@krotovm/gitlab-ai-review 1.0.35 → 1.0.37

package/README.md

@@ -55,7 +55,7 @@ Set these in your project/group CI settings:
 - `OPENAI_API_KEY` (required)
 - `OPENAI_BASE_URL` (optional, for OpenAI-compatible providers/proxies)
 - `AI_MODEL` (optional, default: `gpt-4o-mini`; example: `gpt-4o`)
-- `AI_PROMPT_PROFILE` (optional, default: `default`; one of `default` \| `weak`). Use `weak` for small or heavily-quantized models (≤ ~7B, local Ollama, etc.). The `weak` profile uses shorter system prompts, positive rules instead of negations, and inline few-shot examples for triage / per-file review / consolidation / verification, which dramatically improves output-format adherence on weak models.
+- `AI_PROMPT_PROFILE` (optional, default: `default`; one of `default` \| `weak`). Use `weak` for small or heavily-quantized models (≤ ~7B, local Ollama, etc.). The `weak` profile uses shorter system prompts, positive rules instead of negations, and inline few-shot examples for triage / per-file review / consolidation / verification, which dramatically improves output-format adherence on weak models. When the variable is not set, the profile is auto-detected: if the triage pass returns unparseable JSON with `default` prompts, triage is retried once with `weak` and, on success, the whole run continues with it. Set the variable explicitly to pin a profile and disable auto-detection.
 - `PROJECT_ACCESS_TOKEN` (optional for public projects, but required for most private projects; token with `api` scope)
 - `GITLAB_TOKEN` (optional alias for `PROJECT_ACCESS_TOKEN`)
 - `AI_REVIEW_ARTIFACT_HTML_FILE` (optional, default: `ai-review-report.html`; used with `--include-artifacts`)

package/dist/cli/ci-review.js

@@ -2,7 +2,15 @@
 import OpenAI from "openai";
 import { buildAnswer, buildConsolidatePrompt, buildFileReviewPrompt, buildPrompt, buildTriagePrompt, buildVerificationPrompt, DEFAULT_PROMPT_PROFILE, extractCompletionText, isEmptyReviewBody, NO_FINDINGS_SENTENCE, parseTriageResponseDetailed, parseTriageResponse, } from "../prompt/index.js";
 import { fetchFileAtRef, searchRepository, } from "../gitlab/services.js";
+import { truncateWithMarker } from "../prompt/utils.js";
 import { logToolUsageMinimal, MAX_FILE_TOOL_ROUNDS, MAX_TOOL_ROUNDS, MAX_VERIFICATION_TOOL_ROUNDS, TOOL_NAME_GET_FILE, TOOL_NAME_GREP, } from "./tooling.js";
+/** Hard deadline per model call, retries included. Must exceed the gateway's own
+ *  proxy timeout so the SDK's 5xx retries stay the first line of defense. */
+const COMPLETION_TIMEOUT_MS = 180_000;
+/** Tool-result caps. Every tool response is re-sent as prompt on each following
+ *  round, so oversized results multiply prefill time on self-hosted models. */
+const MAX_TOOL_FILE_CHARS = 12_000;
+const MAX_TOOL_GREP_CHARS = 800;
 function buildTriageDecisions(params) {
     const { changes, triageResult } = params;
     const triageMap = new Map(triageResult.files.map((f) => [f.path, f]));
@@ -63,10 +71,14 @@ async function createCompletionWithDebug(params) {
     });
     // Stream and reassemble: reverse proxies (nginx proxy_read_timeout) return 504 on
     // long silent non-streamed completions; streamed chunks keep the connection alive.
+    // The SDK's own timeout only covers time-to-headers; a stalled SSE body would hang
+    // forever without the explicit AbortSignal deadline.
     const { stream: _stream, ...createParams } = request;
     try {
         const completion = await openaiInstance.chat.completions
-            .stream(createParams)
+            .stream(createParams, {
+            signal: AbortSignal.timeout(COMPLETION_TIMEOUT_MS),
+        })
             .finalChatCompletion();
         await appendDebugDump(debugDumpFile, debugRecordWriter, {
             kind: "openai_response",
@@ -148,8 +160,8 @@ async function handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers) {
             ok: true,
             path,
             ref,
-            content: fileText.slice(0, 30000),
-            truncated: fileText.length > 30000,
+            content: fileText.slice(0, MAX_TOOL_FILE_CHARS),
+            truncated: fileText.length > MAX_TOOL_FILE_CHARS,
         });
     }
     catch (error) {
@@ -185,7 +197,7 @@ async function handleGrepTool(argsRaw, defaultRef, gitLabProjectApiUrl, headers,
         const trimmed = results.map((r) => ({
             path: r.path,
             startline: r.startline,
-            data: r.data.slice(0, 2000),
+            data: r.data.slice(0, MAX_TOOL_GREP_CHARS),
         }));
         return JSON.stringify({ ok: true, query, ref, matches: trimmed });
     }
@@ -642,8 +654,9 @@ async function runVerificationWithTools(params) {
     });
 }
 export async function reviewMergeRequestMultiPass(params) {
-    const { openaiInstance, aiModel, promptLimits, triageDiffChars, changes, refs, gitLabProjectApiUrl, projectId, headers, maxFindings, reviewConcurrency, forceTools, promptProfile = DEFAULT_PROMPT_PROFILE, loggers, debugDumpFile, debugRecordWriter, } = params;
+    const { openaiInstance, aiModel, promptLimits, triageDiffChars, changes, refs, gitLabProjectApiUrl, projectId, headers, maxFindings, reviewConcurrency, forceTools, promptProfile = DEFAULT_PROMPT_PROFILE, allowProfileAutoDemote = false, loggers, debugDumpFile, debugRecordWriter, } = params;
     const { logStep } = loggers;
+    let effectiveProfile = promptProfile;
     logStep(`Pass 1/4: triaging ${changes.length} file(s) ` +
         `(prompt profile=${promptProfile}, triage_diff_chars=${triageDiffChars})`);
     const triageInputs = changes.map((c) => ({
@@ -683,6 +696,44 @@ export async function reviewMergeRequestMultiPass(params) {
     catch (error) {
         logStep(`Triage pass failed: ${error?.message ?? error}. Falling back to single-pass.`);
     }
+    // The triage pass doubles as a capability probe: models that cannot return the
+    // strict triage JSON with the default prompts follow the terser weak-profile
+    // prompts better. Retry triage once with "weak"; on success the remaining
+    // passes run with it. (Self-reported model names are unreliable behind
+    // gateway aliases, so we probe behavior instead of asking.)
+    if (triageResult == null &&
+        triageText != null &&
+        effectiveProfile === "default" &&
+        allowProfileAutoDemote) {
+        logStep("Triage response unparseable with prompt profile=default. Retrying triage with profile=weak.");
+        try {
+            const weakTriageCompletion = await createCompletionWithDebug({
+                openaiInstance,
+                requestLabel: "triage_pass_weak_retry",
+                debugDumpFile,
+                debugRecordWriter,
+                request: {
+                    model: aiModel,
+                    temperature: 0.1,
+                    stream: false,
+                    messages: buildTriagePrompt(triageInputs, "weak", triageDiffChars),
+                    response_format: { type: "json_object" },
+                },
+            });
+            const weakTriageText = extractCompletionText(weakTriageCompletion);
+            const weakParse = weakTriageText != null
+                ? parseTriageResponseDetailed(weakTriageText)
+                : null;
+            if (weakParse?.result != null) {
+                triageResult = weakParse.result;
+                effectiveProfile = "weak";
+                logStep("Weak-profile triage parsed successfully. Continuing all passes with prompt profile=weak.");
+            }
+        }
+        catch (error) {
+            logStep(`Weak-profile triage retry failed: ${error?.message ?? error}.`);
+        }
+    }
     if (triageResult == null) {
         if (triageText != null) {
             const triagePreview = triageText.replace(/\s+/g, " ").trim().slice(0, 200);
@@ -707,7 +758,7 @@ export async function reviewMergeRequestMultiPass(params) {
             projectId,
             headers,
             forceTools,
-            promptProfile,
+            promptProfile: effectiveProfile,
             loggers,
             debugDumpFile,
             debugRecordWriter,
@@ -747,7 +798,7 @@ export async function reviewMergeRequestMultiPass(params) {
                 openaiInstance,
                 aiModel,
                 filePath: change.new_path,
-                fileDiff: change.diff,
+                fileDiff: truncateWithMarker(change.diff, promptLimits.maxDiffChars, change.new_path),
                 summary: triageResult.summary,
                 otherChangedFiles: otherFiles,
                 refs,
@@ -755,7 +806,7 @@ export async function reviewMergeRequestMultiPass(params) {
                 projectId,
                 headers,
                 forceTools,
-                promptProfile,
+                promptProfile: effectiveProfile,
                 loggers,
                 debugDumpFile,
                 debugRecordWriter,
@@ -781,7 +832,7 @@ export async function reviewMergeRequestMultiPass(params) {
         perFileFindings,
         summary: triageResult.summary,
         maxFindings,
-        profile: promptProfile,
+        profile: effectiveProfile,
     });
     if (consolidateMessages == null) {
         const DISCLAIMER = "This comment was generated by AI review bot.";
@@ -811,7 +862,7 @@ export async function reviewMergeRequestMultiPass(params) {
             consolidatedFindings: consolidatedText,
             maxFindings,
             refs,
-            profile: promptProfile,
+            profile: effectiveProfile,
         });
         try {
             const verificationCompletion = await runVerificationWithTools({

package/dist/cli.js

@@ -27,7 +27,7 @@ function printHelp() {
         "  --max-total-prompt-chars=220000",
         "  --triage-diff-chars=2000   Max chars per file diff in triage pass (Pass 1).",
         "  --max-findings=5          Max findings in final review (CI multi-pass only).",
-        "  --max-review-concurrency=5  Parallel per-file review calls (CI multi-pass only).",
+        "  --max-review-concurrency=2  Parallel per-file review calls (CI multi-pass only).",
         "",
         "Env vars:",
         "  OPENAI_API_KEY (required)  OpenAI API key.",
@@ -36,6 +36,8 @@ function printHelp() {
         "  AI_PROMPT_PROFILE (optional)  Prompt style: \"default\" | \"weak\". Default: default.",
         "                              Use \"weak\" for small/quantized models — shorter prompts,",
         "                              positive rules, and few-shot examples.",
+        "                              When unset, an unparseable triage response auto-retries",
+        "                              with \"weak\" and keeps it for the whole run.",
         "  PROJECT_ACCESS_TOKEN (optional)  GitLab Project/Personal Access Token for API calls (required for most private repos; should have api scope).",
         "",
         "CI-only env vars (provided by GitLab):",
@@ -83,7 +85,8 @@ async function main() {
     const reviewConcurrency = parseNumberFlag(process.argv, "max-review-concurrency", DEFAULT_REVIEW_CONCURRENCY, 1);
     const aiModel = envOrDefault("AI_MODEL", "gpt-4o-mini");
     const promptProfile = readPromptProfileFromEnv();
-    logStep(`Prompt profile: ${promptProfile}`);
+    const allowProfileAutoDemote = envOrUndefined("AI_PROMPT_PROFILE") == null;
+    logStep(`Prompt profile: ${promptProfile}${allowProfileAutoDemote ? " (auto: falls back to weak if triage JSON fails)" : ""}`);
     const artifactHtmlFile = INCLUDE_ARTIFACTS
         ? envOrDefault("AI_REVIEW_ARTIFACT_HTML_FILE", "ai-review-report.html")
         : undefined;
@@ -149,6 +152,7 @@ async function main() {
             reviewConcurrency,
             forceTools: FORCE_TOOLS,
             promptProfile,
+            allowProfileAutoDemote,
             loggers,
             debugRecordWriter,
         });

package/dist/prompt/index.js

@@ -53,7 +53,9 @@ export const buildPrompt = ({ changes, limits, allowTools = false, profile = DEF
 // Multi-pass pipeline prompts
 // ---------------------------------------------------------------------------
 export const DEFAULT_MAX_FINDINGS = 5;
-export const DEFAULT_REVIEW_CONCURRENCY = 5;
+// ponytail: 2 keeps self-hosted gateways under their proxy timeout; raise via
+// --max-review-concurrency on backends that batch well.
+export const DEFAULT_REVIEW_CONCURRENCY = 2;
 export function buildTriagePrompt(changes, profile = DEFAULT_PROMPT_PROFILE, triageDiffChars = DEFAULT_TRIAGE_DIFF_CHARS) {
     return [
         buildTriageSystemMessage(profile),

package/package.json

@@ -1,12 +1,15 @@
 {
   "type": "module",
   "name": "@krotovm/gitlab-ai-review",
-  "version": "1.0.35",
+  "version": "1.0.37",
   "description": "CLI tool to generate AI code reviews for GitLab merge requests.",
   "main": "dist/cli.js",
   "bin": {
     "gitlab-ai-review": "dist/cli.js"
   },
+  "engines": {
+    "node": ">=20"
+  },
   "files": [
     "dist/**/*.js",
     "README.md",