@krotovm/gitlab-ai-review 1.0.35 → 1.0.38

package/README.md

@@ -55,7 +55,7 @@ Set these in your project/group CI settings:
 - `OPENAI_API_KEY` (required)
 - `OPENAI_BASE_URL` (optional, for OpenAI-compatible providers/proxies)
 - `AI_MODEL` (optional, default: `gpt-4o-mini`; example: `gpt-4o`)
-- `AI_PROMPT_PROFILE` (optional, default: `default`; one of `default` \| `weak`). Use `weak` for small or heavily-quantized models (≤ ~7B, local Ollama, etc.). The `weak` profile uses shorter system prompts, positive rules instead of negations, and inline few-shot examples for triage / per-file review / consolidation / verification, which dramatically improves output-format adherence on weak models.
+- `AI_PROMPT_PROFILE` (optional, default: `default`; one of `default` \| `weak`). Use `weak` for small or heavily-quantized models (≤ ~7B, local Ollama, etc.). The `weak` profile uses shorter system prompts, positive rules instead of negations, and inline few-shot examples for triage / per-file review / consolidation / verification, which dramatically improves output-format adherence on weak models. When the variable is not set, the profile is auto-detected: if the triage pass returns unparseable JSON with `default` prompts, triage is retried once with `weak` and, on success, the whole run continues with it. Set the variable explicitly to pin a profile and disable auto-detection.
 - `PROJECT_ACCESS_TOKEN` (optional for public projects, but required for most private projects; token with `api` scope)
 - `GITLAB_TOKEN` (optional alias for `PROJECT_ACCESS_TOKEN`)
 - `AI_REVIEW_ARTIFACT_HTML_FILE` (optional, default: `ai-review-report.html`; used with `--include-artifacts`)

package/dist/cli/ci-review.js

@@ -2,7 +2,15 @@
 import OpenAI from "openai";
 import { buildAnswer, buildConsolidatePrompt, buildFileReviewPrompt, buildPrompt, buildTriagePrompt, buildVerificationPrompt, DEFAULT_PROMPT_PROFILE, extractCompletionText, isEmptyReviewBody, NO_FINDINGS_SENTENCE, parseTriageResponseDetailed, parseTriageResponse, } from "../prompt/index.js";
 import { fetchFileAtRef, searchRepository, } from "../gitlab/services.js";
+import { truncateWithMarker } from "../prompt/utils.js";
 import { logToolUsageMinimal, MAX_FILE_TOOL_ROUNDS, MAX_TOOL_ROUNDS, MAX_VERIFICATION_TOOL_ROUNDS, TOOL_NAME_GET_FILE, TOOL_NAME_GREP, } from "./tooling.js";
+/** Hard deadline per model call, retries included. Must exceed the gateway's own
+ *  proxy timeout so the SDK's 5xx retries stay the first line of defense. */
+const COMPLETION_TIMEOUT_MS = 180_000;
+/** Tool-result caps. Every tool response is re-sent as prompt on each following
+ *  round, so oversized results multiply prefill time on self-hosted models. */
+const MAX_TOOL_FILE_CHARS = 12_000;
+const MAX_TOOL_GREP_CHARS = 800;
 function buildTriageDecisions(params) {
     const { changes, triageResult } = params;
     const triageMap = new Map(triageResult.files.map((f) => [f.path, f]));
@@ -63,10 +71,14 @@ async function createCompletionWithDebug(params) {
     });
     // Stream and reassemble: reverse proxies (nginx proxy_read_timeout) return 504 on
     // long silent non-streamed completions; streamed chunks keep the connection alive.
+    // The SDK's own timeout only covers time-to-headers; a stalled SSE body would hang
+    // forever without the explicit AbortSignal deadline.
     const { stream: _stream, ...createParams } = request;
     try {
         const completion = await openaiInstance.chat.completions
-            .stream(createParams)
+            .stream(createParams, {
+            signal: AbortSignal.timeout(COMPLETION_TIMEOUT_MS),
+        })
             .finalChatCompletion();
         await appendDebugDump(debugDumpFile, debugRecordWriter, {
             kind: "openai_response",
@@ -148,8 +160,8 @@ async function handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers) {
             ok: true,
             path,
             ref,
-            content: fileText.slice(0, 30000),
-            truncated: fileText.length > 30000,
+            content: fileText.slice(0, MAX_TOOL_FILE_CHARS),
+            truncated: fileText.length > MAX_TOOL_FILE_CHARS,
         });
     }
     catch (error) {
@@ -185,7 +197,7 @@ async function handleGrepTool(argsRaw, defaultRef, gitLabProjectApiUrl, headers,
         const trimmed = results.map((r) => ({
             path: r.path,
             startline: r.startline,
-            data: r.data.slice(0, 2000),
+            data: r.data.slice(0, MAX_TOOL_GREP_CHARS),
         }));
         return JSON.stringify({ ok: true, query, ref, matches: trimmed });
     }
@@ -642,8 +654,9 @@ async function runVerificationWithTools(params) {
     });
 }
 export async function reviewMergeRequestMultiPass(params) {
-    const { openaiInstance, aiModel, promptLimits, triageDiffChars, changes, refs, gitLabProjectApiUrl, projectId, headers, maxFindings, reviewConcurrency, forceTools, promptProfile = DEFAULT_PROMPT_PROFILE, loggers, debugDumpFile, debugRecordWriter, } = params;
+    const { openaiInstance, aiModel, promptLimits, triageDiffChars, changes, refs, gitLabProjectApiUrl, projectId, headers, maxFindings, reviewConcurrency, forceTools, promptProfile = DEFAULT_PROMPT_PROFILE, allowProfileAutoDemote = false, loggers, debugDumpFile, debugRecordWriter, } = params;
     const { logStep } = loggers;
+    let effectiveProfile = promptProfile;
     logStep(`Pass 1/4: triaging ${changes.length} file(s) ` +
         `(prompt profile=${promptProfile}, triage_diff_chars=${triageDiffChars})`);
     const triageInputs = changes.map((c) => ({
@@ -683,6 +696,44 @@ export async function reviewMergeRequestMultiPass(params) {
     catch (error) {
         logStep(`Triage pass failed: ${error?.message ?? error}. Falling back to single-pass.`);
     }
+    // The triage pass doubles as a capability probe: models that cannot return the
+    // strict triage JSON with the default prompts follow the terser weak-profile
+    // prompts better. Retry triage once with "weak"; on success the remaining
+    // passes run with it. (Self-reported model names are unreliable behind
+    // gateway aliases, so we probe behavior instead of asking.)
+    if (triageResult == null &&
+        triageText != null &&
+        effectiveProfile === "default" &&
+        allowProfileAutoDemote) {
+        logStep("Triage response unparseable with prompt profile=default. Retrying triage with profile=weak.");
+        try {
+            const weakTriageCompletion = await createCompletionWithDebug({
+                openaiInstance,
+                requestLabel: "triage_pass_weak_retry",
+                debugDumpFile,
+                debugRecordWriter,
+                request: {
+                    model: aiModel,
+                    temperature: 0.1,
+                    stream: false,
+                    messages: buildTriagePrompt(triageInputs, "weak", triageDiffChars),
+                    response_format: { type: "json_object" },
+                },
+            });
+            const weakTriageText = extractCompletionText(weakTriageCompletion);
+            const weakParse = weakTriageText != null
+                ? parseTriageResponseDetailed(weakTriageText)
+                : null;
+            if (weakParse?.result != null) {
+                triageResult = weakParse.result;
+                effectiveProfile = "weak";
+                logStep("Weak-profile triage parsed successfully. Continuing all passes with prompt profile=weak.");
+            }
+        }
+        catch (error) {
+            logStep(`Weak-profile triage retry failed: ${error?.message ?? error}.`);
+        }
+    }
     if (triageResult == null) {
         if (triageText != null) {
             const triagePreview = triageText.replace(/\s+/g, " ").trim().slice(0, 200);
@@ -707,7 +758,7 @@ export async function reviewMergeRequestMultiPass(params) {
             projectId,
             headers,
             forceTools,
-            promptProfile,
+            promptProfile: effectiveProfile,
             loggers,
             debugDumpFile,
             debugRecordWriter,
@@ -747,7 +798,7 @@ export async function reviewMergeRequestMultiPass(params) {
                 openaiInstance,
                 aiModel,
                 filePath: change.new_path,
-                fileDiff: change.diff,
+                fileDiff: truncateWithMarker(change.diff, promptLimits.maxDiffChars, change.new_path),
                 summary: triageResult.summary,
                 otherChangedFiles: otherFiles,
                 refs,
@@ -755,7 +806,7 @@ export async function reviewMergeRequestMultiPass(params) {
                 projectId,
                 headers,
                 forceTools,
-                promptProfile,
+                promptProfile: effectiveProfile,
                 loggers,
                 debugDumpFile,
                 debugRecordWriter,
@@ -776,16 +827,20 @@ export async function reviewMergeRequestMultiPass(params) {
     if (failedPaths.length === reviewFiles.length) {
         throw new Error(`All ${reviewFiles.length} per-file reviews failed (e.g. ${failedPaths[0]}). See log above.`);
     }
+    // Deterministic note header: title + triage summary. Prepended in code so
+    // every final-answer path gets it regardless of model formatting discipline.
+    const summaryText = triageResult.summary.trim().replace(/\s*\n\s*/g, " ");
+    const withHeader = (body) => `### 🤖 AI Code Review\n\n${summaryText === "" ? "" : `> ${summaryText}\n\n`}${body}`;
     logStep("Pass 3/4: consolidating findings");
     const consolidateMessages = buildConsolidatePrompt({
         perFileFindings,
         summary: triageResult.summary,
         maxFindings,
-        profile: promptProfile,
+        profile: effectiveProfile,
     });
     if (consolidateMessages == null) {
         const DISCLAIMER = "This comment was generated by AI review bot.";
-        return `${NO_FINDINGS_SENTENCE}\n\n---\n_${DISCLAIMER}_`;
+        return withHeader(`${NO_FINDINGS_SENTENCE}\n\n---\n_${DISCLAIMER}_`);
     }
     try {
         const consolidateCompletion = await createCompletionWithDebug({
@@ -802,7 +857,7 @@ export async function reviewMergeRequestMultiPass(params) {
         });
         const consolidatedText = extractCompletionText(consolidateCompletion);
         if (consolidatedText == null || consolidatedText.trim() === "") {
-            return buildAnswer(consolidateCompletion);
+            return withHeader(buildAnswer(consolidateCompletion));
         }
         logStep("Pass 4/4: verifying consolidated findings (repo tools)");
         const verificationMessages = buildVerificationPrompt({
@@ -811,7 +866,7 @@ export async function reviewMergeRequestMultiPass(params) {
             consolidatedFindings: consolidatedText,
             maxFindings,
             refs,
-            profile: promptProfile,
+            profile: effectiveProfile,
         });
         try {
             const verificationCompletion = await runVerificationWithTools({
@@ -828,11 +883,11 @@ export async function reviewMergeRequestMultiPass(params) {
                 debugDumpFile,
                 debugRecordWriter,
             });
-            return buildAnswer(verificationCompletion);
+            return withHeader(buildAnswer(verificationCompletion));
         }
         catch (error) {
             logStep(`Verification failed: ${error?.message ?? error}. Returning consolidated findings.`);
-            return buildAnswer(consolidateCompletion);
+            return withHeader(buildAnswer(consolidateCompletion));
         }
     }
     catch (error) {
@@ -842,6 +897,6 @@ export async function reviewMergeRequestMultiPass(params) {
             .filter((f) => !isEmptyReviewBody(f.findings))
             .map((f) => f.findings)
             .join("\n");
-        return `${raw || NO_FINDINGS_SENTENCE}\n\n---\n_${DISCLAIMER}_`;
+        return withHeader(`${raw || NO_FINDINGS_SENTENCE}\n\n---\n_${DISCLAIMER}_`);
     }
 }

package/dist/cli.js

@@ -27,7 +27,7 @@ function printHelp() {
         "  --max-total-prompt-chars=220000",
         "  --triage-diff-chars=2000   Max chars per file diff in triage pass (Pass 1).",
         "  --max-findings=5          Max findings in final review (CI multi-pass only).",
-        "  --max-review-concurrency=5  Parallel per-file review calls (CI multi-pass only).",
+        "  --max-review-concurrency=2  Parallel per-file review calls (CI multi-pass only).",
         "",
         "Env vars:",
         "  OPENAI_API_KEY (required)  OpenAI API key.",
@@ -36,6 +36,8 @@ function printHelp() {
         "  AI_PROMPT_PROFILE (optional)  Prompt style: \"default\" | \"weak\". Default: default.",
         "                              Use \"weak\" for small/quantized models — shorter prompts,",
         "                              positive rules, and few-shot examples.",
+        "                              When unset, an unparseable triage response auto-retries",
+        "                              with \"weak\" and keeps it for the whole run.",
         "  PROJECT_ACCESS_TOKEN (optional)  GitLab Project/Personal Access Token for API calls (required for most private repos; should have api scope).",
         "",
         "CI-only env vars (provided by GitLab):",
@@ -83,7 +85,8 @@ async function main() {
     const reviewConcurrency = parseNumberFlag(process.argv, "max-review-concurrency", DEFAULT_REVIEW_CONCURRENCY, 1);
     const aiModel = envOrDefault("AI_MODEL", "gpt-4o-mini");
     const promptProfile = readPromptProfileFromEnv();
-    logStep(`Prompt profile: ${promptProfile}`);
+    const allowProfileAutoDemote = envOrUndefined("AI_PROMPT_PROFILE") == null;
+    logStep(`Prompt profile: ${promptProfile}${allowProfileAutoDemote ? " (auto: falls back to weak if triage JSON fails)" : ""}`);
     const artifactHtmlFile = INCLUDE_ARTIFACTS
         ? envOrDefault("AI_REVIEW_ARTIFACT_HTML_FILE", "ai-review-report.html")
         : undefined;
@@ -149,6 +152,7 @@ async function main() {
             reviewConcurrency,
             forceTools: FORCE_TOOLS,
             promptProfile,
+            allowProfileAutoDemote,
             loggers,
             debugRecordWriter,
         });

package/dist/prompt/index.js

@@ -53,7 +53,9 @@ export const buildPrompt = ({ changes, limits, allowTools = false, profile = DEF
 // Multi-pass pipeline prompts
 // ---------------------------------------------------------------------------
 export const DEFAULT_MAX_FINDINGS = 5;
-export const DEFAULT_REVIEW_CONCURRENCY = 5;
+// ponytail: 2 keeps self-hosted gateways under their proxy timeout; raise via
+// --max-review-concurrency on backends that batch well.
+export const DEFAULT_REVIEW_CONCURRENCY = 2;
 export function buildTriagePrompt(changes, profile = DEFAULT_PROMPT_PROFILE, triageDiffChars = DEFAULT_TRIAGE_DIFF_CHARS) {
     return [
         buildTriageSystemMessage(profile),

package/dist/prompt/utils.js

@@ -70,11 +70,16 @@ export function normalizeReviewFindingsMarkdown(input) {
     const lines = expanded.split("\n");
     const findings = [];
     const headerRe = /^\s*(?:[-*•]\s*)?\[(high|medium)\]\s+(.+?)\s*$/i;
+    // Already-rendered block (see renderer below) — parsing it too keeps this
+    // function idempotent when a model echoes pretty findings back verbatim.
+    const prettyHeaderRe = /^\s*(?:[-*•]\s*)?\*\*(?:🔴|🟠)?\s*(high|medium)\s*[—–-]\s*(.+?)\*\*\s*$/i;
+    const matchHeader = (line) => line.match(headerRe) ?? line.match(prettyHeaderRe);
     const fileRe = /^\s*[-*]?\s*File:\s*(.+?)\s*$/i;
     const lineRe = /^\s*[-*]?\s*Line:\s*(.+?)\s*$/i;
     const whyRe = /^\s*[-*]?\s*Why:\s*(.+?)\s*$/i;
+    const prettyFileLineRe = /^\s*`([^`\n]+?):(~?[^`\n]*)`\s*$/;
     for (let i = 0; i < lines.length; i += 1) {
-        const headerMatch = lines[i].match(headerRe);
+        const headerMatch = matchHeader(lines[i]);
         if (headerMatch == null)
             continue;
         const severity = headerMatch[1].toLowerCase();
@@ -84,9 +89,18 @@ export function normalizeReviewFindingsMarkdown(input) {
         let why = null;
         let j = i + 1;
         while (j < lines.length) {
-            const nextHeader = lines[j].match(headerRe);
+            const nextHeader = matchHeader(lines[j]);
             if (nextHeader != null)
                 break;
+            if (file == null && line == null) {
+                const m = lines[j].match(prettyFileLineRe);
+                if (m != null) {
+                    file = m[1].trim();
+                    line = m[2].trim();
+                    j += 1;
+                    continue;
+                }
+            }
             if (file == null) {
                 const m = lines[j].match(fileRe);
                 if (m != null) {
@@ -111,6 +125,15 @@ export function normalizeReviewFindingsMarkdown(input) {
                     continue;
                 }
             }
+            // Pretty blocks carry the why as an unlabeled line after `file:line`.
+            if (why == null && file != null && line != null) {
+                const text = lines[j].trim();
+                if (text !== "" && !/^(-{3,}|_)/.test(text)) {
+                    why = text;
+                    j += 1;
+                    continue;
+                }
+            }
             j += 1;
         }
         if (file != null && line != null && why != null) {
@@ -120,7 +143,11 @@ export function normalizeReviewFindingsMarkdown(input) {
     }
     if (findings.length === 0)
         return normalized;
+    const severityLabel = {
+        high: "🔴 High",
+        medium: "🟠 Medium",
+    };
     return findings
-        .map((f) => `- [${f.severity}] ${f.title}  \n  File: ${f.file}  \n  Line: ${f.line}  \n  Why: ${f.why}`)
+        .map((f) => `- **${severityLabel[f.severity]} — ${f.title}**  \n  \`${f.file}:${f.line}\`  \n  ${f.why}`)
         .join("\n\n");
 }

package/package.json

@@ -1,12 +1,15 @@
 {
   "type": "module",
   "name": "@krotovm/gitlab-ai-review",
-  "version": "1.0.35",
+  "version": "1.0.38",
   "description": "CLI tool to generate AI code reviews for GitLab merge requests.",
   "main": "dist/cli.js",
   "bin": {
     "gitlab-ai-review": "dist/cli.js"
   },
+  "engines": {
+    "node": ">=20"
+  },
   "files": [
     "dist/**/*.js",
     "README.md",