Add feedback prompt back to code review comments

Restore the 👍/👎 feedback CTA to help gather signal on
code review usefulness.

CHANGELOG.md

@@ -1,33 +1,5 @@
 # Changelog
 
-## 2.0.74
-
-- Added LSP (Language Server Protocol) tool for code intelligence features like go-to-definition, find references, and hover documentation
-- Added `/terminal-setup` support for Kitty, Alacritty, Zed, and Warp terminals
-- Added ctrl+t shortcut in `/theme` to toggle syntax highlighting on/off
-- Added syntax highlighting info to theme picker
-- Added guidance for macOS users when Alt shortcuts fail due to terminal configuration
-- Fixed skill `allowed-tools` not being applied to tools invoked by the skill
-- Fixed Opus 4.5 tip incorrectly showing when user was already using Opus
-- Fixed a potential crash when syntax highlighting isn't initialized correctly
-- Fixed visual bug in `/plugins discover` where list selection indicator showed while search box was focused
-- Fixed macOS keyboard shortcuts to display 'opt' instead of 'alt'
-- Improved `/context` command visualization with grouped skills and agents by source, slash commands, and sorted token count
-- [Windows] Fixed issue with improper rendering
-- [VSCode] Added gift tag pictogram for year-end promotion message
-
-## 2.0.73
-
-- Added clickable `[Image #N]` links that open attached images in the default viewer
-- Added alt-y yank-pop to cycle through kill ring history after ctrl-y yank
-- Added search filtering to the plugin discover screen (type to filter by name, description, or marketplace)
-- Added support for custom session IDs when forking sessions with `--session-id` combined with `--resume` or `--continue` and `--fork-session`
-- Fixed slow input history cycling and race condition that could overwrite text after message submission
-- Improved `/theme` command to open theme picker directly
-- Improved theme picker UI
-- Improved search UX across resume session, permissions, and plugins screens with a unified SearchBox component
-- [VSCode] Added tab icon badges showing pending permissions (blue) and unread completions (orange)
-
 ## 2.0.72
 
 - Added Claude in Chrome (Beta) feature that works with the Chrome extension (https://claude.ai/chrome) to let you control your browser directly from Claude Code
@@ -56,6 +28,7 @@
 - Added Enter key to accept and submit prompt suggestions immediately (tab still accepts for editing)
 - Added wildcard syntax `mcp__server__*` for MCP tool permissions to allow or deny all tools from a server
 - Added auto-update toggle for plugin marketplaces, allowing per-marketplace control over automatic updates
+- Added `plan_mode_required` spawn parameter for teammates to require plan approval before implementing changes
 - Added `current_usage` field to status line input, enabling accurate context window percentage calculations
 - Fixed input being cleared when processing queued commands while the user was typing
 - Fixed prompt suggestions replacing typed input when pressing Tab

plugins/code-review/commands/code-review.md

@@ -52,22 +52,25 @@ Note: Still review Claude generated PR's.
 
 6. Filter out any issues that were not validated in step 5. This step will give us our list of high signal issues for our review.
 
-7. If issues were found, skip to step 8 to post inline comments directly.
+7. Post summary comment FIRST using `gh pr comment` (if `--comment` argument is provided):
+   - Total number of issues found
+   - Brief one-line summary of each issue (no "Bug:" prefix)
+   - Or if no issues: "No issues found. Checked for bugs and CLAUDE.md compliance."
 
-   If NO issues were found, post a summary comment using `gh pr comment` (if `--comment` argument is provided):
-   "No issues found. Checked for bugs and CLAUDE.md compliance."
+   When writing your comment, follow these guidelines:
+   a. Keep your output brief
+   b. Avoid emojis
+   c. Link and cite relevant code, files, and URLs for each issue
+   d. When citing CLAUDE.md violations, you MUST quote the exact text from CLAUDE.md that is being violated (e.g., CLAUDE.md says: "Use snake_case for variable names")
 
-8. Post inline comments for each issue using `mcp__github_inline_comment__create_inline_comment`:
+8. THEN post inline comments for each issue using `mcp__github_inline_comment__create_inline_comment`:
    - `path`: the file path
    - `line` (and `startLine` for ranges): select the buggy lines so the user sees them
    - `body`: Brief description of the issue (no "Bug:" prefix). For small fixes (up to 5 lines changed), include a committable suggestion:
      ```suggestion
      corrected code here
      ```
-
-     **Suggestions must be COMPLETE.** If a fix requires additional changes elsewhere (e.g., renaming a variable requires updating all usages), do NOT use a suggestion block. The author should be able to click "Commit suggestion" and have a working fix - no followup work required.
-
-     For larger fixes (6+ lines, structural changes, or changes spanning multiple locations), do NOT use suggestion blocks. Instead:
+     For larger fixes (6+ lines or structural changes), do NOT use suggestion blocks. Instead:
      1. Describe what the issue is
      2. Explain the suggested fix at a high level
      3. Include a copyable prompt for Claude Code that the user can use to fix the issue, formatted as:
@@ -90,18 +93,44 @@ Notes:
 
 - Use gh CLI to interact with GitHub (e.g., fetch pull requests, create comments). Do not use web fetch.
 - Create a todo list before starting.
-- You must cite and link each issue in inline comments (e.g., if referring to a CLAUDE.md, include a link to it).
-- If no issues are found, post a comment with the following format:
+- You must cite and link each issue (e.g., if referring to a CLAUDE.md, include a link to it).
+- For your final comment, follow the following format precisely (assuming for this example that you found 3 issues):
 
 ---
 
 ## Code review
 
-No issues found. Checked for bugs and CLAUDE.md compliance.
+Found 3 issues:
+
+1. <brief description of bug> (CLAUDE.md says: "<exact quote from CLAUDE.md>")
+
+<link to file and line with full sha1 + line range for context, eg. https://github.com/anthropics/claude-code/blob/1d54823877c4de72b2316a64032a54afc404e619/README.md#L13-L17>
+
+2. <brief description of bug> (some/other/CLAUDE.md says: "<exact quote from CLAUDE.md>")
+
+<link to file and line with full sha1 + line range for context>
+
+3. <brief description of bug> (bug due to <file and code snippet>)
+
+<link to file and line with full sha1 + line range for context>
+
+<sub>If this code review was useful, please react with 👍. Otherwise, react with 👎.</sub>
 
 ---
 
-- When linking to code in inline comments, follow the following format precisely, otherwise the Markdown preview won't render correctly: https://github.com/anthropics/claude-code/blob/c21d3c10bc8e898b7ac1a2d745bdc9bc4e423afe/package.json#L10-L15
+- Or, if you found no issues:
+
+---
+
+## Auto code review
+
+No issues found. Checked for bugs and CLAUDE.md compliance.
+
+<sub>If this code review was useful, please react with 👍. Otherwise, react with 👎.</sub>
+
+---
+
+- When linking to code, follow the following format precisely, otherwise the Markdown preview won't render correctly: https://github.com/anthropics/claude-code/blob/c21d3c10bc8e898b7ac1a2d745bdc9bc4e423afe/package.json#L10-L15
   - Requires full git sha
   - You must provide the full sha. Commands like `https://github.com/owner/repo/blob/$(git rev-parse HEAD)/foo/bar` will not work, since your comment will be directly rendered in Markdown.
   - Repo name must match the repo you're code reviewing

plugins/plugin-dev/skills/mcp-integration/references/authentication.md

@@ -264,139 +264,6 @@ EOF
 - Time-based authentication
 - Dynamic tenant/workspace selection
 
-### TTL Configuration
-
-By default, dynamically generated API keys are cached for 5 minutes. Configure the TTL with:
-
-```bash
-export CLAUDE_CODE_API_KEY_HELPER_TTL_MS=300000  # 5 minutes (default)
-```
-
-### Writing Robust Helper Scripts
-
-Helper scripts can cause issues if they hang or fail repeatedly. Follow these best practices to prevent infinite retry loops and connection hangs:
-
-**1. Always set timeouts on network operations:**
-```bash
-#!/bin/bash
-# get-token.sh - Robust token fetcher
-
-# Set a timeout for the entire script
-TIMEOUT_SECONDS=10
-
-# Use timeout for network calls
-TOKEN=$(timeout ${TIMEOUT_SECONDS}s curl -s --max-time ${TIMEOUT_SECONDS} \
-  "https://auth.example.com/token" 2>/dev/null)
-
-if [ -z "$TOKEN" ] || [ "$TOKEN" = "null" ]; then
-  # Exit with error - don't output invalid JSON
-  echo "Failed to fetch token" >&2
-  exit 1
-fi
-
-echo "{\"Authorization\": \"Bearer $TOKEN\"}"
-```
-
-**2. Handle VPN/network dependency failures:**
-```bash
-#!/bin/bash
-# get-headers.sh - VPN-aware token fetcher
-
-# Quick connectivity check before attempting auth
-if ! timeout 2s ping -c 1 vpn-dependent-service.internal >/dev/null 2>&1; then
-  echo "VPN not connected or service unreachable" >&2
-  exit 1
-fi
-
-# Proceed with token fetch (with timeout)
-TOKEN=$(timeout 10s get-token-from-vpn-service)
-
-if [ $? -ne 0 ] || [ -z "$TOKEN" ]; then
-  echo "Token fetch failed" >&2
-  exit 1
-fi
-
-echo "{\"Authorization\": \"Bearer $TOKEN\"}"
-```
-
-**3. Cache tokens locally to reduce network calls:**
-```bash
-#!/bin/bash
-# get-headers-cached.sh - Token fetcher with local caching
-
-CACHE_FILE="${HOME}/.cache/my-api-token"
-CACHE_MAX_AGE=240  # seconds (refresh before 5min TTL)
-
-# Check cache validity
-if [ -f "$CACHE_FILE" ]; then
-  CACHE_AGE=$(($(date +%s) - $(stat -c %Y "$CACHE_FILE" 2>/dev/null || stat -f %m "$CACHE_FILE")))
-  if [ "$CACHE_AGE" -lt "$CACHE_MAX_AGE" ]; then
-    cat "$CACHE_FILE"
-    exit 0
-  fi
-fi
-
-# Fetch new token with timeout
-TOKEN=$(timeout 10s fetch-new-token 2>/dev/null)
-
-if [ -z "$TOKEN" ]; then
-  # If fetch fails, try to use expired cache as fallback
-  if [ -f "$CACHE_FILE" ]; then
-    echo "Warning: Using expired cached token" >&2
-    cat "$CACHE_FILE"
-    exit 0
-  fi
-  echo "Failed to fetch token and no cache available" >&2
-  exit 1
-fi
-
-# Update cache
-mkdir -p "$(dirname "$CACHE_FILE")"
-echo "{\"Authorization\": \"Bearer $TOKEN\"}" > "$CACHE_FILE"
-cat "$CACHE_FILE"
-```
-
-**4. Fail fast with clear error messages:**
-```bash
-#!/bin/bash
-set -e  # Exit on any error
-
-# Check prerequisites before attempting network calls
-if [ -z "$API_SECRET" ]; then
-  echo "API_SECRET environment variable not set" >&2
-  exit 1
-fi
-
-# Use short timeouts to fail fast
-TOKEN=$(timeout 5s curl -sf --max-time 5 \
-  -H "X-Secret: $API_SECRET" \
-  "https://auth.example.com/token") || {
-  echo "Token request failed or timed out" >&2
-  exit 1
-}
-
-echo "{\"Authorization\": \"Bearer $TOKEN\"}"
-```
-
-### Troubleshooting Helper Scripts
-
-**Infinite retry loop / hanging:**
-- Add timeouts to all network operations
-- Use `set -e` to exit on errors
-- Check VPN/network connectivity before making requests
-- Ensure script outputs valid JSON or exits with error code
-
-**Script takes too long:**
-- Use `timeout` command wrapper
-- Set `--max-time` on curl requests
-- Consider caching tokens locally
-- Reduce TTL if tokens refresh too slowly
-
-**VPN-dependent helpers failing:**
-- Add connectivity check at start of script
-- Implement graceful degradation with cached tokens
-- Log clear error messages to stderr
-
 ## Security Best Practices
 
 ### DO