惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

cs.CL updates on arXiv.org
cs.CL updates on arXiv.org
P
Palo Alto Networks Blog
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
P
Privacy & Cybersecurity Law Blog
Security Archives - TechRepublic
Security Archives - TechRepublic
阮一峰的网络日志
阮一峰的网络日志
Recent Announcements
Recent Announcements
P
Proofpoint News Feed
H
Hacker News: Front Page
H
Help Net Security
云风的 BLOG
云风的 BLOG
H
Heimdal Security Blog
C
CXSECURITY Database RSS Feed - CXSecurity.com
L
Lohrmann on Cybersecurity
C
Check Point Blog
Google DeepMind News
Google DeepMind News
Forbes - Security
Forbes - Security
P
Proofpoint News Feed
Google DeepMind News
Google DeepMind News
I
InfoQ
The GitHub Blog
The GitHub Blog
The Cloudflare Blog
I
Intezer
L
LINUX DO - 最新话题
K
Kaspersky official blog
Attack and Defense Labs
Attack and Defense Labs
C
CERT Recently Published Vulnerability Notes
aimingoo的专栏
aimingoo的专栏
S
SegmentFault 最新的问题
NISL@THU
NISL@THU
人人都是产品经理
人人都是产品经理
雷峰网
雷峰网
cs.CV updates on arXiv.org
cs.CV updates on arXiv.org
Vercel News
Vercel News
C
Cyber Attacks, Cyber Crime and Cyber Security
T
Threatpost
Y
Y Combinator Blog
S
Security Affairs
Latest news
Latest news
T
Threat Research - Cisco Blogs
T
Tailwind CSS Blog
C
Cisco Blogs
CTFtime.org: upcoming CTF events
CTFtime.org: upcoming CTF events
P
Privacy International News Feed
Jina AI
Jina AI
Apple Machine Learning Research
Apple Machine Learning Research
Cisco Talos Blog
Cisco Talos Blog
T
Troy Hunt's Blog
S
Securelist
MongoDB | Blog
MongoDB | Blog

博客园 - lightsong

Micro Frontends extending the microservice idea to frontend development What is Nx? Smart Monorepo Build System & CI Build and Query Knowledge Graphs with LLMs WizMap Claude Code Awesome Claude Agents - 26-agent AI Development Team (open source) WezTerm Herdr Zellij playwright-cli branch vs worktree Ralph Loop Browserbase Skills The Complete Beginner's Guide to GSD (Get Shit Done) Framework for Claude Code A Claude Code Skills Stack: How to Combine Superpowers, gstack, and GSD Without the Chaos Casdoor Harness engineering for coding agent users The 8 Levels of Agentic Engineering assistant-ui vs copilotkit vs tambo Apache Casbin Agentic AI-Powered HR Automation Instant CV Intelligence for Modern Hiring Teams Python + LangGraph + FastAPI langfuse contextvars Agent Skills Temporal + LangGraph: A Two-Layer Architecture for Multi-Agent Coordination Building Generative AI Services with FastAPI DeepAgent vs LangGraph Plan-and-Execute AI-Native Software Delivery 动态表单EAV模型(Entity-Attribute-Value模型)和JSON字段 ClickHouse® is a real-time analytics database management system GRAPH RAG 数仓建模——维度表详细讲解 涌现能力 The 5W2H Problem-Solving Method 前端如何直接上传文件夹 docker状态混乱修复(如果出现容器stop不了问题,报Permission denied) Ducky - BPMN 工作流管理系统
AI Code Review
lightsong · 2026-06-14 · via 博客园 - lightsong

AI Code Review

https://alibaba.github.io/open-code-review/

https://github.com/alibaba/open-code-review/tree/main

What is Open Code Review?

Open Code Review is an AI-powered code review CLI tool. It originated as Alibaba Group's internal official AI code review assistant — over the past two years, it has served tens of thousands of developers and identified millions of code defects. After thorough validation at massive scale, we incubated it into an open source project for the community. Simply configure a model endpoint to get started.

It reads Git diffs, sends changed files to a configurable LLM via an agent with tool-use capabilities, and generates structured review comments with line-level precision. The agent can read full file contents, search the codebase, inspect other changed files for context, and produce deep reviews — not just surface-level diff feedback.

Highlights

Why Open Code Review?

The Problem with General-Purpose Agents

If you've used general-purpose agents like Claude Code with Skills for code review, you've likely encountered these pain points:

  • Incomplete coverage — On larger changesets, agents tend to "cut corners," selectively reviewing only some files and missing others.
  • Position drift — Reported issues frequently don't match the actual code location, with line numbers or file references drifting off target.
  • Unstable quality — Natural-language-driven Skills are hard to debug, and review quality fluctuates significantly with minor prompt variations.

The root cause: a purely language-driven architecture lacks hard constraints on the review process.

Core Design: Deterministic Engineering × Agent Hybrid

Open Code Review's core philosophy is to combine deterministic engineering with an agent, each handling what it does best.

Deterministic Engineering — Hard Constraints

For review steps that must not go wrong, engineering logic — not the language model — guarantees correctness:

  • Precise file selection — Determines exactly which files need review and which should be filtered, ensuring no important change is missed.
  • Smart file bundling — Groups related files into a single review unit (e.g., message_en.properties and message_zh.properties are bundled together). Each bundle runs as a sub-agent with isolated context — a divide-and-conquer strategy that stays stable on very large changesets and naturally supports concurrent review.
  • Fine-grained rule matching — Matches review rules to each file's characteristics, keeping the model's attention sharply focused and eliminating information noise at the source. Compared to purely language-driven rule guidance, template-engine-based rule matching is more stable and predictable.
  • External positioning and reflection modules — Independent comment-positioning and comment-reflection modules systematically improve both the location accuracy and content accuracy of AI feedback.

Agent — Dynamic Decision-Making

The agent's strengths are concentrated where they matter most — dynamic decisions and dynamic context retrieval:

  • Scenario-tuned prompts — Prompt templates deeply optimized for code review, improving effectiveness while reducing token consumption.
  • Scenario-tuned toolset — Distilled from deep analysis of tool-call traces in large-scale production data — including call frequency distributions, per-tool repetition rates, and the impact of new tools on the overall call chain — resulting in a purpose-built toolset that is more stable and predictable for code review than a generic agent toolkit.

Open Code Review (short ocr) is an AI-powered code review CLI tool.

Core Features:

  • Supports workspace changes, branch diff, and single-commit review modes
  • Supports LLM services with Anthropic and OpenAI-compatible protocols
  • Concurrent review with customizable timeouts
  • Output format supports text and json
  • Zero config for Claude Code users
  • WebUI viewer for visualizing review results

An Agent System Purpose-Built for Code Review

An AI Agent that reads files, searches the codebase, cross-references context, and applies fine-grained rules for deep review.

Hybrid Architecture: Deterministic + Agent

Decouples deterministic engineering (task splitting, file filtering, line-number positioning, rule routing, async scheduling) from LLM Agent reasoning (risk detection, context exploration, issue classification) — engineering modules handle certainty, Agents handle semantics, optimizing quality, token cost, and speed.

Precise Comment Positioning & Reflection

An independent line-level comment positioning module with a 3-tier progressive LLM strategy pinpoints each comment to exact line numbers. A separate reflection module intercepts hallucinations and knowledge drift early.

Multi-Model Protocol Support

Supports both Anthropic Messages API and OpenAI Chat Completions API. Connect custom model endpoints.

Dynamic Concurrent Processing

Dynamically splits sub-tasks for parallel review with configurable goroutine workers (default 8). Even large changesets complete quickly.

Smart Memory Compression

Purpose-built memory compression for code review with 3-tier partitioning (frozen/compress/active) context management, breaking token limits for deep review.

Built-in Review Rules

Review rules validated through massive real-world scenarios, covering 10+ languages including Java, TypeScript, Go, Python, Kotlin, C++, C, with specialized rules for NPE, thread safety, XSS, SQL injection, and more.

出处:http://www.cnblogs.com/lightsong/ 本文版权归作者和博客园共有,欢迎转载,但未经作者同意必须保留此段声明,且在文章页面明显位置给出原文连接。