@alibaba-group/open-code-review 1.3.14 → 1.3.19

package/plugins/open-code-review/commands/review.md

@@ -1,35 +0,0 @@
----
-description: Run OpenCodeReview (OCR) to review code changes and autonomously apply fixes.
----
-
-Invoke the professional code review Agent CLI tool OpenCodeReview (OCR) to review current code changes, and let the Agent autonomously decide whether to apply fixes.
-
-## Workflow
-
-### Step 1: Run Code Review
-
-Run the OCR command:
-
-```bash
-ocr review --audience agent [user-args]
-```
-- Default (no user arguments): reviews staged, unstaged, and untracked changes (workspace mode).
-- If the user provides `--commit` or `--c`: pass through as-is.
-- If the user provides `--from` and `--to`: pass through as-is.
-- (Optional) Provide `--background "requirement context"` to review whether the requirements are correctly implemented.
-- Capture full stdout. Set a 5-minute timeout.
-- If the `ocr` command is not found, install it by running `npm i -g @alibaba-group/open-code-review`.
-
-### Step 2: Filter and Evaluate
-
-For each comment, assess its validity and quality:
-
-- **High**: Obvious bugs, security issues, clear mistakes, or well-founded suggestions with precise fix proposals
-- **Medium**: Reasonable concerns but context-dependent, style/performance suggestions, or fixes that require manual implementation
-- **Low**: Likely false positives, lacking sufficient context, nitpicks, or meaningless suggestions
-
-Silently discard low-confidence comments. Display the remaining comments.
-
-### Step 3: Fix
-
-Automatically fix issues and suggestions that are worth adopting.

package/plugins/open-code-review/skills/open-code-review/SKILL.md

@@ -1,236 +0,0 @@
----
-name: open-code-review
-description: >
-  Performs AI-powered code review on Git changes using the `ocr` CLI from
-  alibaba/open-code-review. Use when the user asks to review code, review
-  a pull request, review staged/unstaged changes, review a commit, or
-  compare branches for code quality issues. Produces line-level review
-  comments and can automatically apply fixes when requested. With appropriate
-  review rules, can detect various types of issues including bugs, security
-  vulnerabilities, performance problems, and code quality concerns.
-license: Apache-2.0
-compatibility: >
-  Requires the `ocr` CLI installed (via `npm install -g
-  @alibaba-group/open-code-review` or GitHub release binary). Requires a
-  configured LLM (Anthropic or OpenAI-compatible) before first run.
-metadata:
-  author: alibaba
-  homepage: https://github.com/alibaba/open-code-review
-  version: "1.0.0"
----
-
-# Open Code Review
-
-This Codex plugin skill intentionally mirrors the canonical skill at
-`skills/open-code-review/SKILL.md`. Keep both files synchronized when updating
-OCR agent instructions; a symlink is avoided because plugin installs may only
-materialize the plugin subtree.
-
-A skill for invoking [open-code-review](https://github.com/alibaba/open-code-review) (`ocr`) — an open-source AI code review CLI that reads Git diffs and generates structured, line-level review comments.
-
-## Prerequisites check
-
-Before starting a review, verify the environment:
-
-```bash
-# 1. Check the CLI is installed
-which ocr || echo "NOT INSTALLED"
-
-# 2. Verify LLM connectivity
-ocr llm test
-```
-
-If `ocr` is not installed, install it first:
-
-```bash
-npm install -g @alibaba-group/open-code-review
-```
-
-If `ocr llm test` fails, the user must configure an LLM. Guide them with one of these options:
-
-**Option A — Environment variables (highest priority, recommended for CI):**
-
-```bash
-export OCR_LLM_URL=https://api.anthropic.com/v1/messages
-export OCR_LLM_TOKEN=<api-key>
-export OCR_LLM_MODEL=claude-opus-4-6
-export OCR_USE_ANTHROPIC=true
-```
-
-**Option B — Persistent config:**
-
-```bash
-ocr config set llm.url https://api.anthropic.com/v1/messages
-ocr config set llm.auth_token <api-key>
-ocr config set llm.model claude-opus-4-6
-ocr config set llm.use_anthropic true
-```
-
-Stop here and ask the user to provide credentials — never invent or hardcode API keys.
-
-## Workflow
-
-### Step 1: Gather Business Context
-
-Analyze the review target (commits, branch, or changes) to extract concise business context. Pass this context via `--background` to improve review quality.
-
-### Step 2: Run Code Review
-
-Run the OCR command with appropriate flags. **Always pass business context via `--background`** when available:
-
-```bash
-ocr review --audience agent --background "business context here" [user-args]
-```
-
-**Argument handling:**
-
-- **Background context** (RECOMMENDED): use `--background "context"` or `-b "context"` to provide business context for better review quality
-- **Default** (no user arguments): reviews staged, unstaged, and untracked changes (workspace mode)
-- **Specific commit**: use `--commit` or `-c` to review a single commit against its parent
-- **Branch comparison**: use `--from <ref>` and `--to <ref>` to review diff between two refs
-- **Timeout**: default timeout is 10 minutes per file; adjust with `--timeout <minutes>`
-- **Concurrency**: default concurrency is 8 file workers; reduce with `--concurrency <n>` if rate limits are hit
-- **Preview mode**: use `--preview` or `-p` to preview which files will be reviewed without running the LLM
-- **Installation**: if `ocr` command is not found, install it by running `npm i -g @alibaba-group/open-code-review`
-
-**Common invocation patterns:**
-
-| User says | Command to run |
-|-----------|---------------|
-| "review my changes" / "review the working copy" | `ocr review --audience agent -b "context"` |
-| "review this PR" / "review feature branch" | `ocr review --audience agent -b "context" --from main --to <branch>` |
-| "review commit abc123" | `ocr review --audience agent -b "context" --commit abc123` |
-| "what would be reviewed?" (dry-run) | `ocr review --preview` |
-
-**Output mode:**
-
-- Always use `--audience agent` to suppress progress UI and emit only the final summary
-
-### Step 3: Classify and Report
-
-For each comment from the review output, classify by priority and report all issues to the user:
-
-- **High**: Obvious bugs, security issues, clear mistakes, or well-founded suggestions with precise fix proposals
-- **Medium**: Reasonable concerns but context-dependent, style/performance suggestions, or fixes that require manual implementation
-- **Low**: Likely false positives, lacking sufficient context, nitpicks, or meaningless suggestions
-
-Report all comments grouped by priority level.
-
-### Step 4: Fix
-
-Before applying fixes, check whether the user requested automatic fixes:
-
-- If the user explicitly requested "review and fix" or similar, proceed with automatic fixes
-- If the user only requested "review" without fix intent, ask for permission before applying any changes
-
-When fixing issues and suggestions:
-
-- Focus on High and Medium priority items
-- Apply fixes directly to the code when safe and well-defined
-- For complex fixes requiring manual intervention, clearly describe what needs to be done
-- Always verify fixes with the user before committing
-
-## Output Format
-
-Each comment contains:
-
-- `path`: File path
-- `content`: Review comment text
-- `start_line` / `end_line`: Line range (both 0 means positioning failed)
-- `suggestion_code`: Optional fix suggestion
-- `existing_code`: Optional original code snippet
-- `thinking`: Optional LLM reasoning process
-
-After filtering comments by priority, present results using this template:
-
-```markdown
-## Code Review Results
-
-**Files reviewed**: N
-**Issues found**: X high priority / Y medium priority
-
-### High Priority
-
-- **`path/to/file.java:42`** — Brief description
-  > Recommendation: How to fix
-
-### Medium Priority
-
-- **`path/to/file.ts:88`** — Brief description
-  > Recommendation: How to fix (if applicable)
-```
-
-If the review found no issues after filtering, simply state: "Review complete — no issues found in N files."
-
-**Priority classification:**
-
-- **High**: Obvious bugs, security issues, clear mistakes, or well-founded suggestions with precise fix proposals
-- **Medium**: Reasonable concerns but context-dependent, style/performance suggestions, or fixes that require manual implementation
-- **Low**: Discarded silently (likely false positives, lacking context, nitpicks, or meaningless suggestions)
-
-**Handling mispositioned comments:**
-
-When `start_line` and `end_line` are both `0`, the comment failed to locate the exact position in the file. In such cases:
-
-1. Read the comment content to understand the issue
-2. Examine the target file mentioned in the comment
-3. Identify the relevant code section based on the comment's context
-4. Apply the fix or suggestion to the correct location
-
-## Custom Review Rules
-
-If the user wants project-specific rules, OCR resolves them in this priority order:
-
-1. `--rule <path>` flag (highest)
-2. `<repo>/.opencodereview/rule.json`
-3. `~/.opencodereview/rule.json`
-4. Built-in system defaults (lowest)
-
-Rule file format:
-
-```json
-{
-  "rules": [
-    {
-      "path": "**/*.java",
-      "rule": "All new methods must validate required parameters for null"
-    },
-    {
-      "path": "**/*mapper*.xml",
-      "rule": "Check SQL for injection risks and missing closing tags"
-    }
-  ]
-}
-```
-
-To preview which rule applies to a file before reviewing:
-
-```bash
-ocr rules check src/main/java/com/example/Foo.java
-```
-
-## Gotchas
-
-- **LLM must be configured first** — `ocr review` will fail loudly if no LLM is reachable. Always run `ocr llm test` before the first review.
-- **Working directory matters** — `ocr review` operates on the Git repo at the current directory. Use `--repo /path/to/repo` to run from elsewhere.
-- **Untracked files are reviewed in workspace mode** — running bare `ocr review` includes staged, unstaged, *and* untracked changes. Stage selectively if you want narrower scope.
-- **Large diffs may hit token limits** — files with very large diffs may be truncated. The default `MAX_TOKENS` is 58888 per request.
-- **Plan phase triggers at 50 lines** — diffs exceeding 50 changed lines run an extra risk-analysis phase before main review. This adds latency but improves quality.
-- **Don't pass `--audience human`** — it streams progress UI that pollutes output. Always use `--audience agent`.
-- **Comment language follows config** — set `language` config to `English` or `Chinese` (default: Chinese) to control review comment language.
-
-## Validation
-
-After the review completes, verify success by checking:
-
-1. The command exited with code 0
-2. Comments were generated (or "No comments generated" message appears)
-3. Warnings (if any) are displayed in stderr
-
-If errors occurred, check the stderr warnings for details about which files failed and why.
-
-## References
-
-- Full docs: https://github.com/alibaba/open-code-review
-- NPM package: https://www.npmjs.com/package/@alibaba-group/open-code-review
-- Issue tracker: https://github.com/alibaba/open-code-review/issues

package/scripts/github-actions/post-review-comments.test.js

@@ -1,171 +0,0 @@
-#!/usr/bin/env node
-"use strict";
-
-const assert = require("assert");
-const fs = require("fs");
-const path = require("path");
-const vm = require("vm");
-
-const repoRoot = path.join(__dirname, "..", "..");
-const workflowFiles = [
-  ".github/workflows/ocr-review.yml",
-  "examples/github_actions/ocr-review.yml",
-];
-
-function extractPostReviewScript(workflowPath) {
-  const text = fs.readFileSync(path.join(repoRoot, workflowPath), "utf8");
-  const lines = text.split("\n");
-
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    const marker = line.match(/^(\s*)script:\s*\|\s*$/);
-    if (!marker) continue;
-
-    const blockIndent = marker[1].length + 2;
-    const block = [];
-    for (let j = i + 1; j < lines.length; j++) {
-      const current = lines[j];
-      if (current.trim() === "") {
-        block.push("");
-        continue;
-      }
-      const indent = current.match(/^ */)[0].length;
-      if (indent < blockIndent) break;
-      block.push(current.slice(blockIndent));
-    }
-
-    const script = block.join("\n");
-    if (script.includes("/tmp/ocr-result.json")) {
-      return script;
-    }
-  }
-
-  throw new Error(`post review script not found in ${workflowPath}`);
-}
-
-function mockFs(resultText, stderrText) {
-  return {
-    readFileSync(file) {
-      if (file === "/tmp/ocr-result.json") return resultText;
-      if (file === "/tmp/ocr-stderr.log") return stderrText;
-      throw new Error(`unexpected read: ${file}`);
-    },
-  };
-}
-
-function mockGithub(options) {
-  const createReviewCalls = [];
-  const issueComments = [];
-
-  return {
-    createReviewCalls,
-    issueComments,
-    rest: {
-      pulls: {
-        get: async () => ({ data: { head: { sha: "head-sha" } } }),
-        createReview: async (params) => {
-          createReviewCalls.push(params);
-          if (createReviewCalls.length === 1 && options.bulkError) {
-            throw new Error(options.bulkError);
-          }
-          if (createReviewCalls.length > 1 && options.individualError) {
-            throw new Error(options.individualError);
-          }
-          return { data: {} };
-        },
-      },
-      issues: {
-        createComment: async (params) => {
-          issueComments.push(params);
-          return { data: {} };
-        },
-      },
-    },
-  };
-}
-
-async function runPostReviewScript(workflowPath, options) {
-  const script = extractPostReviewScript(workflowPath);
-  const github = mockGithub(options);
-  const context = {
-    repo: { owner: "owner", repo: "repo" },
-    issue: { number: 123 },
-    eventName: "pull_request_target",
-    payload: { pull_request: { head: { sha: "head-sha" } } },
-  };
-  const sandbox = {
-    github,
-    context,
-    console: { log() {} },
-    require(name) {
-      if (name === "fs") return options.fs;
-      throw new Error(`unexpected require: ${name}`);
-    },
-  };
-
-  await vm.runInNewContext(`(async () => {\n${script}\n})()`, sandbox, {
-    timeout: 1000,
-  });
-
-  return github;
-}
-
-async function testFailedInlineCommentsAreSummarized(workflowPath) {
-  const result = {
-    comments: [
-      {
-        path: "docs/no-line.md",
-        content:
-          "No-line content with a fenced block:\n\n```js\nconsole.log('still visible');\n```",
-        existing_code: "",
-        suggestion_code: "",
-        start_line: 0,
-        end_line: 0,
-      },
-      {
-        path: "src/app.js",
-        content: "Failed inline content must remain visible in the PR summary.",
-        existing_code: "oldCall();",
-        suggestion_code: "newCall();",
-        start_line: 10,
-        end_line: 10,
-      },
-    ],
-    warnings: [],
-  };
-
-  const github = await runPostReviewScript(workflowPath, {
-    fs: mockFs(JSON.stringify(result), ""),
-    bulkError: 'Unprocessable Entity: "Line could not be resolved"',
-    individualError: 'Unprocessable Entity: "Line could not be resolved"',
-  });
-
-  assert.strictEqual(github.createReviewCalls.length, 2);
-  assert.strictEqual(github.issueComments.length, 1);
-  const body = github.issueComments[0].body;
-  assert.match(body, /No-line content with a fenced block/);
-  assert.match(body, /Failed inline content must remain visible/);
-  assert.match(body, /Line could not be resolved/);
-}
-
-async function testErrorCommentUsesSafeFence(workflowPath) {
-  const github = await runPostReviewScript(workflowPath, {
-    fs: mockFs("not json", "stderr includes a fence\n```js\nbroken();\n```"),
-  });
-
-  assert.strictEqual(github.issueComments.length, 1);
-  const body = github.issueComments[0].body;
-  assert.match(body, /\n````\nstderr includes a fence/);
-}
-
-async function main() {
-  for (const workflowPath of workflowFiles) {
-    await testFailedInlineCommentsAreSummarized(workflowPath);
-    await testErrorCommentUsesSafeFence(workflowPath);
-  }
-}
-
-main().catch((err) => {
-  console.error(err);
-  process.exit(1);
-});

package/skills/open-code-review/SKILL.md

@@ -1,231 +0,0 @@
----
-name: open-code-review
-description: >
-  Performs AI-powered code review on Git changes using the `ocr` CLI from
-  alibaba/open-code-review. Use when the user asks to review code, review
-  a pull request, review staged/unstaged changes, review a commit, or
-  compare branches for code quality issues. Produces line-level review
-  comments and can automatically apply fixes when requested. With appropriate
-  review rules, can detect various types of issues including bugs, security
-  vulnerabilities, performance problems, and code quality concerns.
-license: Apache-2.0
-compatibility: >
-  Requires the `ocr` CLI installed (via `npm install -g
-  @alibaba-group/open-code-review` or GitHub release binary). Requires a
-  configured LLM (Anthropic or OpenAI-compatible) before first run.
-metadata:
-  author: alibaba
-  homepage: https://github.com/alibaba/open-code-review
-  version: "1.0.0"
----
-
-# Open Code Review
-
-A skill for invoking [open-code-review](https://github.com/alibaba/open-code-review) (`ocr`) — an open-source AI code review CLI that reads Git diffs and generates structured, line-level review comments.
-
-## Prerequisites check
-
-Before starting a review, verify the environment:
-
-```bash
-# 1. Check the CLI is installed
-which ocr || echo "NOT INSTALLED"
-
-# 2. Verify LLM connectivity
-ocr llm test
-```
-
-If `ocr` is not installed, install it first:
-
-```bash
-npm install -g @alibaba-group/open-code-review
-```
-
-If `ocr llm test` fails, the user must configure an LLM. Guide them with one of these options:
-
-**Option A — Environment variables (highest priority, recommended for CI):**
-
-```bash
-export OCR_LLM_URL=https://api.anthropic.com/v1/messages
-export OCR_LLM_TOKEN=<api-key>
-export OCR_LLM_MODEL=claude-opus-4-6
-export OCR_USE_ANTHROPIC=true
-```
-
-**Option B — Persistent config:**
-
-```bash
-ocr config set llm.url https://api.anthropic.com/v1/messages
-ocr config set llm.auth_token <api-key>
-ocr config set llm.model claude-opus-4-6
-ocr config set llm.use_anthropic true
-```
-
-Stop here and ask the user to provide credentials — never invent or hardcode API keys.
-
-## Workflow
-
-### Step 1: Gather Business Context
-
-Analyze the review target (commits, branch, or changes) to extract concise business context. Pass this context via `--background` to improve review quality.
-
-### Step 2: Run Code Review
-
-Run the OCR command with appropriate flags. **Always pass business context via `--background`** when available:
-
-```bash
-ocr review --audience agent --background "business context here" [user-args]
-```
-
-**Argument handling:**
-
-- **Background context** (RECOMMENDED): use `--background "context"` or `-b "context"` to provide business context for better review quality
-- **Default** (no user arguments): reviews staged, unstaged, and untracked changes (workspace mode)
-- **Specific commit**: use `--commit` or `-c` to review a single commit against its parent
-- **Branch comparison**: use `--from <ref>` and `--to <ref>` to review diff between two refs
-- **Timeout**: default timeout is 10 minutes per file; adjust with `--timeout <minutes>`
-- **Concurrency**: default concurrency is 8 file workers; reduce with `--concurrency <n>` if rate limits are hit
-- **Preview mode**: use `--preview` or `-p` to preview which files will be reviewed without running the LLM
-- **Installation**: if `ocr` command is not found, install it by running `npm i -g @alibaba-group/open-code-review`
-
-**Common invocation patterns:**
-
-| User says | Command to run |
-|-----------|---------------|
-| "review my changes" / "review the working copy" | `ocr review --audience agent -b "context"` |
-| "review this PR" / "review feature branch" | `ocr review --audience agent -b "context" --from main --to <branch>` |
-| "review commit abc123" | `ocr review --audience agent -b "context" --commit abc123` |
-| "what would be reviewed?" (dry-run) | `ocr review --preview` |
-
-**Output mode:**
-
-- Always use `--audience agent` to suppress progress UI and emit only the final summary
-
-### Step 3: Classify and Report
-
-For each comment from the review output, classify by priority and report all issues to the user:
-
-- **High**: Obvious bugs, security issues, clear mistakes, or well-founded suggestions with precise fix proposals
-- **Medium**: Reasonable concerns but context-dependent, style/performance suggestions, or fixes that require manual implementation
-- **Low**: Likely false positives, lacking sufficient context, nitpicks, or meaningless suggestions
-
-Report all comments grouped by priority level.
-
-### Step 4: Fix
-
-Before applying fixes, check whether the user requested automatic fixes:
-
-- If the user explicitly requested "review and fix" or similar, proceed with automatic fixes
-- If the user only requested "review" without fix intent, ask for permission before applying any changes
-
-When fixing issues and suggestions:
-
-- Focus on High and Medium priority items
-- Apply fixes directly to the code when safe and well-defined
-- For complex fixes requiring manual intervention, clearly describe what needs to be done
-- Always verify fixes with the user before committing
-
-## Output Format
-
-Each comment contains:
-
-- `path`: File path
-- `content`: Review comment text
-- `start_line` / `end_line`: Line range (both 0 means positioning failed)
-- `suggestion_code`: Optional fix suggestion
-- `existing_code`: Optional original code snippet
-- `thinking`: Optional LLM reasoning process
-
-After filtering comments by priority, present results using this template:
-
-```markdown
-## Code Review Results
-
-**Files reviewed**: N
-**Issues found**: X high priority / Y medium priority
-
-### High Priority
-
-- **`path/to/file.java:42`** — Brief description
-  > Recommendation: How to fix
-
-### Medium Priority
-
-- **`path/to/file.ts:88`** — Brief description
-  > Recommendation: How to fix (if applicable)
-```
-
-If the review found no issues after filtering, simply state: "Review complete — no issues found in N files."
-
-**Priority classification:**
-
-- **High**: Obvious bugs, security issues, clear mistakes, or well-founded suggestions with precise fix proposals
-- **Medium**: Reasonable concerns but context-dependent, style/performance suggestions, or fixes that require manual implementation
-- **Low**: Discarded silently (likely false positives, lacking context, nitpicks, or meaningless suggestions)
-
-**Handling mispositioned comments:**
-
-When `start_line` and `end_line` are both `0`, the comment failed to locate the exact position in the file. In such cases:
-
-1. Read the comment content to understand the issue
-2. Examine the target file mentioned in the comment
-3. Identify the relevant code section based on the comment's context
-4. Apply the fix or suggestion to the correct location
-
-## Custom Review Rules
-
-If the user wants project-specific rules, OCR resolves them in this priority order:
-
-1. `--rule <path>` flag (highest)
-2. `<repo>/.opencodereview/rule.json`
-3. `~/.opencodereview/rule.json`
-4. Built-in system defaults (lowest)
-
-Rule file format:
-
-```json
-{
-  "rules": [
-    {
-      "path": "**/*.java",
-      "rule": "All new methods must validate required parameters for null"
-    },
-    {
-      "path": "**/*mapper*.xml",
-      "rule": "Check SQL for injection risks and missing closing tags"
-    }
-  ]
-}
-```
-
-To preview which rule applies to a file before reviewing:
-
-```bash
-ocr rules check src/main/java/com/example/Foo.java
-```
-
-## Gotchas
-
-- **LLM must be configured first** — `ocr review` will fail loudly if no LLM is reachable. Always run `ocr llm test` before the first review.
-- **Working directory matters** — `ocr review` operates on the Git repo at the current directory. Use `--repo /path/to/repo` to run from elsewhere.
-- **Untracked files are reviewed in workspace mode** — running bare `ocr review` includes staged, unstaged, *and* untracked changes. Stage selectively if you want narrower scope.
-- **Large diffs may hit token limits** — files with very large diffs may be truncated. The default `MAX_TOKENS` is 58888 per request.
-- **Plan phase triggers at 50 lines** — diffs exceeding 50 changed lines run an extra risk-analysis phase before main review. This adds latency but improves quality.
-- **Don't pass `--audience human`** — it streams progress UI that pollutes output. Always use `--audience agent`.
-- **Comment language follows config** — set `language` config to `English` or `Chinese` (default: Chinese) to control review comment language.
-
-## Validation
-
-After the review completes, verify success by checking:
-
-1. The command exited with code 0
-2. Comments were generated (or "No comments generated" message appears)
-3. Warnings (if any) are displayed in stderr
-
-If errors occurred, check the stderr warnings for details about which files failed and why.
-
-## References
-
-- Full docs: https://github.com/alibaba/open-code-review
-- NPM package: https://www.npmjs.com/package/@alibaba-group/open-code-review
-- Issue tracker: https://github.com/alibaba/open-code-review/issues