | Wraps details in `
` tags | -| **Short comment formatting** | `claude -p "Using posting-bitwarden-review-comments, format this brief comment: Missing null check"` | No `
` needed for short comments | -| **Summary comment** | `claude -p "Using posting-bitwarden-review-comments, format a summary for a clean review with no issues"` | Brief approval, no praise sections | -| **Summary with issues** | `claude -p "Using posting-bitwarden-review-comments, format a summary: 2 critical issues found in auth.ts"` | Lists critical issues, references inline comments | -| **Reject praise request** | `claude -p "Using posting-bitwarden-review-comments, format this comment: Great job on the test coverage!"` | Refuses or warns - praise comments forbidden | +| Test | Command | Expected | +| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | +| **Format a finding** | `claude -p "Using posting-bitwarden-review-comments, format this as a PR comment: null pointer on line 45 of UserService.ts"` | Uses emoji + severity format, ends with `code-review` | +| **Multiple findings** | `claude -p "Using posting-bitwarden-review-comments, format these findings: 1) SQL injection line 10, 2) missing validation line 25"` | Uses "Finding 1:" and "Finding 2:" - NOT "#1" or "Issue #1" | +| **Long comment formatting** | `claude -p "Using posting-bitwarden-review-comments, format this detailed comment: [provide 15 line explanation of why a fictional api endpoint is a medium security risk ]"` | Wraps details in `
` tags, ends with `code-review` | +| **Short comment formatting** | `claude -p "Using posting-bitwarden-review-comments, format this brief comment: Missing null check"` | No `
` needed for short comments, ends with `code-review` | +| **Summary comment** | `claude -p "Using posting-bitwarden-review-comments, format a summary for a clean review with no issues"` | Brief approval, no praise sections | +| **Summary with issues** | `claude -p "Using posting-bitwarden-review-comments, format a summary: 2 critical issues found in auth.ts"` | Lists critical issues, references inline comments | +| **Reject praise request** | `claude -p "Using posting-bitwarden-review-comments, format this comment: Great job on the test coverage!"` | Refuses or warns - praise comments forbidden | #### Anti-Pattern Tests From 6c918b9ee924893ccc9f6886b77ab52238ef88a9 Mon Sep 17 00:00:00 2001 From: Patrick Honkonen Date: Fri, 23 Oct 2026 09:52:11 -0400 Subject: [PATCH 3/3] Scope the source line to GitHub pull requests --- plugins/bitwarden-code-review/CHANGELOG.md | 2 +- .../skills/posting-bitwarden-review-comments/SKILL.md | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/plugins/bitwarden-code-review/CHANGELOG.md b/plugins/bitwarden-code-review/CHANGELOG.md index 11511543..f68eeb38 100644 --- a/plugins/bitwarden-code-review/CHANGELOG.md +++ b/plugins/bitwarden-code-review/CHANGELOG.md @@ -9,7 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed -- Inline comments and thread replies end with a `code-review` source line. claude-config-validator's `/validate-ai` posts under the same bot account, so without it a reader cannot tell which review raised a finding +- Inline comments and thread replies on a GitHub pull request end with a `code-review` source line. claude-config-validator's `/validate-ai` posts under the same bot account, so without it a reader cannot tell which review raised a finding ## [2.4.0] - 2026-10-12 diff --git a/plugins/bitwarden-code-review/skills/posting-bitwarden-review-comments/SKILL.md b/plugins/bitwarden-code-review/skills/posting-bitwarden-review-comments/SKILL.md index 0544a579..0cb5720d 100644 --- a/plugins/bitwarden-code-review/skills/posting-bitwarden-review-comments/SKILL.md +++ b/plugins/bitwarden-code-review/skills/posting-bitwarden-review-comments/SKILL.md @@ -15,7 +15,7 @@ Check destinations **in this order** — use the first match: | Local target, no GitHub destination | The review target is local changes and no caller declared a GitHub destination | Write to `review-inline-comments.md` in working directory | | GitHub pull request | Neither of the above | Post via `mcp__github_inline_comment__create_inline_comment` | -Under either local destination, format every finding exactly as below and write them all to the one file — do not post, whatever comment tools happen to be available. +Under either local destination, format every finding exactly as below, without the source line, and write them all to the one file — do not post, whatever comment tools happen to be available. On a GitHub pull request, a finding raised again in an existing thread goes as a reply in that thread, so its history stays in one place. Call `mcp__github_replies__add_reply_to_pull_request_comment` with the `database_id` of the thread's first comment as `commentId`, the owner and repository from the threads data's top-level `repository`, and the pull request number as `pullNumber`, which the tool requires whenever a reply has a body. The reply uses the same finding format as an inline comment. When that tool is unavailable, the thread's first comment has no `database_id`, or the reply call fails, post a new inline comment instead. @@ -57,9 +57,9 @@ On a GitHub pull request, a finding raised again in an existing thread goes as a 4. Be brief yet clear 5. Use collapsed sections for comments over 5 lines 6. Include both opening `
` AND closing `
` tags -7. End with the source line `code-review`, short comments and thread replies included +7. On a GitHub pull request, end with the source line `code-review`, short comments and thread replies included -**Visibility Rule:** Only severity + one-line description and the source line visible; everything else inside `
` tags. +**Visibility Rule:** Only severity + one-line description and, on a GitHub pull request, the source line visible; everything else inside `
` tags. ### Template for long comments