fix(bitwarden-code-review): grant git status where a local review is told to run it

[withinfocus]

🎟️ Tracking

Layer 1 of 4 in stack #221, bottom to top: #220, #217, #219, #218. The first three each bump bitwarden-code-review, so they merge in that order.

No Jira ticket. Noticed while auditing tool grants in bitwarden-code-review.

📔 Objective

code-review-local tells the reviewer to inspect the working tree with git diff and git status, and its README documents the same behavior. Neither the command's allowed-tools nor the agent's tools listed git status, so the call prompts or fails on the local path. performing-multi-agent-code-review already grants it, which is why the multi-agent path works and this one does not.

Adds Bash(git status:*) to both.

One thing this does not fix: the agent's local mode fetches only committed work, while the command promises "uncommitted and committed changes." That is a behavior change rather than a grant fix, so it is left alone here.

Version 1.14.0 to 1.14.1.

[github-actions]

Claude Code validation

Result: Pass

Validated PR #220 against origin/main — a version bump (1.14.0 → 1.14.1) for bitwarden-code-review plus the addition of Bash(git status:*) to the reviewer agent's tools and to the code-review-local command's allowed-tools. Plugin validation and the configuration and security review both ran; no skills changed, so skill review did not apply.

The new tool grant is read-only, prefix-scoped in the same shape as the existing Bash(git diff:*) / Bash(git log:*) grants, and matches an instruction already present in the command body (code-review-local.md:17 tells the agent to review local changes "using git diff and git status"). It is a widening the changeset justifies, so it is not a finding. No secrets, no settings.local.json, no new path from contributor input to a shell, and no prompt-injection content (CWE-1427) in any changed line.

Critical

None.

Major

None.

Minor

• plugins/bitwarden-code-review/CHANGELOG.md:8 — Patch bump conflicts with the plugin's own documented version policy. The "Version Format" section at the foot of this same file reserves minor for "new organizational patterns added to base guidelines, or new tool additions", and this change adds a tool grant the agent did not previously hold. Calling it a fix is defensible — the grant only enables behavior the command already instructs — which is why this is a warning rather than an error. Fix: either bump to 1.15.0 across .claude-plugin/marketplace.json, plugins/bitwarden-code-review/.claude-plugin/plugin.json, the README.md catalog row, plugins/bitwarden-code-review/agents/bitwarden-code-reviewer/AGENT.md:3, and the CHANGELOG heading; or keep 1.14.1 deliberately as a fix and clarify the "new tool additions" line so future grants are unambiguous.

Pre-existing (not counted against this changeset)

• plugins/bitwarden-code-review/commands/code-review-local/code-review-local.md:2 — argument-hint: [PR#] | [PR URL] is unquoted and is not valid YAML: [PR#] parses as a flow sequence, then | opens a block scalar. Confirmed with PyYAML, which raises ScannerError while scanning a block scalar. plugins/bitwarden-code-review/commands/code-review/code-review.md:2 has the same shape; these are the only two unquoted argument-hint values in the repository. Line 2 is untouched by this PR, so it is out of scope as a finding — raised only because if Claude Code's frontmatter parser is strict, the whole block including the allowed-tools line this PR edits would be discarded and the fix would be inert. Quoting the value (argument-hint: "[PR#] | [PR URL]") is a cheap, independently correct cleanup. The agent file's frontmatter parses cleanly.

What was validated

• Version consistency — 1.14.1 present in all four required locations (marketplace entry, plugin.json:3, README catalog row, AGENT.md:3); no stale 1.14.0 references remain in the plugin.
• Changelog — [1.14.1] - 2026-08-26 under ### Fixed, Keep a Changelog format, ordered correctly, and accurately describing both edits.
• Manifest — valid JSON, kebab-case name matching the directory and marketplace entry, valid semver, all agents and commands paths resolve.
• Frontmatter — AGENT.md parses as valid YAML with a valid model: opus; the command's allowed-tools remains a single well-formed scalar and the inserted entry does not break the embedded quoted "Bash(gh api graphql -f query=:*)".
• Tool grant scope — Bash(git status:*) cannot mutate the repository or post to GitHub, and does not intersect the plugin's unchanged deny list, which still blocks all gh write/merge/close operations. Both call paths that invoke git status are now covered.
• Security scan — no hardcoded credentials in any changed file, no settings file in the changeset, no bash-execution block and no argument interpolation into a shell string.
• Hooks / MCP — none present in this plugin; nothing to validate.

Checks run

Check	Status
Plugin structure	Skipped — run as a dedicated workflow step; see the job log and check status
Marketplace	Skipped — run as a dedicated workflow step; see the job log and check status
Version bump	Skipped — run as a dedicated workflow step; see the job log and check status
Plugin validation (AI)	Passed — 1 minor finding
Skill review (AI)	Skipped — no SKILL.md changed in this pull request
Configuration & security	Passed — agent and command definitions reviewed, no in-scope findings

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This adds Bash(git status:*) to the code-review-local command's allowed-tools and to the bitwarden-code-reviewer agent's tools, plus the 1.14.0 → 1.14.1 version bump and changelog entry. The grant is read-only and prefix-scoped in the same shape as the existing Bash(git diff:*) and Bash(git log:*) entries, and it is justified by the command body, which already instructs the reviewer to inspect the working tree with git status (code-review-local.md:17) and by the command README that documents the same behavior. Configuration review covered both changed files: no secrets, no settings.local.json, no new path from contributor input to a shell, and no instruction-injection content in any changed line. The version bump is applied consistently across marketplace.json, plugin.json, the README catalog, and the agent frontmatter, with no stale 1.14.0 references left behind.

No findings.