@krotovm/gitlab-ai-review 1.0.38 → 1.0.40

package/README.md

@@ -58,6 +58,7 @@ Set these in your project/group CI settings:
 - `AI_PROMPT_PROFILE` (optional, default: `default`; one of `default` \| `weak`). Use `weak` for small or heavily-quantized models (≤ ~7B, local Ollama, etc.). The `weak` profile uses shorter system prompts, positive rules instead of negations, and inline few-shot examples for triage / per-file review / consolidation / verification, which dramatically improves output-format adherence on weak models. When the variable is not set, the profile is auto-detected: if the triage pass returns unparseable JSON with `default` prompts, triage is retried once with `weak` and, on success, the whole run continues with it. Set the variable explicitly to pin a profile and disable auto-detection.
 - `PROJECT_ACCESS_TOKEN` (optional for public projects, but required for most private projects; token with `api` scope)
 - `GITLAB_TOKEN` (optional alias for `PROJECT_ACCESS_TOKEN`)
+- `AI_REVIEW_CONCURRENCY` (optional) — same as `--max-review-concurrency`, handy as a CI/CD variable; the flag wins when both are set.
 - `AI_REVIEW_ARTIFACT_HTML_FILE` (optional, default: `ai-review-report.html`; used with `--include-artifacts`)
 
 `OPENAI_BASE_URL` is passed through to the `openai` SDK client, so you can use any OpenAI-compatible gateway/provider endpoint.
@@ -77,11 +78,29 @@ GitLab provides these automatically in Merge Request pipelines:
 - `--max-total-prompt-chars=220000` - Final hard cap for prompt size (single-pass fallback only).
 - `--triage-diff-chars=2000` - Max chars per file diff sent to the triage pass (Pass 1). Increase for large diffs where the first hunks are mostly git headers.
 - `--max-findings=5` - Max findings in the final review (CI multi-pass only).
-- `--max-review-concurrency=5` - Parallel per-file review API calls (CI multi-pass only).
+- `--max-review-concurrency=2` - Parallel per-file review API calls (CI multi-pass only). Set to 1 for single-GPU backends that queue-starve long requests.
 - `--debug` - Print full error details (stack and API error fields).
 - `--include-artifacts` - Generate a local HTML debug artifact with per-pass outputs/tokens.
 - `--help` - Show help output.
 
+## Benchmark
+
+Head-to-head against [Alibaba OpenCodeReview](https://github.com/alibaba/open-code-review) v1.8.10 (via its official GitLab CI recipe) on a demo MR with 4 seeded bugs: an auth bypass (`API_KEYS` unset → empty key accepted), a rate limiter whose window never resets, an unbounded per-IP counters Map, and a null-deref crash in a stats endpoint. Same MR, same commit range, same backends.
+
+| Tool | Model | Seeded bugs found | Noise (dups / off-target) | Tokens | LLM time |
+| --- | --- | --- | --- | --- | --- |
+| **gitlab-ai-review** | gpt-5.4 | 3 / 4 | 0 | 15.7k | ~17s |
+| OpenCodeReview | gpt-5.4 | 3 / 4 | 2 | 41.5k | ~11s |
+| **gitlab-ai-review** | self-hosted (single GPU) | **4 / 4** | **0** | 37.2k | 7m 24s |
+| OpenCodeReview | self-hosted (single GPU) | 3 / 4 | 8 (incl. 5 duplicates) | 151.8k | 11m 45s |
+
+Notes:
+
+- On gpt-5.4 both tools found the same 3 bugs and both missed the memory leak. OpenCodeReview added two design opinions, one of which (severity "high") suggested removing the very auth feature the MR introduces.
+- On the self-hosted model the multi-pass pipeline (triage → per-file review → consolidate → verify) paid off: all 4 seeded bugs, zero noise. OpenCodeReview posted 11 comments: 3 unique real findings, 5 duplicates, and 3 off-target — its only rate-limiter comment misdiagnosed the bug, and several comments were attributed to the wrong file or line.
+- Weak-model reviews are output-bound on a single GPU: OpenCodeReview generated 40.2k output tokens vs our 18.5k, and consumed 6× our prompt tokens (111.6k vs 18.7k) — that difference is the wall-clock gap.
+- Methodology caveats: single run per cell on one MR; LLM variance applies.
+
 ## Architecture
 
 The reviewer uses a three-pass pipeline optimized for large merge requests:

package/dist/cli/ci-review.js

@@ -7,6 +7,9 @@ import { logToolUsageMinimal, MAX_FILE_TOOL_ROUNDS, MAX_TOOL_ROUNDS, MAX_VERIFIC
 /** Hard deadline per model call, retries included. Must exceed the gateway's own
  *  proxy timeout so the SDK's 5xx retries stay the first line of defense. */
 const COMPLETION_TIMEOUT_MS = 180_000;
+/** Whether to request token usage in streamed completions. Flipped off for the
+ *  rest of the run the first time a gateway rejects stream_options with a 400. */
+let streamUsageSupported = true;
 /** Tool-result caps. Every tool response is re-sent as prompt on each following
  *  round, so oversized results multiply prefill time on self-hosted models. */
 const MAX_TOOL_FILE_CHARS = 12_000;
@@ -74,12 +77,27 @@ async function createCompletionWithDebug(params) {
     // The SDK's own timeout only covers time-to-headers; a stalled SSE body would hang
     // forever without the explicit AbortSignal deadline.
     const { stream: _stream, ...createParams } = request;
+    const attempt = (withUsage) => openaiInstance.chat.completions
+        .stream(withUsage
+        ? { ...createParams, stream_options: { include_usage: true } }
+        : createParams, { signal: AbortSignal.timeout(COMPLETION_TIMEOUT_MS) })
+        .finalChatCompletion();
     try {
-        const completion = await openaiInstance.chat.completions
-            .stream(createParams, {
-            signal: AbortSignal.timeout(COMPLETION_TIMEOUT_MS),
-        })
-            .finalChatCompletion();
+        let completion;
+        try {
+            completion = await attempt(streamUsageSupported);
+        }
+        catch (error) {
+            // Strict OpenAI-compatible gateways 400 on unknown params. Drop the
+            // usage request for the rest of the run and retry this call once.
+            const rejectedStreamOptions = streamUsageSupported &&
+                error?.status === 400 &&
+                String(error?.message ?? "").includes("stream_options");
+            if (!rejectedStreamOptions)
+                throw error;
+            streamUsageSupported = false;
+            completion = await attempt(false);
+        }
         await appendDebugDump(debugDumpFile, debugRecordWriter, {
             kind: "openai_response",
             label: requestLabel,

package/dist/cli/debug-artifacts-html.js

@@ -1,5 +1,6 @@
 /** @format */
 import { writeFile } from "node:fs/promises";
+import { parseReviewFindings } from "../prompt/utils.js";
 function escapeHtml(value) {
     return value
         .replaceAll("&", "&")
@@ -11,31 +12,94 @@ function escapeHtml(value) {
 export async function renderDebugArtifactsHtml(params) {
     const { records, artifactHtmlFile, cliVersion, aiModel } = params;
     const responses = records.filter((r) => r.kind === "openai_response");
+    const requests = records.filter((r) => r.kind === "openai_request");
+    const errors = records.filter((r) => r.kind === "openai_error");
     const byLabel = new Map();
     for (const response of responses) {
         if (typeof response.label === "string")
             byLabel.set(response.label, response);
     }
-    const totalTokens = responses.reduce((sum, r) => sum + Number(r?.response?.usage?.total_tokens ?? 0), 0);
-    const tokenLine = responses
-        .map((r) => {
-        const label = String(r.label ?? "unknown");
-        const tokens = Number(r?.response?.usage?.total_tokens ?? 0);
-        return `${label}: ${tokens}`;
-    })
-        .join(" • ");
+    const requestTsByLabel = new Map();
+    for (const request of requests) {
+        if (typeof request.label === "string" && !requestTsByLabel.has(request.label))
+            requestTsByLabel.set(request.label, String(request.ts ?? ""));
+    }
+    function usageOf(record) {
+        const u = record?.response?.usage;
+        if (u == null)
+            return null;
+        return {
+            prompt: Number(u.prompt_tokens ?? 0),
+            completion: Number(u.completion_tokens ?? 0),
+            total: Number(u.total_tokens ?? 0),
+        };
+    }
+    function sumUsage(labels) {
+        const usage = { prompt: 0, completion: 0, total: 0 };
+        let reported = 0;
+        for (const label of labels) {
+            const u = usageOf(byLabel.get(label));
+            if (u == null)
+                continue;
+            reported += 1;
+            usage.prompt += u.prompt;
+            usage.completion += u.completion;
+            usage.total += u.total;
+        }
+        return { usage, reported };
+    }
+    function tokensText(labels) {
+        const { usage, reported } = sumUsage(labels);
+        if (reported === 0)
+            return "tokens: not reported by backend";
+        return `prompt: ${usage.prompt.toLocaleString()} • completion: ${usage.completion.toLocaleString()} • total: ${usage.total.toLocaleString()}`;
+    }
+    function parseTs(value) {
+        const ms = Date.parse(String(value ?? ""));
+        return Number.isFinite(ms) ? ms : null;
+    }
+    function durationText(labels) {
+        const starts = labels
+            .map((label) => parseTs(requestTsByLabel.get(label)))
+            .filter((n) => n != null);
+        const ends = labels
+            .map((label) => parseTs(byLabel.get(label)?.ts))
+            .filter((n) => n != null);
+        if (starts.length === 0 || ends.length === 0)
+            return "";
+        return `${((Math.max(...ends) - Math.min(...starts)) / 1000).toFixed(1)}s`;
+    }
+    const allLabels = Array.from(byLabel.keys());
+    const triageLabels = allLabels.filter((l) => l.startsWith("triage_pass"));
+    const consolidateLabels = allLabels.filter((l) => l === "consolidate_pass");
+    const verificationLabels = allLabels.filter((l) => l.startsWith("verification_pass"));
+    const mainLabels = allLabels.filter((l) => l.startsWith("main_review"));
+    // Per-file review request groups, in first-seen (chronological) order.
+    const fileGroups = new Map();
+    const fileLabelRe = /^file_review_(.+?)_(?:round_\d+|final_after_tool_limit)$/;
+    for (const response of responses) {
+        const label = typeof response.label === "string" ? response.label : "";
+        const match = label.match(fileLabelRe);
+        if (match == null)
+            continue;
+        const group = fileGroups.get(match[1]) ?? [];
+        group.push(label);
+        fileGroups.set(match[1], group);
+    }
     function getContent(label) {
         const content = byLabel.get(label)?.response?.choices?.[0]?.message?.content;
         return typeof content === "string" ? content : "";
     }
-    function getTokenTriplet(label) {
-        const usage = byLabel.get(label)?.response?.usage;
-        if (usage == null)
-            return "prompt: 0 • completion: 0 • total: 0";
-        return `prompt: ${usage.prompt_tokens ?? 0} • completion: ${usage.completion_tokens ?? 0} • total: ${usage.total_tokens ?? 0}`;
-    }
-    function findTs(label) {
-        return String(byLabel.get(label)?.ts ?? "");
+    function lastContent(labels) {
+        const finalLabel = labels.find((l) => l.endsWith("_final_after_tool_limit"));
+        if (finalLabel != null && getContent(finalLabel).trim() !== "")
+            return getContent(finalLabel);
+        for (let i = labels.length - 1; i >= 0; i -= 1) {
+            const content = getContent(labels[i]);
+            if (content.trim() !== "")
+                return content;
+        }
+        return "";
     }
     function formatAsPrettyJsonIfPossible(value) {
         const trimmed = value.trim();
@@ -106,28 +170,22 @@ export async function renderDebugArtifactsHtml(params) {
         const trimmed = markdown.trim();
         if (trimmed === "")
             return "<pre>No data</pre>";
-        const blocks = trimmed.split(/\n\s*\n/);
-        const items = [];
-        for (const block of blocks) {
-            const lines = block.split("\n").map((l) => l.trimEnd());
-            const title = lines[0] ?? "";
-            const file = lines.find((l) => l.trimStart().startsWith("File:")) ?? "";
-            const line = lines.find((l) => l.trimStart().startsWith("Line:")) ?? "";
-            const why = lines.find((l) => l.trimStart().startsWith("Why:")) ?? "";
-            if (!title.startsWith("- ["))
-                continue;
-            const isHigh = title.toLowerCase().includes("[high]");
-            items.push(`<div class="finding${isHigh ? " high" : ""}"><div class="title">${escapeHtml(title)}</div><div class="meta">${escapeHtml(file)} • ${escapeHtml(line)}</div><div>${escapeHtml(why)}</div></div>`);
-        }
-        if (items.length === 0)
+        const findings = parseReviewFindings(trimmed);
+        if (findings.length === 0)
             return `<pre>${escapeHtml(trimmed)}</pre>`;
-        return items.join("\n");
+        return findings
+            .map((f) => `<div class="finding${f.severity === "high" ? " high" : ""}"><div class="title">${escapeHtml(`[${f.severity}] ${f.title}`)}</div><div class="meta">${escapeHtml(`${f.file}:${f.line}`)}</div><div>${escapeHtml(f.why)}</div></div>`)
+            .join("\n");
+    }
+    function sectionHeader(badge, labels) {
+        const duration = durationText(labels);
+        const parts = [
+            tokensText(labels),
+            duration === "" ? "" : `took ${duration}`,
+            `${labels.length} request(s)`,
+        ].filter((p) => p !== "");
+        return `<div class="row"><span class="badge">${escapeHtml(badge)}</span><span class="tokens">${escapeHtml(parts.join(" • "))}</span></div>`;
     }
-    const triageContent = getContent("triage_pass");
-    const triageContentPretty = formatAsPrettyJsonIfPossible(triageContent);
-    const fileServerLabel = Array.from(byLabel.keys()).find((k) => k.startsWith("file_review_server.js_round_"));
-    const fileCiLabel = Array.from(byLabel.keys()).find((k) => k.startsWith("file_review_.gitlab-ci.yml_round_"));
-    const consolidateLabel = "consolidate_pass";
     function pickVerificationSection() {
         const afterLimit = getContent("verification_pass_final_after_tool_limit");
         if (afterLimit.trim() !== "")
@@ -135,7 +193,7 @@ export async function renderDebugArtifactsHtml(params) {
                 label: "verification_pass_final_after_tool_limit",
                 content: afterLimit,
             };
-        const roundLabels = Array.from(byLabel.keys())
+        const roundLabels = verificationLabels
             .filter((k) => k.startsWith("verification_pass_round_"))
             .sort((a, b) => {
             const na = Number(a.replace("verification_pass_round_", ""));
@@ -154,8 +212,53 @@ export async function renderDebugArtifactsHtml(params) {
         return { label: "verification_pass_round_1", content: "" };
     }
     const verificationSection = pickVerificationSection();
-    const verificationLabel = verificationSection.label;
     const finalStatus = verificationSection.content.trim() !== "" ? "Verified" : "Fallback";
+    // Per-pass token/duration summary table.
+    const passRows = [
+        ["Triage", triageLabels],
+        ...Array.from(fileGroups.entries()).map(([path, labels]) => [`File review — ${path}`, labels]),
+        ["Consolidation", consolidateLabels],
+        ["Verification", verificationLabels],
+        ["Single-pass fallback", mainLabels],
+    ].filter(([, labels]) => labels.length > 0);
+    const cell = (value, opts) => `<td style="padding:6px 8px;border-bottom:1px solid var(--line);${opts?.strong ? "font-weight:700;" : ""}">${value}</td>`;
+    const usageCells = (labels, strong) => {
+        const { usage, reported } = sumUsage(labels);
+        if (reported === 0)
+            return `${cell("n/a", { strong })}${cell("n/a", { strong })}${cell("n/a", { strong })}`;
+        return [usage.prompt, usage.completion, usage.total]
+            .map((n) => cell(escapeHtml(n.toLocaleString()), { strong }))
+            .join("");
+    };
+    const passTableRows = passRows
+        .map(([name, labels]) => `<tr>${cell(escapeHtml(name))}${cell(String(labels.length))}${usageCells(labels)}${cell(escapeHtml(durationText(labels) || "—"))}</tr>`)
+        .join("\n");
+    const totalRow = `<tr>${cell("Total", { strong: true })}${cell(String(allLabels.length), { strong: true })}${usageCells(allLabels, true)}${cell(escapeHtml(durationText(allLabels) || "—"), { strong: true })}</tr>`;
+    const totalUsage = sumUsage(allLabels);
+    const totalTokensText = totalUsage.reported === 0 ? "n/a" : totalUsage.usage.total.toLocaleString();
+    const wallStarts = requests
+        .map((r) => parseTs(r.ts))
+        .filter((n) => n != null);
+    const wallEnds = [...responses, ...errors]
+        .map((r) => parseTs(r.ts))
+        .filter((n) => n != null);
+    const wallText = wallStarts.length > 0 && wallEnds.length > 0
+        ? `${((Math.max(...wallEnds) - Math.min(...wallStarts)) / 1000).toFixed(1)}s`
+        : "n/a";
+    const fileSections = Array.from(fileGroups.entries())
+        .map(([path, labels]) => `<div class="section">${sectionHeader(`file: ${path}`, labels)}${renderFindings(lastContent(labels))}</div>`)
+        .join("\n");
+    const triageRawSections = triageLabels
+        .map((label) => `<div class="section">${sectionHeader(`label: ${label}`, [label])}<pre>${escapeHtml(formatAsPrettyJsonIfPossible(getContent(label)))}</pre></div>`)
+        .join("\n");
+    const errorSection = errors.length === 0
+        ? ""
+        : `<h2>Errors</h2>
+    <div class="section">
+      ${errors
+            .map((e) => `<div class="finding high"><div class="title">${escapeHtml(String(e.label ?? "unknown"))}</div><div class="meta">${escapeHtml(String(e.ts ?? ""))}</div><div>${escapeHtml(`${e?.error?.name ?? ""} ${e?.error?.status ?? ""} ${e?.error?.message ?? ""}`.trim())}</div></div>`)
+            .join("\n")}
+    </div>`;
     const html = `<!doctype html>
 <html lang="en">
 <head>
@@ -167,13 +270,14 @@ export async function renderDebugArtifactsHtml(params) {
     * { box-sizing:border-box; } body { margin:0; background:var(--bg); color:var(--text); font:14px/1.45 Inter,system-ui,sans-serif; padding:24px; }
     .wrap{max-width:1100px;margin:0 auto;} h1,h2{margin:0 0 10px;} h1{font-size:24px;} h2{font-size:18px;margin-top:26px;} .sub{color:var(--muted);margin-bottom:18px;}
     .grid{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:10px;margin:14px 0 22px;} .card{background:var(--panel);border:1px solid var(--line);border-radius:10px;padding:12px;}
-    .k{color:var(--muted);font-size:12px;} .v{font-size:20px;font-weight:700;margin-top:4px;} .ok{color:var(--ok);}
+    .k{color:var(--muted);font-size:12px;} .v{font-size:20px;font-weight:700;margin-top:4px;} .ok{color:var(--ok);} .bad{color:var(--high);}
     .section{background:var(--panel);border:1px solid var(--line);border-radius:12px;padding:14px;margin-bottom:14px;}
     .row{display:flex;align-items:center;justify-content:space-between;gap:10px;flex-wrap:wrap;margin-bottom:10px;}
     .badge{border:1px solid var(--line);background:#16223a;border-radius:999px;padding:2px 10px;font-size:12px;color:var(--muted);}
     .tokens{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:12px;color:var(--muted);}
     .finding{border-left:3px solid var(--med);background:#131f36;padding:10px 12px;border-radius:8px;margin:8px 0;} .finding.high{border-left-color:var(--high);}
     .finding .title{font-weight:700;} .meta{color:var(--muted);font-size:12px;margin:4px 0;}
+    table{width:100%;border-collapse:collapse;font-size:13px;}
     pre{margin:8px 0 0;white-space:pre-wrap;word-break:break-word;background:var(--mono-bg);border:1px solid var(--line);padding:10px;border-radius:8px;font:12px/1.4 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;color:#d7e3ff;}
     @media (max-width:900px){.grid{grid-template-columns:1fr 1fr;}} @media (max-width:520px){.grid{grid-template-columns:1fr;}}
   </style>
@@ -185,16 +289,34 @@ export async function renderDebugArtifactsHtml(params) {
 
     <div class="grid">
       <div class="card"><div class="k">Model</div><div class="v">${escapeHtml(aiModel)}</div></div>
-      <div class="card"><div class="k">Requests</div><div class="v">${escapeHtml(String(records.filter((r) => r.kind === "openai_request").length))}</div></div>
-      <div class="card"><div class="k">Responses</div><div class="v">${escapeHtml(String(responses.length))}</div></div>
+      <div class="card"><div class="k">Requests</div><div class="v">${escapeHtml(String(requests.length))}</div></div>
+      <div class="card"><div class="k">Files reviewed</div><div class="v">${escapeHtml(String(fileGroups.size))}</div></div>
+      <div class="card"><div class="k">Errors</div><div class="v${errors.length > 0 ? " bad" : ""}">${escapeHtml(String(errors.length))}</div></div>
+      <div class="card"><div class="k">Total tokens</div><div class="v">${escapeHtml(totalTokensText)}</div></div>
+      <div class="card"><div class="k">Wall time</div><div class="v">${escapeHtml(wallText)}</div></div>
       <div class="card"><div class="k">Final Status</div><div class="v ok">${escapeHtml(finalStatus)}</div></div>
     </div>
 
-    <h2>Token Usage</h2>
+    <h2>Token Usage by Pass</h2>
     <div class="section">
-      <div class="tokens">${escapeHtml(tokenLine)}</div>
-      <div class="tokens" style="margin-top:6px;"><strong>Total:</strong> ${escapeHtml(totalTokens.toLocaleString())} tokens</div>
+      <table>
+        <thead>
+          <tr style="text-align:left;color:var(--muted);">
+            <th style="padding:6px 8px;border-bottom:1px solid var(--line);">Pass</th>
+            <th style="padding:6px 8px;border-bottom:1px solid var(--line);">Requests</th>
+            <th style="padding:6px 8px;border-bottom:1px solid var(--line);">Prompt</th>
+            <th style="padding:6px 8px;border-bottom:1px solid var(--line);">Completion</th>
+            <th style="padding:6px 8px;border-bottom:1px solid var(--line);">Total</th>
+            <th style="padding:6px 8px;border-bottom:1px solid var(--line);">Duration</th>
+          </tr>
+        </thead>
+        <tbody>
+${passTableRows}
+${totalRow}
+        </tbody>
+      </table>
     </div>
+    ${errorSection}
 
     <h2>Pass 1 — Triage Decisions</h2>
     <div class="section">
@@ -202,28 +324,20 @@ export async function renderDebugArtifactsHtml(params) {
     </div>
 
     <h2>Pass 1 — Triage (raw model output)</h2>
-    <div class="section">
-      <div class="row"><span class="badge">label: triage_pass</span><span class="tokens">${escapeHtml(findTs("triage_pass"))}</span></div>
-      <pre>${escapeHtml(triageContentPretty)}</pre>
-    </div>
+    ${triageRawSections}
 
     <h2>Pass 2 — File Reviews</h2>
-    ${fileServerLabel == null
-        ? ""
-        : `<div class="section"><div class="row"><span class="badge">label: ${escapeHtml(fileServerLabel)}</span><span class="tokens">${escapeHtml(getTokenTriplet(fileServerLabel))}</span></div>${renderFindings(getContent(fileServerLabel))}</div>`}
-    ${fileCiLabel == null
-        ? ""
-        : `<div class="section"><div class="row"><span class="badge">label: ${escapeHtml(fileCiLabel)}</span><span class="tokens">${escapeHtml(getTokenTriplet(fileCiLabel))}</span></div>${renderFindings(getContent(fileCiLabel))}</div>`}
+    ${fileSections === "" ? "<div class=\"section\"><pre>No file review records</pre></div>" : fileSections}
 
     <h2>Pass 3 — Consolidation</h2>
     <div class="section">
-      <div class="row"><span class="badge">label: ${escapeHtml(consolidateLabel)}</span><span class="tokens">${escapeHtml(getTokenTriplet(consolidateLabel))}</span></div>
-      ${renderFindings(getContent(consolidateLabel))}
+      ${sectionHeader("label: consolidate_pass", consolidateLabels)}
+      ${renderFindings(getContent("consolidate_pass"))}
     </div>
 
     <h2>Pass 4 — Verification</h2>
     <div class="section">
-      <div class="row"><span class="badge">label: ${escapeHtml(verificationLabel)}</span><span class="tokens">${escapeHtml(getTokenTriplet(verificationLabel))}</span></div>
+      ${sectionHeader(`label: ${verificationSection.label}`, verificationLabels)}
       ${renderFindings(verificationSection.content)}
     </div>
   </div>

package/dist/cli.js

@@ -33,6 +33,7 @@ function printHelp() {
         "  OPENAI_API_KEY (required)  OpenAI API key.",
         "  OPENAI_BASE_URL (optional)  Custom OpenAI-compatible API base URL.",
         "  AI_MODEL      (optional)  OpenAI chat model, e.g. gpt-4o. Default: gpt-4o-mini.",
+        "  AI_REVIEW_CONCURRENCY (optional)  Same as --max-review-concurrency; the flag wins.",
         "  AI_PROMPT_PROFILE (optional)  Prompt style: \"default\" | \"weak\". Default: default.",
         "                              Use \"weak\" for small/quantized models — shorter prompts,",
         "                              positive rules, and few-shot examples.",
@@ -82,7 +83,10 @@ async function main() {
     const promptLimits = parsePromptLimits(process.argv);
     const triageDiffChars = parseTriageDiffChars(process.argv);
     const maxFindings = parseNumberFlag(process.argv, "max-findings", DEFAULT_MAX_FINDINGS, 1);
-    const reviewConcurrency = parseNumberFlag(process.argv, "max-review-concurrency", DEFAULT_REVIEW_CONCURRENCY, 1);
+    const envConcurrency = Number(envOrUndefined("AI_REVIEW_CONCURRENCY"));
+    const reviewConcurrency = parseNumberFlag(process.argv, "max-review-concurrency", Number.isFinite(envConcurrency) && envConcurrency >= 1
+        ? Math.floor(envConcurrency)
+        : DEFAULT_REVIEW_CONCURRENCY, 1);
     const aiModel = envOrDefault("AI_MODEL", "gpt-4o-mini");
     const promptProfile = readPromptProfileFromEnv();
     const allowProfileAutoDemote = envOrUndefined("AI_PROMPT_PROFILE") == null;

package/dist/prompt/index.js

@@ -53,8 +53,8 @@ export const buildPrompt = ({ changes, limits, allowTools = false, profile = DEF
 // Multi-pass pipeline prompts
 // ---------------------------------------------------------------------------
 export const DEFAULT_MAX_FINDINGS = 5;
-// ponytail: 2 keeps self-hosted gateways under their proxy timeout; raise via
-// --max-review-concurrency on backends that batch well.
+// ponytail: 2 suits most gateways; single-GPU backends that queue-starve past
+// the per-call deadline should set AI_REVIEW_CONCURRENCY=1 (or the flag).
 export const DEFAULT_REVIEW_CONCURRENCY = 2;
 export function buildTriagePrompt(changes, profile = DEFAULT_PROMPT_PROFILE, triageDiffChars = DEFAULT_TRIAGE_DIFF_CHARS) {
     return [

package/dist/prompt/utils.js

@@ -55,10 +55,10 @@ export function sanitizeGitLabMarkdown(input) {
     return withClosedFence;
 }
 const NO_ISSUES_SENTENCE = "No confirmed bugs or high-value optimizations found.";
-export function normalizeReviewFindingsMarkdown(input) {
+/** Parse labeled (`- [high] … File:/Line:/Why:`) or pretty (`**🔴 High — …**`)
+ *  finding blocks out of arbitrary model output. Returns [] when none match. */
+export function parseReviewFindings(input) {
     const normalized = input.replace(/\r\n/g, "\n").trim();
-    if (normalized === "" || normalized === NO_ISSUES_SENTENCE)
-        return normalized;
     // Some providers collapse each finding into one long line.
     // Expand inline markers so parser can recover structured blocks.
     const expanded = normalized
@@ -141,6 +141,13 @@ export function normalizeReviewFindingsMarkdown(input) {
             i = j - 1;
         }
     }
+    return findings;
+}
+export function normalizeReviewFindingsMarkdown(input) {
+    const normalized = input.replace(/\r\n/g, "\n").trim();
+    if (normalized === "" || normalized === NO_ISSUES_SENTENCE)
+        return normalized;
+    const findings = parseReviewFindings(normalized);
     if (findings.length === 0)
         return normalized;
     const severityLabel = {

package/package.json

@@ -1,7 +1,7 @@
 {
   "type": "module",
   "name": "@krotovm/gitlab-ai-review",
-  "version": "1.0.38",
+  "version": "1.0.40",
   "description": "CLI tool to generate AI code reviews for GitLab merge requests.",
   "main": "dist/cli.js",
   "bin": {