OpenCodeCommit

AI commit, branch, PR, and changelog generation through terminal AI CLIs and direct provider APIs.

OpenCodeCommit works as:

• a VS Code / VSCodium extension
• a Rust / npm CLI (occ)
• a terminal TUI (occ tui)
• a standalone CI/CD scanner in cloud (occ scan)

Before any prompt leaves your machine, OpenCodeCommit scans the diff locally for secrets, credential files, source maps, private keys, and other sensitive artifacts.

• Open VSX
• VS Code Marketplace
• npm
• crates.io
• GitHub

Install

Extension:

• Search for OpenCodeCommit in VS Code or VSCodium marketplace

CLI:

• cargo install opencodecommit
• npm i -g opencodecommit

Optional CLI backends:

• npm i -g @openai/codex
• npm i -g opencode
• npm i -g @anthropic-ai/claude-code
• npm i -g @google/gemini-cli

Direct API backends:

• OpenAI
• Anthropic
• Google Gemini
• OpenRouter
• OpenCode Zen
• Ollama
• LM Studio
• Custom OpenAI-compatible endpoints

Hosted API backends use API keys from environment variables. Ollama and LM Studio can auto-detect the lexicographically first available model when their model field is left empty.

Highlights

• Mixed fallback chains across CLI and API backends from the same backend / backend-order config.
• Commit, PR, branch, and changelog generation from the CLI, TUI, and extension with the same config surface.
• occ scan for CI/CD with text, json, sarif, and github-annotations output modes.
• Built-in languages: English, Finnish, Japanese, Chinese, Spanish, Portuguese, French, Korean, Russian, Vietnamese, and German.
• Terminal TUI with one-shot backend picks and a file sidebar that stages or unstages the selected file with Space.
• Transparent git guard for normal git commit flows.

Quick Start

Extension:

1. Open Source Control.
2. Click the sparkle action.
3. Use the dropdown for refine, branch, PR, language, backend, or diagnose actions.

CLI:

occ tui
occ commit
occ commit --backend openai-api --dry-run --text
occ commit --backend gemini --dry-run --text
occ branch --dry-run
occ pr --backend openrouter-api --text
occ changelog --text
occ scan --format text
occ scan --format sarif --output occ-scan.sarif
occ guard install --global
occ update

Security Scanner

The local scanner checks for:

• provider tokens and webhook URLs for OpenAI, Anthropic, GitHub, GitLab, AWS, Slack, Stripe, SendGrid, npm, PyPI, Docker, Vault, Discord, Teams, and more
• bearer tokens, JWTs, Docker auth blobs, kube auth fields, and credential-bearing connection strings
• .env*, .npmrc, .git-credentials, .kube/config, Terraform state and vars, service-account JSON, key stores, SSH keys, and private key material
• exposed source maps such as *.js.map and *.css.map

Enforcement modes:

• warn
• block-high
• block-all
• strict-high
• strict-all

occ scan reuses the same scanner outside the AI flow. It accepts git diff input, --stdin, or --diff-file, returns 0 when the selected enforcement allows the diff, and returns 2 when blocking findings remain.

Use occ guard profile human for warnings-first local use, or occ guard profile strict-agent when you want non-bypassable blocking behavior for autonomous tooling.

See SENSITIVE.md for the full scanning flow and PROCESS.md for how it fits into generation and CI/CD.

Config

~/.config/opencodecommit/config.toml is the single source of truth for both CLI and extension. On first use, OpenCodeCommit writes the full default config there so every setting is visible in one file. VS Code / VSCodium settings under opencodecommit.* are synced bidirectionally with the file.

Override the path with the OPENCODECOMMIT_CONFIG environment variable.

Useful settings:

• backend
• backend-order
• commit-mode
• branch-mode
• diff-source
• active-language
• commit-template
• sensitive.enforcement
• sensitive.allowlist
• api.openai
• api.anthropic
• api.gemini
• api.openrouter
• api.opencode
• api.ollama
• api.lm-studio
• api.custom

Example:

backend = "openai-api"
backend-order = ["claude", "openai-api", "ollama-api"]

[api.openai]
model = "gpt-5.4-mini"
endpoint = "https://api.openai.com/v1/chat/completions"
key-env = "OPENAI_API_KEY"
pr-model = "gpt-5.4"
cheap-model = "gpt-5.4-mini"

[api.ollama]
model = ""
endpoint = "http://localhost:11434"
key-env = ""

CI/CD

• GitHub Action: action.yml
• Examples: examples/ci/github-actions.yml, examples/ci/azure-pipelines.yml, examples/ci/gitlab-ci.yml

The composite action installs the published opencodecommit package, runs occ scan, can upload SARIF to GitHub code scanning, emits GitHub annotations, and supports a workflow-level manual override that preserves reports without hiding findings.

License

MIT