aireview 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6f428bec4ae96692e65cd9f219856dff87e04e75dec45448dc9ef6806dd6694a
-  data.tar.gz: 515afe0ed7450df6cfcb2ce12040780a9c0f45bbbc45fef08f19c4601239908b
+  metadata.gz: 394d2acbc7ed98d03e3a1f87e61fd9f07e1985b40ad47e4086fce47e5a18f5be
+  data.tar.gz: 85598cb2c2e81f95ff59e40bb5d2cef47d4813caf49f0ef318cf5931651adbf7
 SHA512:
-  metadata.gz: 97cf66d34a0dee0d02823a3d37ad37b85aefeb4a0e2b997cd9f8c0780c3df9816d7c95f520709d3cc668d3910bf749f26553da2001b0878c0935bf117b6a486d
-  data.tar.gz: c9ede525f15c46b1ce3371c7a77394933599bc71c6900f79dcea5a6780a29621378e7cd6d5652480921cefe84e6513c4865bd81265523fb6436752f9b35a422d
+  metadata.gz: c45f78bc422def8e2392499ba1dc0e7f87e67183bad8b9e9a29b3b242512caf0a006511922ad32f6a237d6e971578861a86ebb5107790e86e4c3e34598d9c6e6
+  data.tar.gz: fb33990e5743821e8bef7900241ff6b5b7d7f575d3a22ac3eb645990c7050e792d46927c71d401ab659e200366e23acacb9d4f62eef6c74e70e78e7a76bc9111

data/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.3.0
+
+- Fallback models per stage (`llm.<stage>.fallbacks`,
+  `LLM_<STAGE>_FALLBACK_MODEL`) and fallback API keys (`GEMINI_API_KEYS`).
+  An overloaded model or a timeout switches to the next model after one
+  short retry; an exhausted daily quota switches to the next key without
+  waiting; the last route keeps the full retry schedule.
+- A time budget for the LLM part of the run (`llm.time_budget`,
+  `LLM_TIME_BUDGET`, 30 minutes by default) bounds pauses and request
+  timeouts; the built-in RubyLLM retries are disabled.
+- The report names the fallback model a stage used; `--dry-run` prints the
+  chains and the number of keys; `--no-fallbacks` disables the reserves.
+- Candidates are checked against the diff shown to the model: a file outside
+  the merge request drops the candidate, a line outside the shown hunks is
+  reset, a quote not found in the diff is marked in the report and reported
+  to Critique.
+- Critique is skipped when Generate returns no candidates.
+- Report limits are applied after selecting the findings to show, so a
+  finding that is never shown no longer displaces a useful one.
+
 ## 0.2.1
 
 - An overloaded LLM (503) gets a fifth attempt: the pauses are now about

data/README.md

@@ -59,15 +59,19 @@ JIRA_URL=https://jira.company.com
 JIRA_LOGIN=user
 JIRA_PASSWORD=xxx
 GEMINI_API_KEY=xxx
+GEMINI_API_KEYS=xxx,yyy
 LLM_PROVIDER=gemini
 LLM_TEMPERATURE=0
-LLM_TIMEOUT=60
+LLM_TIMEOUT=120
+LLM_TIME_BUDGET=1800
 LLM_HTTP_PROXY=http://127.0.0.1:8888
 LLM_GENERATE_PROVIDER=gemini
 LLM_GENERATE_MODEL=gemini-3.7-flash
+LLM_GENERATE_FALLBACK_MODEL=gemini-3.8-flash
 LLM_GENERATE_TEMPERATURE=0.3
 LLM_CRITIQUE_PROVIDER=gemini
 LLM_CRITIQUE_MODEL=gemini-3.8-flash
+LLM_CRITIQUE_FALLBACK_MODEL=gemini-3.7-flash
 LLM_CRITIQUE_TEMPERATURE=0
 REVIEW_LANGUAGE=ru
 REVIEW_MODE=update
@@ -162,10 +166,14 @@ To run both stages locally, set `ollama` in both provider variables. The
 address with `/v1` matches the
 [Ollama configuration in RubyLLM](https://rubyllm.com/configuration/#provider-configuration).
 `LLM_TIMEOUT` sets the timeout of every LLM request in seconds; for a slow
-local model it can be raised. It does not apply to an "overloaded" (503)
-answer from the provider: such a request gets up to five attempts, the
-original one and four retries with pauses of about 2, 5, 5 and 5 minutes, and
-only the failed stage is repeated, not the whole run.
+local model it can be raised, but not without limit: a hung request holds
+the job for exactly that long while a fallback model sits idle. An
+"overloaded" (503) answer from the provider or a timeout does not fail the
+run right away: without a fallback model such a request gets up to five
+attempts, the original one and four retries with pauses of about 2, 5, 5 and
+5 minutes; with a fallback model, one short retry and a switch (see
+"Fallback models and keys"). Only the failed stage is repeated, not the
+whole run.
 
 Project rules live in `.aireview.yml`. In YAML the `generate.model` and
 `critique.model` settings are required for each stage and are not inherited
@@ -213,13 +221,19 @@ context:
 llm:
   provider: gemini
   temperature: 0
-  timeout: 60
+  timeout: 120
+  time_budget: 1800
   http_proxy: http://127.0.0.1:8888
   max_prompt_chars: 400000
   generate:
     provider: gemini
     model: gemini-3.7-flash
     temperature: 0.3
+    fallbacks:
+      - gemini-3.8-flash
+      - provider: ollama
+        model: qwen2.5-coder:7b
+        max_prompt_chars: 20000
   critique:
     provider: ollama
     model: qwen2.5-coder:7b
@@ -264,6 +278,77 @@ with an error instead of silently reviewing less. Raise the limits or extend
 `ignore_paths`. `--dry-run` prints the sizes of every part and the coverage;
 `--verbose` logs them during a real run.
 
+### Fallback models and keys
+
+The primary model can sit under load (503) for half a day, and a key can run
+out of its daily quota. Neither is cured by waiting, so a stage can have a
+fallback model and a provider can have a fallback key:
+
+- `llm.generate.fallbacks` / `llm.critique.fallbacks` in YAML or
+  `LLM_GENERATE_FALLBACK_MODEL` / `LLM_CRITIQUE_FALLBACK_MODEL` in the
+  environment. One model or several separated by commas, in the order they
+  are tried. The provider goes before a slash (`ollama/qwen2.5-coder:7b`);
+  without it the stage provider is used. A fallback model can have its own
+  `max_prompt_chars`: when the assembled request does not fit, that model is
+  skipped, the context is not cut for it.
+- `GEMINI_API_KEYS=key1,key2`: keys in order of preference; `GEMINI_API_KEY`
+  still works and means a single key. Google counts quotas per Google Cloud
+  project and per model, so a reserve key only makes sense from another
+  project. Use fallback credentials in compliance with the provider's quota
+  and billing terms: Google's
+  [API limitations](https://developers.google.com/terms#api_limitations)
+  forbid circumventing its limits regardless of the project's billing. Keys
+  live only in the environment, never in `.aireview.yml`.
+
+What happens on which error:
+
+| Error | Reaction |
+|---|---|
+| Daily quota (`quotaId` like `…PerDay…` in Google's answer) | No retries: the next key on the same model. The "key + model" pair is remembered until the end of the run so that Critique and the JSON repair do not hit it again. Out of keys: the next model with the first key. |
+| Per-minute limit (429 with a "retry in N s" hint) | Retry after the hinted delay; one retry while there is somewhere to switch to, up to three on the last route. Then the next key, then the next model. |
+| Overloaded (503) or timeout | One short retry (~30 s) and the next model with the same key. The last model in the chain gets the full 2/5/5/5 minute schedule. |
+| Other API errors (schema, context length, auth) | The run fails right away: a fallback model would answer the same. |
+
+All of this is bounded by a time budget for the LLM part of the run:
+`llm.time_budget` / `LLM_TIME_BUDGET`, 1800 seconds by default. A pause that
+does not fit into the remainder is skipped and the request timeout is capped
+by the remainder; when the time is up, the run fails with an error listing
+everything that was tried. Because of this keep `LLM_TIMEOUT` around 120–300
+seconds: one hung request must not eat the whole budget.
+
+The review key (see "A single comment per merge request") is computed from
+the configured primary model, not from the one that answered: a review made
+by a fallback model is not rewritten on the next push without changes in the
+MR, and adding a fallback model to the config does not re-run the review on
+every open MR. When a stage went to a fallback model, the report ends with a
+`Fallback model used: critique — …` line. A key switch stays in the log only,
+and key values never reach the log. `--dry-run` prints the model chains and
+the number of keys per provider, `--no-fallbacks` leaves one model and one
+key per stage.
+
+### Checking that findings point at the diff
+
+Between the passes every candidate is checked against the diff that actually
+went to the model (after `ignore_paths`, secret scrubbing and the budget
+cut). What is checked is the link to the code, not the bug itself:
+
+- `file` is not among the changed files of the MR (renames included): the
+  candidate is dropped before Critique, there is nothing to check it
+  against. A file of the MR that was left out of the context by the budget
+  is a different case, see below.
+- `line` falls into none of the shown hunks: the report shows the finding
+  without a line number.
+- `quoted_code` is not found in the shown diff (compared ignoring
+  whitespace, on the new and on the old side): the candidate stays, but the
+  "Where" line of the report gets `(quote not found in the diff)`. Critique
+  cannot fix the quote, so the mark survives its keep.
+- The file is shown partially, without a diff or not at all: the link cannot
+  be checked, and the coverage block of the report already says so.
+
+Critique receives the result of the check in the candidate's `note` field
+and decides keep/reject with it in mind. With `--no-critique` the check works
+the same way, its marks just go straight to the report.
+
 ## Usage
 
 ```bash
@@ -284,6 +369,7 @@ bundle _2.3.26_ exec bin/aireview review https://gitlab.company.com/team/project
 - `--no-jira` turns off the Jira enrichment even when the MR carries an issue key.
 - `--dry-run` prints the LLM settings, the context sizes and coverage, and the Generate prompt, plus the Critique prompt unless `--no-critique` is given.
 - `--no-critique` skips the second pass and renders the Generate candidates directly.
+- `--no-fallbacks` uses only the primary model and the first API key of each stage.
 - `--review-mode MODE` sets the behaviour when a review has already been published: `update` or `once`.
 - `--force` reviews again even when a review for this state of the MR is already published.
 
@@ -372,13 +458,13 @@ aireview:
       - stuck_or_timeout_failure
 ```
 
-`timeout: 45m` is a chosen ceiling, not a guarantee that every retry fits in:
-when the provider is overloaded, one stage can wait up to ~20 minutes of
-pauses plus up to five requests of `LLM_TIMEOUT` each, and there are two
-stages.
+`timeout: 45m` is the job ceiling, not a guarantee: the LLM part of the run
+is itself bounded by `LLM_TIME_BUDGET` (30 minutes by default, pauses and
+fallback models included), the rest is reading the MR and Jira and
+publishing.
 
-Set secrets such as `GITLAB_TOKEN`, `GEMINI_API_KEY` and the optional Jira
-credentials in the GitLab CI/CD variables. If the job should publish the result
+Set secrets such as `GITLAB_TOKEN`, `GEMINI_API_KEY` / `GEMINI_API_KEYS` and
+the optional Jira credentials in the GitLab CI/CD variables. If the job should publish the result
 back to the merge request, add `--post` to the review command.
 
 For runners where the LLM provider is only reachable over WireGuard, bring up a

data/config/.aireview.yml.example

@@ -27,5 +27,12 @@ review_instructions: |
 
 llm:
   provider: gemini
-  model: gemini-3.7-flash
   temperature: 0.2
+  generate:
+    model: gemini-3.7-flash
+    fallbacks:
+      - gemini-3.8-flash
+  critique:
+    model: gemini-3.8-flash
+    fallbacks:
+      - gemini-3.7-flash

data/lib/aireview/candidate_checker.rb

@@ -0,0 +1,167 @@
+# frozen_string_literal: true
+require 'logger'
+require 'set'
+
+module Aireview
+  # Механическая проверка привязки кандидата к коду по тому диффу, который
+  # реально ушёл в модель: файл, строка, цитата. Проверяется привязка, а не
+  # сам баг: ненайденная цитата — повод критику присмотреться, не
+  # доказательство выдумки. Файл, которого нет среди изменений MR, — другое
+  # дело: такого кандидата проверять нечем, он отбрасывается.
+  class CandidateChecker
+    HUNK_HEADER = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/
+    FILE_HEADER = %r{^diff --git a/(.+?) b/(.+)$}
+    NOTE_QUOTE_NOT_FOUND = 'quoted_code not found in the diff shown to the model'
+    NOTE_LINE_RESET = 'line was outside the shown hunks and has been reset to null'
+    NOTE_NOT_VERIFIED = 'file shown partially or without a diff, location not verified'
+
+    # Один файл из контекста: диапазоны строк нового файла по показанным
+    # хункам и нормализованный текст каждого хунка для поиска цитаты —
+    # отдельно новая сторона (контекст + добавленные строки) и старая
+    # (контекст + удалённые), чтобы многострочная цитата из одной версии
+    # файла находилась целиком. Хунки не склеиваются: между ними пропущенный
+    # код, и цитата через границу хунка — не цитата.
+    Section = Struct.new(:ranges, :hunks, :partial, keyword_init: true) do
+      def include?(quote)
+        hunks.any? { |hunk| hunk[:new_text].include?(quote) || hunk[:old_text].include?(quote) }
+      end
+    end
+
+    def initialize(changes:, diff_text:, coverage:, logger: Logger.new($stderr))
+      @mr_paths = changes.flat_map { |change| change.values_at('old_path', 'new_path') }.compact.to_set
+      @coverage = coverage
+      @logger = logger
+      @sections = parse_sections(diff_text.to_s)
+    end
+
+    # Возвращает кандидатов с пометками: note для критика, quote_missing для
+    # отчёта, line сброшена в null, если не подтвердилась. Кандидаты с файлом
+    # не из MR отброшены.
+    def check(candidates)
+      candidates.filter_map do |candidate|
+        id = value(candidate, 'id')
+        path = resolve_path(value(candidate, 'file'))
+        unless path
+          @logger.warn("Candidate #{id} dropped: file #{value(candidate, 'file').inspect} is not in the merge request")
+          next
+        end
+
+        annotate(candidate.dup, id: id, section: @sections[path])
+      end
+    end
+
+    private
+
+    def annotate(candidate, id:, section:)
+      notes = []
+      if section.nil? || section.partial
+        @logger.debug("Candidate #{id}: file shown partially or not at all, location not verified")
+        notes << NOTE_NOT_VERIFIED
+      else
+        notes << check_line(candidate, id, section)
+        notes << check_quote(candidate, id, section)
+      end
+      notes.compact!
+      set(candidate, 'note', notes.join('; ')) unless notes.empty?
+      candidate
+    end
+
+    def check_line(candidate, id, section)
+      line = value(candidate, 'line')
+      return nil if line.nil?
+      return nil if line.is_a?(Integer) && section.ranges.any? { |range| range.cover?(line) }
+
+      @logger.warn("Candidate #{id}: line #{line} is outside the shown hunks, reset to null")
+      set(candidate, 'line', nil)
+      NOTE_LINE_RESET
+    end
+
+    def check_quote(candidate, id, section)
+      quote = normalize_text(value(candidate, 'quoted_code'))
+      return nil if quote.empty? || section.include?(quote)
+
+      @logger.warn("Candidate #{id}: quoted_code not found in the diff shown to the model")
+      set(candidate, 'quote_missing', true)
+      NOTE_QUOTE_NOT_FOUND
+    end
+
+    # Дифф уже собран под бюджет: у показанного частично файла хунков может
+    # не хватать, у файла без диффа хунков нет вовсе. Заголовки --- / +++
+    # бывают только между заголовком файла и первым @@; внутри хунка строка
+    # «+++ x» — это добавленный код «++ x».
+    def parse_sections(diff_text)
+      sections = {}
+      section = nil
+      hunk = nil
+      diff_text.each_line do |line|
+        if (header = line.match(FILE_HEADER))
+          section = Section.new(ranges: [], hunks: [], partial: false)
+          hunk = nil
+          header.captures.map(&:strip).each { |path| sections[path] = section }
+        elsif section && (hunk_header = line.match(HUNK_HEADER))
+          hunk = start_hunk(section, hunk_header)
+        elsif hunk
+          add_line(hunk, line)
+        end
+      end
+      mark_partial(sections)
+      normalize_hunks(sections)
+    end
+
+    # Хунк без новых строк (удаление, @@ -1 +0,0 @@) диапазона не даёт:
+    # строки 0 в новом файле нет.
+    def start_hunk(section, header)
+      start = header[1].to_i
+      length = header[2] ? header[2].to_i : 1
+      section.ranges << (start..(start + length - 1)) if length.positive?
+      hunk = {new_text: +'', old_text: +''}
+      section.hunks << hunk
+      hunk
+    end
+
+    def add_line(hunk, line)
+      if line.start_with?(' ')
+        hunk[:new_text] << line[1..]
+        hunk[:old_text] << line[1..]
+      elsif line.start_with?('+')
+        hunk[:new_text] << line[1..]
+      elsif line.start_with?('-')
+        hunk[:old_text] << line[1..]
+      end
+    end
+
+    def normalize_hunks(sections)
+      sections.each_value do |section|
+        section.hunks.each { |hunk| hunk.transform_values! { |text| normalize_text(text) } }
+      end
+    end
+
+    def mark_partial(sections)
+      partial = @coverage.files_partial.map { |file| file[:path] } + @coverage.files_unavailable
+      partial += @coverage.hunks_skipped.map { |skipped| skipped[:path] }
+      partial.each { |path| sections[path]&.partial = true }
+    end
+
+    # Сначала точное совпадение: каталоги a/ и b/ бывают настоящими. Префикс
+    # из заголовка диффа снимается только если точного пути в MR нет.
+    def resolve_path(path)
+      path = path.to_s.strip
+      return path if @mr_paths.include?(path)
+
+      stripped = path.sub(%r{\A(?:\./|[ab]/)}, '')
+      stripped if @mr_paths.include?(stripped)
+    end
+
+    def normalize_text(text)
+      text.to_s.gsub(/\s+/, ' ').strip
+    end
+
+    def value(hash, key)
+      hash[key] || hash[key.to_sym]
+    end
+
+    def set(hash, key, new_value)
+      hash[hash.key?(key.to_sym) ? key.to_sym : key] = new_value
+    end
+  end
+end

data/lib/aireview/cli.rb

@@ -68,7 +68,8 @@ module Aireview
         generate_model: options[:generate_model],
         critique_model: options[:critique_model],
         generate_temperature: options[:generate_temperature],
-        critique_temperature: options[:critique_temperature]
+        critique_temperature: options[:critique_temperature],
+        no_fallbacks: options[:no_fallbacks] == true
       )
       config.require_llm_configuration!
       config
@@ -280,6 +281,10 @@ module Aireview
       parser.on('--no-critique', 'Skip critique pass and render Generate candidates directly') do
         options[:no_critique] = true
       end
+
+      parser.on('--no-fallbacks', 'Use only the primary model and the first API key of each stage') do
+        options[:no_fallbacks] = true
+      end
     end
 
     def add_publication_options(parser, options)
@@ -349,6 +354,7 @@ module Aireview
           --no-jira        Disable Jira enrichment
           --dry-run        Print prompts without LLM calls
           --no-critique    Skip second LLM critique pass
+          --no-fallbacks   Use only the primary model and the first API key of each stage
           --verbose        Enable verbose logging
           -h, --help       Show help
       HELP

data/lib/aireview/config.rb

@@ -5,11 +5,14 @@ require 'yaml'
 require_relative 'errors'
 require_relative 'utils'
 require_relative 'config_limits'
+require_relative 'config_fallbacks'
 
 module Aireview
   class Config
     include ConfigLimits
+    include ConfigFallbacks
     extend ConfigLimits::ClassMethods
+    extend ConfigFallbacks::ClassMethods
 
     DEFAULT_SECRET_FILES = [
       '.env',
@@ -39,7 +42,8 @@ module Aireview
         'provider' => 'gemini',
         'temperature' => 0,
         'timeout' => 60,
-        'max_prompt_chars' => ConfigLimits::DEFAULT_MAX_PROMPT_CHARS
+        'max_prompt_chars' => ConfigLimits::DEFAULT_MAX_PROMPT_CHARS,
+        'time_budget' => ConfigFallbacks::DEFAULT_TIME_BUDGET
       },
       'context' => ConfigLimits::CONTEXT_DEFAULTS
     }.freeze
@@ -104,6 +108,7 @@ module Aireview
         .merge('llm' => llm_env_config(env))
         .merge(context_env_config(env))
         .merge(provider_key_env_config(env))
+        .merge(provider_keys_env_config(env))
         .merge(generic_api_key_env_config(env))
     end
 
@@ -120,6 +125,7 @@ module Aireview
         'temperature' => parse_float(env['LLM_TEMPERATURE']),
         'timeout' => parse_float(env['LLM_TIMEOUT']),
         'max_prompt_chars' => parse_integer(env['LLM_MAX_PROMPT_CHARS'], 'LLM_MAX_PROMPT_CHARS'),
+        'time_budget' => parse_integer(env['LLM_TIME_BUDGET'], 'LLM_TIME_BUDGET'),
         'generate' => llm_stage_env_config(env, 'GENERATE'),
         'critique' => llm_stage_env_config(env, 'CRITIQUE')
       }.compact.reject { |key, value| %w[generate critique].include?(key) && value.empty? }
@@ -130,7 +136,8 @@ module Aireview
         'provider' => env["LLM_#{stage}_PROVIDER"],
         'model' => env["LLM_#{stage}_MODEL"],
         'temperature' => parse_float(env["LLM_#{stage}_TEMPERATURE"]),
-        'max_prompt_chars' => parse_integer(env["LLM_#{stage}_MAX_PROMPT_CHARS"], "LLM_#{stage}_MAX_PROMPT_CHARS")
+        'max_prompt_chars' => parse_integer(env["LLM_#{stage}_MAX_PROMPT_CHARS"], "LLM_#{stage}_MAX_PROMPT_CHARS"),
+        'fallbacks' => fallback_models_env_config(env, stage)
       }.compact
     end
 
@@ -187,23 +194,25 @@ module Aireview
       @logger = logger
     end
 
+    # Переопределения из CLI меняют только основную модель стадии, запасные
+    # из конфига остаются; no_fallbacks оставляет одну модель и один ключ.
     def with_overrides(
       generate_model: nil,
       critique_model: nil,
       generate_temperature: nil,
-      critique_temperature: nil
+      critique_temperature: nil,
+      no_fallbacks: false
     )
       llm_config = {
         'generate' => stage_overrides(model: generate_model, temperature: generate_temperature),
         'critique' => stage_overrides(model: critique_model, temperature: critique_temperature)
       }.reject { |_, overrides| overrides.empty? }
-      return self if llm_config.empty?
+      overrides = {}
+      overrides['llm'] = llm_config unless llm_config.empty?
+      overrides['fallbacks_disabled'] = true if no_fallbacks
+      return self if overrides.empty?
 
-      merged = self.class.deep_merge(
-        @data,
-        'llm' => llm_config
-      )
-      self.class.new(merged, config_path: config_path, logger: @logger)
+      self.class.new(self.class.deep_merge(@data, overrides), config_path: config_path, logger: @logger)
     end
 
     def gitlab_url
@@ -334,20 +343,21 @@ module Aireview
     def require_llm_configuration!
       require_models!
 
-      missing_keys = {
-        'generate' => generate_provider,
-        'critique' => critique_provider
-      }.filter_map do |stage, provider|
-        next if provider.to_s == 'ollama'
-        next if Aireview::Utils.present?(provider_api_key(provider))
-
-        "#{stage}: API key is required for provider #{provider.inspect}"
+      missing_keys = ConfigLimits::LLM_STAGES.flat_map do |stage|
+        providers = stage_chain(stage).map(&:provider).uniq.reject { |provider| provider_keys_present?(provider) }
+        providers.map { |provider| "#{stage}: API key is required for provider #{provider.inspect}" }
       end
       raise ConfigError, missing_keys.join(', ') unless missing_keys.empty?
     end
 
     private
 
+    def provider_keys_present?(provider)
+      return true if ConfigFallbacks::KEYLESS_PROVIDERS.include?(provider.to_s)
+
+      provider_api_keys(provider).any? { |key| Aireview::Utils.present?(key) }
+    end
+
     def stage_overrides(model:, temperature:)
       {
         'model' => model,

data/lib/aireview/config_fallbacks.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+module Aireview
+  # Резервы на случай, когда основная модель лежит или у ключа кончилась
+  # квота: цепочка моделей на стадию и список ключей на провайдера. Модели
+  # задаются в .aireview.yml или env, ключи — только в env.
+  module ConfigFallbacks
+    ModelCandidate = Struct.new(:provider, :model, :max_prompt_chars, keyword_init: true) do
+      def to_s
+        "#{provider}/#{model}"
+      end
+    end
+
+    KNOWN_PROVIDERS = %w[gemini ollama].freeze
+    KEYLESS_PROVIDERS = %w[ollama].freeze
+    PROVIDER_KEYS_MAPPING = {
+      'gemini' => 'GEMINI_API_KEYS'
+    }.freeze
+    DEFAULT_TIME_BUDGET = 1_800
+
+    module ClassMethods
+      # LLM_GENERATE_FALLBACK_MODEL=gemini-3.8-flash (или список через запятую) —
+      # провайдер отделён слэшем, потому что теги Ollama содержат двоеточие.
+      def fallback_models_env_config(env, stage)
+        value = env["LLM_#{stage}_FALLBACK_MODEL"]
+        return nil if Aireview::Utils.blank?(value)
+
+        value.split(',').map(&:strip).reject(&:empty?).map { |item| parse_fallback_item(item) }
+      end
+
+      def parse_fallback_item(item)
+        provider, model = item.split('/', 2)
+        return {'provider' => provider, 'model' => model} if model && KNOWN_PROVIDERS.include?(provider)
+
+        {'model' => item}
+      end
+
+      def provider_keys_env_config(env)
+        PROVIDER_KEYS_MAPPING.each_with_object({}) do |(provider, env_key), config|
+          keys = env[env_key].to_s.split(',').map(&:strip).reject(&:empty?)
+          config["#{provider}_api_keys"] = keys unless keys.empty?
+        end
+      end
+    end
+
+    # Первый элемент — основная модель стадии, дальше запасные в порядке
+    # обхода. Запасная без провайдера наследует провайдера стадии, без
+    # max_prompt_chars — лимит стадии.
+    def stage_chain(stage)
+      stage = stage.to_s
+      primary = ModelCandidate.new(
+        provider: public_send("#{stage}_provider"),
+        model: public_send("#{stage}_model"),
+        max_prompt_chars: max_prompt_chars(stage)
+      )
+      return [primary] if fallbacks_disabled?
+
+      [primary, *fallback_candidates(stage, primary)]
+    end
+
+    # Ключи в порядке предпочтения; для провайдера без ключей — один nil,
+    # чтобы обход цепочки не зависел от провайдера.
+    def provider_api_keys(provider)
+      provider = provider.to_s
+      return [nil] if KEYLESS_PROVIDERS.include?(provider)
+
+      keys = Array(@data["#{provider}_api_keys"]).compact
+      keys = [provider_api_key(provider)].compact if keys.empty?
+      fallbacks_disabled? ? keys.first(1) : keys
+    end
+
+    def fallbacks_disabled?
+      @data['fallbacks_disabled'] == true
+    end
+
+    def fallback_names(stage)
+      stage_chain(stage).drop(1).map(&:to_s)
+    end
+
+    # Только число ключей на провайдера — для --dry-run; значения наружу не
+    # выходят.
+    def api_key_counts(stages)
+      providers = stages.flat_map { |stage| stage_chain(stage).map(&:provider) }.uniq
+      providers.reject { |provider| KEYLESS_PROVIDERS.include?(provider.to_s) }
+        .to_h { |provider| [provider, provider_api_keys(provider).size] }
+    end
+
+    # Общий потолок на все LLM-запросы прогона вместе с паузами между
+    # попытками: цепочка резервов не должна съедать всю CI-джобу.
+    def llm_time_budget
+      positive_integer!(dig('llm', 'time_budget') || DEFAULT_TIME_BUDGET, 'llm.time_budget')
+    end
+
+    private
+
+    def fallback_candidates(stage, primary)
+      Array(dig('llm', stage, 'fallbacks')).each_with_index.map do |item, index|
+        item = {'model' => item} if item.is_a?(String)
+        name = "llm.#{stage}.fallbacks[#{index}]"
+        raise ConfigError, "#{name} must be a model name or a hash with model" unless item.is_a?(Hash)
+        raise ConfigError, "#{name}.model is required" if Aireview::Utils.blank?(item['model'])
+
+        limit = item['max_prompt_chars']
+        ModelCandidate.new(
+          provider: (item['provider'] || primary.provider).to_s,
+          model: item['model'].to_s,
+          max_prompt_chars: limit.nil? ? primary.max_prompt_chars : positive_integer!(limit, "#{name}.max_prompt_chars")
+        )
+      end
+    end
+  end
+end

data/lib/aireview/context_builder.rb

@@ -23,7 +23,7 @@ module Aireview
 
     # Контекст одного прогона: обе стадии получают одинаковые MR, Jira и дифф,
     # усечённые один раз под самую тесную из стадий.
-    Context = Struct.new(:user_prompt, :coverage, :sizes, keyword_init: true)
+    Context = Struct.new(:user_prompt, :diff_text, :coverage, :sizes, keyword_init: true)
 
     def initialize(config:, logger: Logger.new($stderr))
       @config = config
@@ -49,7 +49,7 @@ module Aireview
 
       sizes = context_sizes(fixed: fixed, packed: packed, budget: budget, diff_budget: diff_budget, critique: critique)
       log_sizes(sizes)
-      Context.new(user_prompt: fixed + packed.text, coverage: coverage, sizes: sizes)
+      Context.new(user_prompt: fixed + packed.text, diff_text: packed.text, coverage: coverage, sizes: sizes)
     end
 
     def build_generate_prompt(context)