Skip to content

POWER.md

Latest commit

 

History

History
177 lines (123 loc) · 7.71 KB

POWER.md

File metadata and controls

177 lines (123 loc) · 7.71 KB
Raw
name coderabbit
displayName CodeRabbit — AI code review
description Run CodeRabbit AI code reviews against local changes without leaving Kiro. Catches bugs, security issues, and style violations before you push or open a PR.
keywords
coderabbit
rabbit
code review
pr review
pull request review
review
ai review
ai code review
security review
pre-push
.coderabbit.yaml
author CodeRabbit

CodeRabbit Power

Overview

CodeRabbit is an AI code review platform trusted by production teams on GitHub, GitLab, Azure DevOps, and Bitbucket. This power lets Kiro drive the local coderabbit CLI to review your working tree, uncommitted changes, or a branch diff — returning structured findings the agent can act on immediately.

This power is CLI-native: it wraps the coderabbit review --agent command, which emits a well-defined newline-delimited JSON stream designed specifically for agent consumption. No MCP server is required, and no GitHub Personal Access Token is needed — authentication is handled by the CLI's own OAuth flow.

Key capabilities:

  • Uncommitted-change review: Review what you've edited before you commit.
  • Committed-only review: Review just what's new vs. the base branch.
  • Full-diff review: Review everything that differs from main (or any base).
  • File-scoped review: Focus the review on specific files.
  • Agent-friendly output: Structured NDJSON stream with per-finding events, severity levels, and codegen-ready fix instructions.

Prerequisites

  1. Install the CodeRabbit CLI (macOS/Linux): 
    curl -fsSL https://cli.coderabbit.ai/install.sh | sh
  2. Authenticate (opens a browser once): 
    coderabbit auth login
  3. Confirm you're signed in: 
    coderabbit auth status

If coderabbit auth status reports an authenticated user, this power is ready to use. Otherwise, Kiro should stop and ask the human to run coderabbit auth login — the agent cannot complete the OAuth flow on the user's behalf.

How to invoke

The CLI is the single integration point. Always run from the root of a git repository.

The canonical invocation

coderabbit review --agent --base main
  • --agent switches stdout to newline-delimited JSON events.
  • --base <branch> names the branch to diff against (defaults to the repository's default base).
  • Add -t uncommitted to scope to unstaged/staged-but-uncommitted changes only.
  • Add -t committed to scope to new commits on the current branch.
  • Add -t all (default) to review everything that differs from the base.
  • Add -f <file> [<file> ...] to scope to specific files.

Reading the stream

Every line of stdout is a JSON object. The full schema is documented in steering/agent-event-schema.md. The five event type values are:

type When it appears What the agent does
review_context First, once Confirm repo, base, and review type.
status Repeated Update user on progress (connecting → setup → analyzing).
finding Zero or more The actionable unit. Contains severity, fileName, codegenInstructions, suggestions.
error On failure Distinguish auth/rate_limit/network errors; recover or escalate.
complete Last, once Terminal success; carries findings: N.

See steering/review-workflow.md for the full recipe, including how to turn a finding into a concrete code edit.

Common workflows

Workflow 1: Review before push

coderabbit review --agent --base main -t committed

Triggered when the user says something like "review my changes before I push" or "what would CodeRabbit say about this PR?". Treat every finding with severity at or above major as blocking; present minor and suggestion findings as optional improvements.

Workflow 2: Review uncommitted edits

coderabbit review --agent -t uncommitted

Triggered when the user says "is my WIP clean?" or "check what I've changed". Especially useful right before git commit.

Workflow 3: Scoped file review

coderabbit review --agent -f src/auth.ts src/session.ts

Triggered when the user names specific files. Faster than full-diff reviews and produces focused output.

Workflow 4: Apply a CodeRabbit fix

When a finding includes non-empty codegenInstructions, that text is a self-contained prompt describing the fix. The agent should:

  1. Read the file at fileName.
  2. Apply the change described in codegenInstructions, using suggestions[] as reference patches when present.
  3. Re-run the review with -f <fileName> to confirm the finding is resolved.

Best Practices

✅ Do

  • Run from the repo root. The CLI uses git to compute diffs and expects to be inside a working tree.
  • Parse NDJSON line-by-line. Do not wait for the whole stream; start acting on findings as they arrive.
  • Respect severity. Escalate critical and major; treat minor/suggestion as optional polish.
  • Use codegenInstructions verbatim. It's already authored for agent consumption.
  • Fall back gracefully on error events. error.errorType === "auth" means the user must re-run coderabbit auth login; do not retry silently.

❌ Don't

  • Don't run coderabbit review without --agent when the agent is consuming the output. The plain-text mode is for humans.
  • Don't pipe the output through formatters that break line boundaries.
  • Don't invent new flags. The CLI surface is stable; if a flag isn't listed here, check coderabbit review --help.
  • Don't prompt the user for a GitHub PAT. This power does not require one; that's a community-MCP-server convention, not a CodeRabbit requirement.

Configuration

No configuration is required beyond installing the CLI and authenticating. The CLI persists its OAuth token in the user's local config directory; the coderabbit binary is expected to be on PATH.

Optional repository-level configuration lives in .coderabbit.yaml at the repo root. If the user asks to tune review behavior (severity thresholds, path filters, review profile), edit that file. The schema is documented at https://docs.coderabbit.ai/reference/yaml-template.

Troubleshooting

coderabbit: command not found

Cause: CLI not installed or not on PATH. Fix: Run the installer from the Prerequisites section and reopen your terminal.

error event with errorType: "auth"

Cause: Missing or expired OAuth token. Fix: Ask the user to run coderabbit auth login. Do not attempt to authenticate programmatically.

error event with errorType: "rate_limit"

Cause: Org has exceeded the free-tier review budget. Fix: Surface metadata.policyGuidance (CodeRabbit's server-provided hint) to the user. Do not retry on a timer; wait for the user to decide.

Stream hangs on status without emitting finding or complete

Cause: The review service is still warming up, or the repository is large. Fix: Keep reading; treat a 2+ minute silence as suspicious and suggest rerunning with -f <file> to narrow the scope.

Review runs but reports zero findings on a change you know has issues

Cause: The wrong review -t was selected, or the base branch isn't where the user expected. Fix: Inspect the first review_context event — it echoes back reviewType, currentBranch, baseBranch. If they're wrong, rerun with explicit flags.

Resources

License: Apache-2.0