Local code review without letting the diff leave the machine

You do not have to let the diff leave the machine to have a model read it. The one outbound call goes to the provider you picked — and the real work is in making that provider pluggable.

A review that never leaves the terminal

The problem was this: before a code change goes to another person (or to my future self), it should be possible to get a structured “second pair of eyes” review without leaving the terminal. The diff should not leave the machine, and neither should the review.

What fits in one command

The scope fit into a single command: staged diff, one commit, the working tree, or a PR-style three-dot range. Project rules can be customised through COMMITBRIEF.md, and the output can be produced as a coloured terminal card, as markdown or as a strict JSON schema.

Making the provider pluggable

The shortest-lived part of an LLM tool is the provider it talks to. Two decisions came out of that assumption.

Provider is a registry in the database/sql style. Calling the provider directly would have been the shortest path; you pay for that path with the second provider. With a registry, adding a new provider means one package and one blank import. Anthropic, OpenAI, Gemini and Ollama are API-based; claude-cli and gemini-cli are subprocess-based providers that reuse the user’s existing subscription — all of them implement the same interface.

Git is not read through one path. go-git is pure Go and needs no installation; it covers every commit-based operation, plus status and diff. Its coverage ends at the edges of the working tree: add is supported only in its plain form, and multiple worktrees and index v1/v3 are not supported at all. The pure solution would have been to never fall back to the binary, and then every one of those edges would have been a blind spot for the tool. A hybrid path was chosen: go-git first, the git binary beyond its coverage, both behind the same Repo interface.

Not paying twice for the same diff

The third decision is about cost. An LLM call is billed, and a developer has the same diff reviewed several times a day — before the commit, after the fix, when opening the PR.

If the cache key were the diff alone, the cache would return the wrong answer: the same diff under a different provider, model or language is a different review. So the key has five parts — diff, system prompt, provider, model and language — hashed with SHA256. When the same five arrive again, the call drops to a single disk read, and each call reports what it saved on a Saved: $X line.

The same discipline applies to what gets sent: a three-layer filter narrows what reaches the model — built-in defaults, .commitbriefignore and the semantic filter in COMMITBRIEF.md. “The diff never leaves the machine” meant this; what does leave is also something you choose.

The road to signed binaries

The Labs stage is closed: CommitBrief is now a product with its own domain, signed binaries and a release contract. Details in the portfolio.