github.com/alibaba/open-code-review

🚀 Features

• feat(llm): exercise a tool-call round trip in ocr llm test (#1394)
• feat(llm): add OpenRouter to list of providers (#1522)
• feat(session): add 'ocr session rm' to delete a saved session (#1490)

🐛 Bug Fixes

• fix(llmloop): account for tool_calls and arguments in messageTokens (#1413)
• fix(llm): trim environment-sourced endpoint values (#1414)
• fix(tool): keep non-ASCII paths literal in file_find results (#1530)
• fix(opencode): handle long background context (#1010)
• fix(action): allow checkpoints after out-of-diff findings (#1524)
• fix(config): remove OCR_CONFIG_PATH (#1537)
• fix(llm): replay tool_call extra_content and surface provider error bodies (#1393)

📖 Documentation

• docs(cli-reference): list the manifest status values in the status field (#1587)
• docs(readme): replace Go weekly badge with all-language weekly badge (#1559)
• docs(review-rules): document merge_system_rule in all five locales (#1555)

Full Changelog: v1.12.9...v1.12.10

🐛 Bug Fixes

• fix(session): preserve findings across file renames (#1529)
• fix(config): preserve unknown JSON fields during config updates (#1508)
• fix(review): keep git stderr out of --commit background (#1467)
• fix(ci): pin workflow action references to full commit SHAs (#856)
• fix(viewer): wrap long session metadata on mobile (#1458)

📖 Documentation

• docs(agents): add guideline to comment sparingly and explain why (#1534)

Other Changes

• security: validate credential commands and expand .gitattributes binary markers (#1291)
• Fix/gitlab multiline comments and suggestions (#1000)
• test: stabilize token boundary fixtures (#1015)
• test(diff): guard quoted-path parsing through a real git subprocess (#1516)

Full Changelog: v1.12.8...v1.12.9

🚀 Features

• feat(rules): add F# review support (#1448)

🐛 Bug Fixes

• fix(config): exclude dependency and build-output directories by default (#1499)
• fix(viewer): keep vertical mouse-wheel working over scroll regions (#1515)
• fix(action): honor an explicit llm_protocol instead of forcing openai or anthropic (#1192)
• fix(diff): parse git's quoted pathnames instead of dropping the file (#1498)
• fix(scan): keep NUL-delimited pathnames from git ls-files intact (#1497)
• fix(viewer): shorten the session id cell on the session list (#1488)
• fix(viewer): responsive, accessibility and contrast polish across the four screens (#1426)
• fix(tool): keep non-ASCII paths literal in code_search results (#1425)

📖 Documentation

• docs(assurance): correct API key storage claims (#1449)
• docs(extensions): new translations for vscode ext (#1381)
• docs(review): synchronize exclude & secret patterns (#1491)

Other Changes

• perf(viewer): paginate large review result lists (#1460)

Full Changelog: v1.12.7...v1.12.8

🚀 Features

• feat(viewer): export a session to a self-contained HTML file (#1167) (#1174)

🐛 Bug Fixes

• fix(allowlist): exclude pytest-style test_*.py from review (#1439)

Other Changes

• chore: drop the last TEMPORARY english-only exemption (#1445)
• chore(idea): translate the Chinese comments in services/ (#1436)
• chore(idea): translate tests and narrow language exemptions (#1429)
• chore(vscode): translate comments and test names to English (#1427)
• chore(idea): translate provider and host string comments (#1428)
• chore: translations (#1437)

Full Changelog: v1.12.6...v1.12.7

🚀 Features

• feat(viewer): restyle the review comments section (#1387)
• feat(viewer): restyle session detail header and meta bar (#1384)
• feat(viewer): restyle the sessions list page (#1377)
• feat(viewer): restyle the repositories page (#1382)

🐛 Bug Fixes

• fix(test): add TestMain to isolate session writes from real HOME (#1416)
• fix(npm): hide the updater's console window on Windows (#1406)
• fix(viewer): make --surface white to match the mockup backgrounds (#1404)

🔧 Refactoring

• refactor(viewer): dedupe shared viewer chrome (pager + back-link) (#1400)

Other Changes

• chore(idea): rename the Marketplace listing and set version 0.1.0 (#1438)
• chore: clear non-code blockers ahead of the english-only cleanup (#1417)
• Feat/idea plugin (#1031)
• chore: extend license and english-only gates to kt, py and css (#1407)

Full Changelog: v1.12.5...v1.12.6

🚀 Features

• feat(viewer): restyle session detail sections (#1358)
• feat(action): opt-in resolution of the bot's own outdated review threads (#567) (#944)
• feat(viewer): integrate a shared SVG icon set (#1367)
• feat(viewer): align design-token values to the mockup palette (#1365)
• feat(plugin): add kimi code plugin (#1355)
• feat(pages): standardize web crawler policy (#939)
• feat(viewer): restyle the session compare page (#1328) (#1331)
• feat(viewer): restyle Coverage and Token Usage cards (#1346)
• feat(viewer): add shared design foundation (#1338)
• feat(viewer): align suggested change indentation with existing code gutter (#1313) (#1315)

🐛 Bug Fixes

• fix(agent): enforce --max-tokens-budget inside a running group (#1248)
• fix: dedupe overlapping incremental review comments (#1359)
• fix(install): add download timeout to asset fetch in install.sh (#1292)
• fix(tool): enforce the global code search result limit (#1306)
• fix(session): tolerate truncated resume tail (#1312)
• fix(diff): strip trailing CR from CRLF diff text (#1302)

📖 Documentation

• docs(skill): skip ocr install pre-check on the common path (#1356)
• docs(telemetry): document existing LLM and tool spans (#1348)

Other Changes

• chore(pages): remove MacPorts install channel (#1334)

Full Changelog: v1.12.4...v1.12.5

🚀 Features

• feat(action): add optional pr_number input and workflow_run fallback (#1156)

🐛 Bug Fixes

• fix(diff): flag untracked binary files as binary in workspace mode (#1288)

Other Changes

• perf(diff): skip oversized untracked files before reading (#1310)
• test(action): satisfy resolved_head contract in workflow_run pr_number test (#1309)
• test(diff): cover gitignore-drop interleaved with provider-exclude (#1300)

Full Changelog: v1.12.3...v1.12.4

🚀 Features

• feat(allowlist): protect per-environment .env files (#1279)
• feat(allowlist): exclude secret paths from review (#1262)

🐛 Bug Fixes

• fix: recover tool-call JSON with trailing content and back off repeated failures (#1278)
• fix(tool): prevent path traversal bypass and normalize paths in code_search and code_comment (#1089)
• fix(preview): collapse provider-directory rows and keep changeset order (#1242)

📖 Documentation

• docs: use subtask instead of file/file-group in user-facing docs (#1277)
• docs(readme): add monthly Trendshift badge and improve layout (#1267)

Full Changelog: v1.12.2...v1.12.3

🚀 Features

• feat(viewer): add back navigation to improve page traversal UX (#1217)
• feat(opencode): add backgroundFile input and report termination signals (#1234)

🐛 Bug Fixes

• fix(suggestdiff): preserve case and indentation changes (#1256)
• fix(preview): scope preview totals to the tracked changeset (#1241)
• fix(template): remove unused scan settings (#1261)
• fix(cli): flush telemetry before error exit (#1259)

📖 Documentation

• docs: tidy repo root and refresh screenshots; fix highlights label alignment (#1260)
• docs(architecture): remove incorrect provider_directory entry from whyExcluded list (#1238)

Full Changelog: v1.12.1...v1.12.2

🚀 Features

• feat(git): validate if PATH git version is safe git (#865)

🐛 Bug Fixes

• fix(rules): route Python stub files to the Python review rules (#1232)
• fix(preview): show provider-excluded diffs (#1223)
• fix(opencode): support OpenCode 2.x via native tools and commands (#1213)
• fix(skill): align review skill with current CLI semantics (#1225)
• fix(llm): install the embedded BPE loader from package init (#1228)
• fix(actions): post findings against the reviewed commit (#1230)

Other Changes

• chore: remove stale alias pointing to deepseek-flash (#1219)

Full Changelog: v1.12.0...v1.12.1

Other Changes

• perf(grouping): return file indices instead of paths (#1209)
• chore: synchronize glm-5.3 to from z-ai coding plan to z ai api (#923)

Full Changelog: v1.11.9...v1.12.0

🚀 Features

• feat(viewer): add session compare page (#1175)

🐛 Bug Fixes

• fix(llm): add deepseek-flash model (#1210)
• fix(agent): make --preview apply the same selection the review applies (#801)

Full Changelog: v1.11.8...v1.11.9

🚀 Features

• feat(rules): add Rego policy review support (#1199)

🐛 Bug Fixes

• fix(llm): request stream usage by default with extra_body override (#822)
• fix(scan): align preview selection with execution (#1041)

📖 Documentation

• docs: enforce responsible AI usage (#1037)

Full Changelog: v1.11.7...v1.11.8

🐛 Bug Fixes

• fix(output): write reports atomically (#1160)
• fix(mcp): bound the MCP shutdown phase (#1183)
• fix(review): exit immediately on the second signal (#1185)
• fix(config): support timeout_sec in config set (#1179)

📖 Documentation

• docs(skill): prefer --output flag over shell redirection (#1097)

Full Changelog: v1.11.6...v1.11.7

🚀 Features

• feat(allowlist): add OCaml/ReasonML language support (#942) (#951)
• feat(action): first-class review controls (effort, max_tokens_budget, llm_reasoning_effort) and live progress (#1154)
• feat(viewer): number the lines inside the Existing Code block (#1172) (#1180)

🐛 Bug Fixes

• fix(launcher): forward SIGINT/SIGTERM signals to child process (#1145)
• fix(rules): route Kotlin script files to Kotlin review rules (#1091)

📖 Documentation

• docs(pages): correct FAQ JSON output shape and plan-threshold cost lever (#1190)
• docs(pages): correct the developer guide to match the actual project (#1182)

Other Changes

• Honor timeout_sec for openai-go's ResponseHeaderTimeout (#1161) (#1162)

Full Changelog: v1.11.5...v1.11.6

🚀 Features

• feat(viewer): mark comments as fixed/ignored and hide them (#1101)

🐛 Bug Fixes

• fix(deps): bump grpc, fast-uri and browserslist to patch high-severity advisories (#1169)

🔧 Refactoring

• refactor: retire per-file naming left over from grouped review (#1168)

Full Changelog: v1.11.4...v1.11.5

🚀 Features

• feat(tool): include arguments in failure details (#1152)

🐛 Bug Fixes

• fix(rules): route Objective-C++ files to Objective-C rules (#1166)
• fix(tool): repair serialized code_comment arguments instead of losing the batch (#1153)

Other Changes

• Keep repeated documentation headings independently addressable (#1151)
• ci: add plugin distribution contract guardrails (#1117)

Full Changelog: v1.11.3...v1.11.4

🚀 Features

• feat(raw): capture raw LLM traffic via SDK middleware (opt-in) (#1109)

🐛 Bug Fixes

• fix(tool): report tool call failures (#1144)
• fix(diff): propagate untracked file listing errors (#1140)
• fix(review): handle SIGTERM for graceful shutdown (#1111)

Other Changes

• chore(deps-dev): bump the vscode-dependencies group (#1129)

Full Changelog: v1.11.2...v1.11.3

🚀 Features

• feat(cmd, viewer): open viewer URL in default browser (#1108)

🐛 Bug Fixes

• fix(rules): route .cxx and .hxx files to C++ rules (#1123)
• fix(rules): route JavaScript module files to JS rules (#1122)

📖 Documentation

• docs(mcp): document remote setup with Parallel Search example (#1107)
• docs(zh-CN): improve branch range wording (#1124)

Other Changes

• build: keep node_modules out of the Go package list via a module boundary (#1125)

Full Changelog: v1.11.1...v1.11.2

🚀 Features

• feat(allowlist): add Pug template support (#1114)
• feat(grouping): skip the grouping LLM call for small change sets (#1103)
• feat(allowlist): add Verilog, SystemVerilog, and VHDL support (#1050)

🐛 Bug Fixes

• fix(security): prevent rule.json from reading arbitrary files on the review host (#1100)
• fix(viewer): report selected files from run manifest (#1096)

📖 Documentation

• docs(site): replace concurrency feature card with effort (#1116)
• docs(skill): correct timeout description to reflect effort-scaled group timeout (#1110)

Other Changes

• chore(skill): remove Prerequisites section from delegate SKILL.md (#1098)

Full Changelog: v1.11.0...v1.11.1

🚀 Features

• feat(allowlist): add Handlebars and Mustache support (#1086)
• feat(config): validate provider existence before auxiliary fields (#1093)
• feat(agent): include churn stats (+N/-M) in the other-changed-files list (#1078) (#1082)

🐛 Bug Fixes

• fix(llm): preserve provider reasoning/thinking across assistant turns (#1070)
• fix(agent): scale subtask timeout linearly with effort review rounds (#1085)
• fix(filter): omit forced tool choice (#1065)
• fix(tool): support subpath and cross-platform queries in file_find (#1075)

📖 Documentation

• docs(ko): polish the six new Korean pages (#1087)
• docs(ko): complete the Korean docs locale (#1084)
• docs(ko): add Korean translation for the core user guide (#1080)
• docs(cli): align --max-tools help text with min 50 clamp (#1077)

Full Changelog: v1.10.2...v1.11.0

🚀 Features

• feat(session): register GroupingTask as a tracked TaskType (#1067)
• feat(rules): add Solidity and Vyper review rules (#961)
• feat(action): opt-in completeness-gated checkpoint ranges (#476) (#945)
• feat(session): compare findings across two review sessions (#922) (#946)

🐛 Bug Fixes

• fix: record grace round requests (#1066)

📖 Documentation

• docs(ko): add Korean translation for integration guides (#1072)

Full Changelog: v1.10.1...v1.10.2

🚀 Features

• feat(rules): add Objective-C-specific review rules (#1061)
• feat(allowlist): add matlab support (#574)
• feat(rules): add project review rule for providers.go (#1057)

🐛 Bug Fixes

• fix(llm): bound session task key length (#1009)
• fix(skill): handle delegate CLI version skew and background limits (#1047)
• fix(action): forward review timeout and complete LLM config (#1051)
• fix(llm): serve GPT-5.6 models via the OpenAI Responses API (#559) (#938)
• fix(cli): exit 128+signo when the native binary is killed by a signal (#1054)

📖 Documentation

• docs(ko): add Korean translation for getting-started pages (#993)

Other Changes

• ci(workflows): run the contract suite in a dedicated workflow (#1058)

Full Changelog: v1.10.0...v1.10.1

🚀 Features

• feat(agent): group semantically related files for multi-file review (#808)
• feat(cli): add --output flag to write review/scan results to a file (#852)

🐛 Bug Fixes

• fix(diff): surface git's own message when a diff command fails (#1039)

Full Changelog: v1.9.10...v1.10.0

🚀 Features

• feat(cli): clarify LLM request failures by review stage (#1022)

🐛 Bug Fixes

• fix(scan): join background memory compression before session finalization (#1026)
• fix(scan): persist safe dedup checkpoints on resume (#1035)
• fix(vscode): list merge commit files (#1029)

Full Changelog: v1.9.9...v1.9.10

🐛 Bug Fixes

• fix(agent): name the main-loop stop trigger in item failure reasons (#855)

🔧 Refactoring

• refactor(background): treat --background and --background-file as mutually exclusive with file precedence (#1016)

Other Changes

• test(llm): cover tool_choice mapping for all three provider protocols (#1011)

Full Changelog: v1.9.8...v1.9.9

🚀 Features

• feat(providers): add AWS Bedrock as a built-in provider with native SigV4 auth (#705)

🐛 Bug Fixes

• fix(cmd): suppress ANSI color when stdout is not a TTY (#927)
• fix(cmd): stream review progress to stderr for json and sarif (#929)

🔧 Refactoring

• refactor(skill): simplify review flow, use native severity (#1002)

Other Changes

• chore(examples): add explicit --audience agent to codeup_ci and action.yml (#1004)

Full Changelog: v1.9.7...v1.9.8

🚀 Features

• feat(installation): support asset download via OCR_GITHUB_MIRROR (#893)
• feat(providers): add gemini to built-in providers (#930)

Other Changes

• chore(deps): bump the go-dependencies group across 1 directory with 18 updates (#880)
• chore(ci): change dependabot schedule from weekly to monthly (#998)

Full Changelog: v1.9.6...v1.9.7

🚀 Features

• feat(language): add support for .ipynb files (#980)
• feat(allowlist): add Thrift and Cap'n Proto support (#960)
• feat(lang): review support for R (#988)
• feat(allowlist): add Zig support (#937)
• feat(rules): add Jsonnet review rules (#470) (#962)
• feat(config): resolve api_key/auth_token from a command (#236) (#605)
• feat(allowlist): add Elm language support (#940) (#953)

🐛 Bug Fixes

• fix(updater): discard stale version hints (#720)
• fix(ci): line endings check fails on symbolic links (#952)
• fix(pages): make install-channel command box scrollable (#912)
• fix(scripts): stop license checks failing on valid headers (#971)
• fix(pages): serve 404 pages on non-existent GET requests but render no React Route (#955)
• fix(allowlist): allow .properties, .po and .pot so their rules can run (#958)

📖 Documentation

• docs(site): update for elm (#978)
• docs: fix code of conduct reporting links (#968)

Other Changes

• i18n(pages): add Korean (ko) locale (#857)

Full Changelog: v1.9.5...v1.9.6