CodeJackRabbit architecture

Overview

Developer machine                         Your infrastructure
+----------------+    HTTPS / WSS        +---------------------------+
| CLI (cjr)      | --------------------> | api.codejackrabbit.com    |
| VS Code ext.   |                       |  HTTP + WebSocket         |
| GitHub Action  | --------------------> |  review engine            |
+----------------+                       |  coding tasks + webhooks  |
        |                                +-------------+-------------+
        | --local (offline)                            | optional
        v                                +-------------v-------------+
+----------------+                       | LLM provider              |
| packages/core  |                       | OpenAI / Anthropic /      |
| review engine  |                       | local Ollama              |
+----------------+                       +---------------------------+

One engine (packages/core) powers local, server and forge reviews so results have the same shape on every surface. Only the optional LLM pass and externally installed analyzers differ by environment.

Review path

1. The CLI selects committed, uncommitted, staged and optionally untracked Git changes, or a Perforce changelist when requested.
2. It loads .codejackrabbit.yaml, repository guideline files and any extra instruction files passed with --config.
3. Local mode runs the engine in-process. Server mode streams files over WebSocket and may reuse a previous internal state when the reviewed content fingerprint is unchanged.
4. Findings are deduplicated, filtered by learnings and profile rules, stored in local review history and returned as human text or NDJSON.

Maximum serialized review payload: 100 MiB on both client and server.

Local state

• Windows: %LOCALAPPDATA%\CodeJackRabbit
• macOS: ~/Library/Application Support/CodeJackRabbit
• Linux: $XDG_DATA_HOME/codejackrabbit or ~/.local/share/codejackrabbit
• Test override: CJR_STATE_DIR

It contains authentication, machine id, review history, learnings, installed skills, diagnostics and statistics. It is never used as a server-side source of truth.

Engine layers

1. Built-in deterministic rules for secrets and common correctness or security defects. Detected secret values are not echoed.
2. External analyzers from the tool registry, executed only when installed and enabled; missing binaries are reported honestly.
3. Optional LLM review using repository guidelines, tone and path instructions. A missing provider changes an engine note, not the outcome of the deterministic layers.

Server and tasks

The Node server persists reviews, organizations, users, roles, repositories, learnings, audit records, reports and tasks in Supabase Postgres when CJR_DATABASE_URL is set, and otherwise in one atomic JSON store for self-hosted deployments. Every coding task owns a clean Git workspace. Its plan is versioned and hashed. Patches are generated mechanically from findings and content generators first, then by a configured LLM, and are validated with git apply --check before they can be ready. Delivery commits to the task branch or creates a stacked pull request.

HTTP and WebSocket surfaces are specified in protocol.md.