How the Code Review Process Is Initiated in Open-Code-Review: CLI Pipeline Explained

The code review process in Open-Code-Review is initiated by executing the ocr review CLI command, which orchestrates a twelve-step pipeline that validates options, configures the LLM runtime, registers tools, and delegates execution to an agent that analyzes repository diffs.

Open-Code-Review by Alibaba automates code analysis through a command-line interface that transforms Git diffs into LLM-generated feedback. Understanding exactly how the code review process is initiated requires examining the Cobra command definition in cmd/opencodereview/review_cmd.go and the subsequent initialization sequence that prepares the runtime environment.

The Entry Point: ocr review Command

The review lifecycle begins when a user invokes ocr review (or its alias ocr r). This command is registered with the Cobra framework in cmd/opencodereview/review_cmd.go at lines 49-55. Upon invocation, the command handler executes a deterministic sequence of initialization steps before any LLM interaction occurs.

The command supports multiple operation modes:

• Standard diff review: Analyzes staged, unstaged, or committed changes
• Branch range review: Compares --from and --to references
• Single commit review: Targets a specific --commit hash
• Preview mode: Lists files without LLM processing (--preview)

Step-by-Step Execution Pipeline

The ocr review command implements a rigorous twelve-stage initialization pipeline defined in the command's RunE function.

Option Validation and Security

First, validateReviewOptions inspects CLI flags including --from, --to, --commit, and exclusion patterns (lines 90-92). Immediately after, validateReviewRefs sanitizes Git references to prevent ref-option injection attacks (lines 38-45). This security layer ensures malformed references cannot execute arbitrary Git commands.

Context Initialization

The pipeline then calls loadCommonContext, which constructs a commonContext struct containing:

• Repository root path
• Rule set configuration
• File filter patterns
• Git runner instance

This context ensures all subsequent operations target the correct Git tree state. If --background or --background-file flags are present, the system reads and merges this supplementary context into the review scope.

For interrupted sessions, loadReviewResumeState restores previous execution state using a session ID, enabling fault-tolerant long-running reviews.

LLM and Tool Configuration

Before analysis begins, the system initializes the AI infrastructure:

1. loadLLMRuntime builds a runtime (rt) that configures the LLM provider, model selection, and tool configuration paths
2. buildToolRegistry registers built-in tools including file_read, file_find, file_read_diff, and code_search through tool.NewRegistry and reg.Register
3. initMCPClients optionally connects to external Micro-Code-Provider (MCP) servers, extending the toolset with custom capabilities

Agent Execution and Result Emission

The final stage constructs the review engine. agent.New receives an Args struct containing:

• Repository location
• Diff range parameters (from, to, commit)
• LLM client instance
• Tool registry
• Telemetry settings
• Concurrency limits
• Background context and resume state

The agent's Run method executes the core review logic, invoking the LLM for each file or diff chunk. Upon completion, emitRunResult formats the output as JSON, plain text, or agent-mode format, propagating any errors to the caller.

Practical Usage Examples

The following commands demonstrate how to initiate reviews under different scenarios:

# Review all changes in the current workspace (staged, unstaged, untracked)

ocr review

# Review a specific branch range using merge-base comparison

ocr review --from master --to develop

# Analyze a single commit by hash

ocr review --commit a1b2c3d

# Preview which files would be reviewed without LLM processing

ocr review --preview

# Exclude generated files and test data

ocr review --exclude '**/generated/*,**/testdata/*'

# Include background context from a requirements document

ocr review --background-file ./docs/requirements.md

# Resume an interrupted session using the session ID

ocr review --resume 2023-09-12-abcdef

Key Source Files and Architecture

Understanding the initiation flow requires familiarity with these critical components:

File	Role
cmd/opencodereview/review_cmd.go	Defines the Cobra command structure and orchestrates the end-to-end pipeline
internal/agent/agent.go	Implements the Agent type that executes the LLM-driven review logic
internal/llm/runtime.go	Manages LLM provider configuration and runtime initialization
internal/tool/registry.go	Registers built-in tools available to the LLM during analysis
internal/mcp/client.go	Handles MCP server connections for extended tool capabilities
internal/session/run_manifest.go	Captures and persists review results for output formatting and resume functionality

Summary

• The ocr review CLI command serves as the sole entry point for initiating automated code reviews in the alibaba/open-code-review repository.
• The initiation pipeline validates security constraints through validateReviewRefs before executing any Git operations.
• The system constructs a commonContext to maintain repository state, then initializes LLM runtimes and tool registries.
• An Agent instance orchestrates the actual diff analysis, utilizing registered tools like file_read and code_search to provide context to the LLM.
• Support for resume functionality, background context, and preview mode ensures robust enterprise workflows.

Frequently Asked Questions

What CLI command initiates a code review in Open-Code-Review?

The ocr review command (aliased as ocr r) initiates the review process. Defined in cmd/opencodereview/review_cmd.go, this command accepts flags for commit ranges, exclusion patterns, and background context to customize the analysis scope.

How does Open-Code-Review prevent security issues when processing Git references?

Before executing Git commands, the system calls validateReviewRefs (lines 38-45 in review_cmd.go) to sanitize and validate all Git refs provided via --from, --to, or --commit flags. This prevents ref-option injection attacks that could execute arbitrary shell commands.

Can I preview which files will be reviewed without running the LLM analysis?

Yes. The --preview flag triggers runPreview mode, which generates a file list showing exactly which repository files match the current diff criteria and exclusion patterns without invoking any LLM processing or consuming API tokens.

What happens if a review session is interrupted or fails?

The system captures session state through loadReviewResumeState, assigning a unique session ID (formatted as YYYY-MM-DD-abcdef). Users can resume incomplete reviews by passing this ID to the --resume flag, preventing redundant LLM API calls and preserving progress on large codebases.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}