* fix(opencode): separate per-file and overall timeouts
* fix(opencode): default to 30-minute overall timeout instead of no timeout
Defense in depth: when overallTimeoutMinutes is not configured,
apply a 30-minute watchdog so genuinely stuck processes are reaped
even if the abort signal never fires.
---------
Co-authored-by: kite <lizhengfeng.lzf@alibaba-inc.com>
* chore: add SPDX license headers to all source files
Add Apache-2.0 SPDX license identifiers and copyright notices to all
tracked .go, .sh, .js, .mjs, .ts, and .tsx source files.
Introduce scripts/verify-license.sh and scripts/add-license.sh for
automated verification and bulk addition of license headers. Integrate
the check into CI (ci.yml) and the Makefile (license-check target as
a prerequisite of the existing check target).
This satisfies the OpenSSF Best Practices Badge requirements for
copyright_per_file and license_per_file.
* fix: restore execute permissions on scripts
* docs: add license header instructions to CONTRIBUTING guides
* docs: add license header instructions to pages contributing guides
* fix(pages): strip unclosed HTML comment markers to satisfy CodeQL
* fix: apply code review suggestions for license scripts
- Fix portability: detect macOS vs Linux stat for permission copy
- Fix has_header: check both SPDX and copyright (match verify logic)
- Fix is_ignored: match on path boundaries to avoid false positives
- Fix year extraction: use consistent pipeline across both scripts
- Fix Bash 3.2 compat: quote array length expansion for set -u
* fix(pages): use loop-until-clean for HTML comment stripping (CodeQL)
* fix(pages): use split/join instead of replace to avoid CodeQL false positive
CodeQL's js/incomplete-multi-character-sanitization rule flags any
.replace() that removes multi-character sequences like '<!--...-->',
regardless of context. The data here comes from readFileSync on the
project's own index.html (no untrusted input), making this a false
positive. Using split(regex).join('') achieves the same result without
triggering the taint-tracking rule.
Address the six still-open findings from #702 in the opencode plugin:
- M1: wrap the telemetry app.log call so a failing log service no longer
blocks tool registration
- M2: guard context.abort.aborted for hosts that omit an abort signal
- M3: reject resume combined with commit or a from/to range
- M4: spawn OCR in its own process group and kill the group on timeout
or cancel so git/LLM grandchildren cannot orphan
- L1: treat empty stdout as no changes instead of misleading invalid JSON
- L2: drop the dead ReviewInput.repo field and pass cwd as the repo arg
directly
Adds regression tests for each fix, including a process-group test that
asserts grandchildren are reaped on cancellation.
* feat(delegate): add delegation mode for host-agent driven code review
Add `ocr delegate` subcommand that provides deterministic file selection
and rule resolution without calling any LLM. This enables AI coding agents
to perform reviews themselves using OCR only for engineering scaffolding
(preview which files to review, resolve grouped rules by path).
Includes:
- `ocr delegate preview` — outputs reviewable file list with mode/ref metadata
- `ocr delegate rule <path...>` — outputs review rules grouped by content
- Claude Code plugin command (delegate-review.md)
- Skill definitions for Claude Code, Codex, and Cursor
- Unit tests for internal/delegate package
- README documentation synced across all 5 locales
* fix(delegate): group rules by source, pattern and text
GroupRules keyed groups on rule text alone, so files sharing identical
rule text but resolved from different sources or matched by different
patterns were merged into one group that kept only the first file's
Source/Pattern metadata. Use a composite (source, pattern, text) key so
each group's provenance is accurate for every file it contains.
Add .cursor-plugin/plugin.json manifest alongside existing Claude Code
and Codex plugin integrations, reusing the shared SKILL.md. Update all
README versions (EN, zh-CN, ja-JP, ko-KR, ru-RU) with Cursor badge and
installation instructions.
* feat: add open-code-review skill for agent integration
Add skills/open-code-review/SKILL.md that teaches coding agents
how to invoke ocr for code review, classify issues by priority,
and optionally apply fixes.
* feat: add Claude Code plugin for open-code-review
Add .claude-plugin/marketplace.json and plugins/open-code-review/
with plugin configuration and review command, enabling installation
as a Claude Code slash command plugin.
* docs: add agent integration section to README (EN/ZH)
Add 'Integration into Coding Agents' section covering three methods:
skill installation, Claude Code plugin, and direct command file copy.
Bilingual update for both README.md and README.zh-CN.md.
* docs: update manual setup curl URLs to new plugin path
