* fix(opencode): support OpenCode 2.x via native tools and commands
The single-file plugin (open-code-review.ts) cannot load on OpenCode 2.x:
the 2.x loader requires a default-exported { id, effect | setup } and has
no custom-tool registration API. It also fails on 1.x for most users
because nothing installs the @opencode-ai/plugin dependency the file
imports.
Ship the same ocr_review / ocr_health features as 2.x-native custom
tools plus /ocr-review /ocr-health commands, and document the
@opencode-ai/plugin dependency step for both versions.
* fix(opencode): dual V1+V2 plugin entrypoint instead of separate files
Replace the tools/+commands/ split with the documented dual plugin form:
default-export { ...Plugin.define({ id, setup }), server }. V2 registers
ocr_review/ocr_health via ctx.tool.transform and /ocr-review//ocr-health
via ctx.command.transform, reusing the same OCR logic as V1. Add
@opencode/plugin beta devDependency and a test for the default export.
* fix(opencode): review feedback: typeless V2 import, strict schemas, tests
- Import @opencode/plugin as types only and export a plain dual object,
so OpenCode 1.x never needs the V2 beta package at runtime (verified
in the built output: only node:*, @opencode-ai/plugin imports remain).
- V2 numeric inputs now require positive integers
({ type: integer, minimum: 1 }), matching the V1 zod schema.
- V2 commands keep the V1 sentence break, skip user-defined names like
the V1 ??= guards, and resolveSessionCwd falls back to the plugin
location when the session lookup fails.
- README: single download block, corrected 30-minute tool timeout,
deduped project section.
- Track package-lock.json (drop the local ignore) so npm ci works.
- Move the V2 stub harness into the test suite (+6 tests, 29 passing).
- Verified live on OpenCode 1.18.30 sandbox: plugin loads with no
errors, single init across sessions, both commands registered once.
* fix(skill): align review skill with current CLI semantics
Correct stale token, plan-phase, language, and provider wording, and document current review controls and the resume/session workflow in the canonical OCR Skill and its plugin mirror.
Refs #1224
* fix(skill): correct effort default and token-budget wording
Address maintainer review: --effort defaults to the configured effort (or medium when unset), and the token gotcha describes compression against the prompt budget rather than a single 80% threshold.
Refs #1224
* fix(skill): keep only agent-relevant review controls
Fold resume guidance into the gotchas as failure recovery and drop the human-facing session inspection commands and expert tuning flags, per maintainer review.
Refs #1224
* feat: Apply batched suggestions from code review
Co-authored-by: Kite <254839944+lizhengfeng101@users.noreply.github.com>
* fix(skill): restore per-run provider and model overrides
Agreed with maintainer review: keep the per-run --provider/--model override documented for user-directed model changes; --effort stays documented in the Workflow timeout line only.
Refs #1224
---------
Co-authored-by: Kite <254839944+lizhengfeng101@users.noreply.github.com>
* docs(skill): prefer --output flag over shell redirection for large reviews
Since v1.10.0, `ocr review` supports --output/-o to write results to a
file directly, superseding the shell redirection workaround the skill
taught for preventing output truncation. Register the flag in the
Argument handling catalog, switch the Output mode guidance to --output,
align the Gotchas reminder, and add an `unknown flag: --output`
Troubleshooting entry. On older CLIs the skill stops the review, asks
the user before upgrading, and never falls back to redirection or plain
stdout silently.
* docs(skill): drop -o shorthand from output-flag guidance
pflag reports a missing shorthand as "unknown shorthand flag: 'o' in -o",
which does not match the "unknown flag: --output" upgrade gate. Pointing
agents at the long flag keeps the error signal stable.
The SKILL.md argument-handling section claimed the default timeout is
15 minutes per file. Since #1085 introduced effort-scaled review rounds,
the actual timeout is ConcurrentTaskTimeout minutes multiplied by
ReviewRounds() (internal/agent/agent.go:644), i.e. per review round per
concurrent review group. With the default --timeout 15 and effort presets
low/medium/high (1/2/3 rounds), the effective group timeout is 15/30/45
minutes; the default effort is medium (30 minutes).
Update both the canonical skill and the plugin mirror so host agents no
longer kill healthy reviews by assuming a flat 15-minute per-file budget.
* fix(agent): scale subtask timeout linearly with effort review rounds
Previously the timeout applied a flat 1.5x multiplier whenever
ReviewRounds > 1, giving both medium (2 rounds) and high (3 rounds)
the same deadline. Replace this with a linear formula:
timeout = base × ReviewRounds(), producing 10/20/30 min defaults
for low/medium/high effort respectively.
* chore: bump default --timeout from 10 to 15 minutes
The base unit of 10 min was too tight for real-world reviews.
Raising it to 15 min gives linear scaling of 15/30/45 min
for low/medium/high effort respectively.
Update CLI flags, action.yml, docs, and skill files.
* test: update action-contract assertions for 15-min default timeout
* refactor(background): treat --background and --background-file as mutually exclusive with file precedence
Replace mergeBackground with selectBackground: when both flags are
provided, --background-file wins and --background is ignored (with a
stderr warning). The commit-message fallback now fires only when neither
entry point was used.
This fixes the inconsistency where review and delegate produced
different backgrounds for equivalent input (issue #1013), and makes
the effective background deterministic regardless of which command
is invoked.
Closes#1013
* refactor(background): extract resolveBackground helper and fix tests
Address reviewer feedback:
- Extract resolveBackground() so review and delegate share one call
site, making future drift impossible.
- Rewrite tests to call resolveBackground directly instead of
duplicating the if/else-if logic (which could never fail).
- Fix stale comment on TestBackgroundFilePrecedenceOverCommit.
* refactor(skill): move prerequisites check to troubleshooting section
- Remove upfront `which ocr` / `ocr llm test` from main workflow
- Keep inline installation fallback hint in Step 2
- Add Troubleshooting section with install and LLM config guidance
- Update Gotchas entry to reference Troubleshooting instead of requiring pre-run check
* refactor(skill): use native OCR severity/category instead of manual classification
- Step 3: remove manual High/Medium/Low classification; use OCR output severity/category directly
- Step 4: reference severity field instead of custom priority levels
- Output Format: add category/severity to field list; group template by severity
- Remove duplicated Priority classification definition
- Retain mispositioned comments handling and thinking field
* refactor(skill): apply prerequisites/severity refactor to canonical skill
Mirrors the plugin skill refactor:
- Move prerequisites check to Troubleshooting section
- Use native OCR severity/category instead of manual classification
- Retain mispositioned comments handling and thinking field
- Retain truncation guidance added in 4f7d78f
* docs(skill): sync truncation guidance from canonical to plugin skill
The plugin skill copy missed the output-truncation guidance added to the
canonical skill in 4f7d78f (#809). Both files now diverge only by the
plugin's self-descriptive mirror notice, as designed.
* fix(skill): route command failures to troubleshooting section
Step 2 had no failure directive, so the agent did not consult the
Troubleshooting section when `ocr review` failed (e.g. LLM connection
error). Add an explicit pointer so the agent looks up the matching fix
before retrying.
* docs(skill): address PR review feedback
- Lead with the interactive `ocr config provider` wizard for LLM config
(agent cannot obtain credentials); keep manual `ocr config set` as
alternative; drop env-var option.
- Fix the no-issues line to reflect that low-severity findings are
discarded ("no critical, high, or medium severity issues remain after
filtering").
- Apply to both canonical and plugin skill copies.
* fix(opencode): separate per-file and overall timeouts
* fix(opencode): default to 30-minute overall timeout instead of no timeout
Defense in depth: when overallTimeoutMinutes is not configured,
apply a 30-minute watchdog so genuinely stuck processes are reaped
even if the abort signal never fires.
---------
Co-authored-by: kite <lizhengfeng.lzf@alibaba-inc.com>
* chore: add SPDX license headers to all source files
Add Apache-2.0 SPDX license identifiers and copyright notices to all
tracked .go, .sh, .js, .mjs, .ts, and .tsx source files.
Introduce scripts/verify-license.sh and scripts/add-license.sh for
automated verification and bulk addition of license headers. Integrate
the check into CI (ci.yml) and the Makefile (license-check target as
a prerequisite of the existing check target).
This satisfies the OpenSSF Best Practices Badge requirements for
copyright_per_file and license_per_file.
* fix: restore execute permissions on scripts
* docs: add license header instructions to CONTRIBUTING guides
* docs: add license header instructions to pages contributing guides
* fix(pages): strip unclosed HTML comment markers to satisfy CodeQL
* fix: apply code review suggestions for license scripts
- Fix portability: detect macOS vs Linux stat for permission copy
- Fix has_header: check both SPDX and copyright (match verify logic)
- Fix is_ignored: match on path boundaries to avoid false positives
- Fix year extraction: use consistent pipeline across both scripts
- Fix Bash 3.2 compat: quote array length expansion for set -u
* fix(pages): use loop-until-clean for HTML comment stripping (CodeQL)
* fix(pages): use split/join instead of replace to avoid CodeQL false positive
CodeQL's js/incomplete-multi-character-sanitization rule flags any
.replace() that removes multi-character sequences like '<!--...-->',
regardless of context. The data here comes from readFileSync on the
project's own index.html (no untrusted input), making this a false
positive. Using split(regex).join('') achieves the same result without
triggering the taint-tracking rule.
Address the six still-open findings from #702 in the opencode plugin:
- M1: wrap the telemetry app.log call so a failing log service no longer
blocks tool registration
- M2: guard context.abort.aborted for hosts that omit an abort signal
- M3: reject resume combined with commit or a from/to range
- M4: spawn OCR in its own process group and kill the group on timeout
or cancel so git/LLM grandchildren cannot orphan
- L1: treat empty stdout as no changes instead of misleading invalid JSON
- L2: drop the dead ReviewInput.repo field and pass cwd as the repo arg
directly
Adds regression tests for each fix, including a process-group test that
asserts grandchildren are reaped on cancellation.
* feat(delegate): add delegation mode for host-agent driven code review
Add `ocr delegate` subcommand that provides deterministic file selection
and rule resolution without calling any LLM. This enables AI coding agents
to perform reviews themselves using OCR only for engineering scaffolding
(preview which files to review, resolve grouped rules by path).
Includes:
- `ocr delegate preview` — outputs reviewable file list with mode/ref metadata
- `ocr delegate rule <path...>` — outputs review rules grouped by content
- Claude Code plugin command (delegate-review.md)
- Skill definitions for Claude Code, Codex, and Cursor
- Unit tests for internal/delegate package
- README documentation synced across all 5 locales
* fix(delegate): group rules by source, pattern and text
GroupRules keyed groups on rule text alone, so files sharing identical
rule text but resolved from different sources or matched by different
patterns were merged into one group that kept only the first file's
Source/Pattern metadata. Use a composite (source, pattern, text) key so
each group's provenance is accurate for every file it contains.
Add .cursor-plugin/plugin.json manifest alongside existing Claude Code
and Codex plugin integrations, reusing the shared SKILL.md. Update all
README versions (EN, zh-CN, ja-JP, ko-KR, ru-RU) with Cursor badge and
installation instructions.
* feat: add open-code-review skill for agent integration
Add skills/open-code-review/SKILL.md that teaches coding agents
how to invoke ocr for code review, classify issues by priority,
and optionally apply fixes.
* feat: add Claude Code plugin for open-code-review
Add .claude-plugin/marketplace.json and plugins/open-code-review/
with plugin configuration and review command, enabling installation
as a Claude Code slash command plugin.
* docs: add agent integration section to README (EN/ZH)
Add 'Integration into Coding Agents' section covering three methods:
skill installation, Claude Code plugin, and direct command file copy.
Bilingual update for both README.md and README.zh-CN.md.
* docs: update manual setup curl URLs to new plugin path
Jordan Humberto de Souza