@krotovm/gitlab-ai-review 1.0.40 → 1.0.42

package/README.md

@@ -2,8 +2,15 @@
 
 # AI Code Reviewer
 
+[![npm](https://img.shields.io/npm/v/@krotovm/gitlab-ai-review)](https://www.npmjs.com/package/@krotovm/gitlab-ai-review)
+[![downloads](https://img.shields.io/npm/dm/@krotovm/gitlab-ai-review)](https://www.npmjs.com/package/@krotovm/gitlab-ai-review)
+[![license](https://img.shields.io/npm/l/@krotovm/gitlab-ai-review)](https://github.com/KrotovM/gitlab-ai-mr-reviewer/blob/main/LICENSE)
+[![GitLab CI/CD Catalog](https://img.shields.io/gitlab/v/release/KrotovM/gitlab-ai-review?label=GitLab%20CI%2FCD%20Catalog&color=fc6d26)](https://gitlab.com/explore/catalog/KrotovM/gitlab-ai-review)
+
 Gitlab AI Code Review is a CLI tool that leverages OpenAI models to automatically review code changes and post a Markdown review to GitLab merge requests from CI.
 
+![AI review comment posted on a GitLab merge request](docs/review.png)
+
 ## Features
 
 - Automatically reviews code changes in GitLab repositories
@@ -30,6 +37,15 @@ ai_review:
     - npx -y @krotovm/gitlab-ai-review
 ```
 
+Or include it as a [CI/CD component from the GitLab Catalog](https://gitlab.com/explore/catalog/KrotovM/gitlab-ai-review) (gitlab.com):
+
+```yaml
+include:
+  - component: gitlab.com/KrotovM/gitlab-ai-review/review@1.0.2
+    inputs:
+      args: "--include-artifacts"
+```
+
 Save debug HTML as a CI artifact:
 
 ```yaml
@@ -48,6 +64,10 @@ ai_review:
       - ai-review-report.html
 ```
 
+The HTML artifact breaks the run down per pass — tokens, durations, triage decisions, per-file findings, and errors:
+
+![AI review debug report artifact](docs/report.png)
+
 ## Env variables
 
 Set these in your project/group CI settings:
@@ -110,3 +130,7 @@ The reviewer uses a three-pass pipeline optimized for large merge requests:
 3. **Consolidate** - Per-file findings are merged, deduplicated, ranked by severity, and trimmed to top N (default 5).
 
 If the triage pass fails (API error, unparseable response), the pipeline falls back to the original single-pass approach automatically.
+
+The pipeline in a CI job log — triage, parallel tool-assisted file reviews, consolidation, verification:
+
+![Multi-pass pipeline in the CI job log](docs/job.png)

package/dist/cli/ci-review.js

@@ -2,7 +2,7 @@
 import OpenAI from "openai";
 import { buildAnswer, buildConsolidatePrompt, buildFileReviewPrompt, buildPrompt, buildTriagePrompt, buildVerificationPrompt, DEFAULT_PROMPT_PROFILE, extractCompletionText, isEmptyReviewBody, NO_FINDINGS_SENTENCE, parseTriageResponseDetailed, parseTriageResponse, } from "../prompt/index.js";
 import { fetchFileAtRef, searchRepository, } from "../gitlab/services.js";
-import { truncateWithMarker } from "../prompt/utils.js";
+import { parseReviewFindings, truncateWithMarker } from "../prompt/utils.js";
 import { logToolUsageMinimal, MAX_FILE_TOOL_ROUNDS, MAX_TOOL_ROUNDS, MAX_VERIFICATION_TOOL_ROUNDS, TOOL_NAME_GET_FILE, TOOL_NAME_GREP, } from "./tooling.js";
 /** Hard deadline per model call, retries included. Must exceed the gateway's own
  *  proxy timeout so the SDK's 5xx retries stay the first line of defense. */
@@ -143,7 +143,7 @@ function buildReviewMetadata(changes, refs) {
         changed_files: files,
         tool_usage_guidance: [
             "If diff context is insufficient, call get_file_at_ref to read a specific file.",
-            "Use grep_repository to search for usages, definitions, or patterns across the codebase.",
+            "Use grep_repository to find usages or definitions by literal text (no regex) across the codebase.",
             "Use refs.base to inspect pre-change content and refs.head for current content.",
             "Prefer targeted searches and file fetches; avoid broad context requests.",
         ],
@@ -161,7 +161,7 @@ async function handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers) {
             });
         }
         const fileText = await fetchFileAtRef({
-            gitLabBaseUrl: gitLabProjectApiUrl,
+            gitLabProjectApiUrl: gitLabProjectApiUrl,
             headers,
             filePath: path,
             ref,
@@ -198,7 +198,7 @@ async function handleGrepTool(argsRaw, defaultRef, gitLabProjectApiUrl, headers,
             return JSON.stringify({ ok: false, error: "query is required." });
         const ref = parsed.ref?.trim() || defaultRef;
         const results = await searchRepository({
-            gitLabBaseUrl: gitLabProjectApiUrl,
+            gitLabProjectApiUrl: gitLabProjectApiUrl,
             headers,
             query,
             ref,
@@ -279,14 +279,14 @@ export async function reviewMergeRequestWithTools(params) {
             type: "function",
             function: {
                 name: TOOL_NAME_GREP,
-                description: "Search the repository for a keyword or pattern. Returns up to 10 matching code fragments with file paths and line numbers.",
+                description: "Search the repository for literal text (case-insensitive substring match). Regular expressions are not supported: `a|b` or `foo.*bar` are searched as literal text, so query one identifier at a time. Returns up to 10 matching code fragments with file paths and line numbers.",
                 parameters: {
                     type: "object",
                     additionalProperties: false,
                     properties: {
                         query: {
                             type: "string",
-                            description: "Search string (keyword, function name, variable, etc.).",
+                            description: "Literal text to find, e.g. a function or variable name (no regex).",
                         },
                         ref: {
                             type: "string",
@@ -424,14 +424,14 @@ async function runFileReviewWithTools(params) {
             type: "function",
             function: {
                 name: TOOL_NAME_GREP,
-                description: "Search the repository for a keyword or pattern. Returns up to 10 matching code fragments with file paths and line numbers.",
+                description: "Search the repository for literal text (case-insensitive substring match). Regular expressions are not supported: `a|b` or `foo.*bar` are searched as literal text, so query one identifier at a time. Returns up to 10 matching code fragments with file paths and line numbers.",
                 parameters: {
                     type: "object",
                     additionalProperties: false,
                     properties: {
                         query: {
                             type: "string",
-                            description: "Search string (keyword, function name, variable, etc.).",
+                            description: "Literal text to find, e.g. a function or variable name (no regex).",
                         },
                         ref: {
                             type: "string",
@@ -564,14 +564,14 @@ async function runVerificationWithTools(params) {
             type: "function",
             function: {
                 name: TOOL_NAME_GREP,
-                description: "Search the repository for a keyword or pattern. Returns up to 10 matching code fragments with file paths and line numbers.",
+                description: "Search the repository for literal text (case-insensitive substring match). Regular expressions are not supported: `a|b` or `foo.*bar` are searched as literal text, so query one identifier at a time. Returns up to 10 matching code fragments with file paths and line numbers.",
                 parameters: {
                     type: "object",
                     additionalProperties: false,
                     properties: {
                         query: {
                             type: "string",
-                            description: "Search string (keyword, function name, variable, etc.).",
+                            description: "Literal text to find, e.g. a function or variable name (no regex).",
                         },
                         ref: {
                             type: "string",
@@ -849,6 +849,22 @@ export async function reviewMergeRequestMultiPass(params) {
     // every final-answer path gets it regardless of model formatting discipline.
     const summaryText = triageResult.summary.trim().replace(/\s*\n\s*/g, " ");
     const withHeader = (body) => `### 🤖 AI Code Review\n\n${summaryText === "" ? "" : `> ${summaryText}\n\n`}${body}`;
+    // Cap transparency: if consolidation likely trimmed the list (final count hit
+    // the cap while per-file review produced more candidates), say so in the note
+    // instead of silently dropping findings.
+    // ponytail: candidates deduped by file+title only; differently-worded dupes
+    // across files still inflate the count, which is why the note says "candidate".
+    const candidateCount = new Set(perFileFindings.flatMap((f) => parseReviewFindings(f.findings).map((x) => `${x.file}|${x.title.toLowerCase()}`))).size;
+    const withCapNote = (body) => {
+        const finalCount = parseReviewFindings(body).length;
+        if (finalCount < maxFindings || candidateCount <= finalCount)
+            return body;
+        const note = `\n\nℹ️ Showing top ${finalCount} of ${candidateCount} candidate findings (\`--max-findings=${maxFindings}\`). Run with \`--include-artifacts\` for the full list.`;
+        const disclaimerAt = body.lastIndexOf("\n\n---\n_");
+        return disclaimerAt === -1
+            ? body + note
+            : body.slice(0, disclaimerAt) + note + body.slice(disclaimerAt);
+    };
     logStep("Pass 3/4: consolidating findings");
     const consolidateMessages = buildConsolidatePrompt({
         perFileFindings,
@@ -875,7 +891,7 @@ export async function reviewMergeRequestMultiPass(params) {
         });
         const consolidatedText = extractCompletionText(consolidateCompletion);
         if (consolidatedText == null || consolidatedText.trim() === "") {
-            return withHeader(buildAnswer(consolidateCompletion));
+            return withHeader(withCapNote(buildAnswer(consolidateCompletion)));
         }
         logStep("Pass 4/4: verifying consolidated findings (repo tools)");
         const verificationMessages = buildVerificationPrompt({
@@ -901,11 +917,11 @@ export async function reviewMergeRequestMultiPass(params) {
                 debugDumpFile,
                 debugRecordWriter,
             });
-            return withHeader(buildAnswer(verificationCompletion));
+            return withHeader(withCapNote(buildAnswer(verificationCompletion)));
         }
         catch (error) {
             logStep(`Verification failed: ${error?.message ?? error}. Returning consolidated findings.`);
-            return withHeader(buildAnswer(consolidateCompletion));
+            return withHeader(withCapNote(buildAnswer(consolidateCompletion)));
         }
     }
     catch (error) {

package/dist/cli.js

@@ -8,43 +8,41 @@ import { reviewMergeRequestMultiPass } from "./cli/ci-review.js";
 import { fetchMergeRequestChanges, postMergeRequestNote, } from "./gitlab/services.js";
 import { renderDebugArtifactsHtml } from "./cli/debug-artifacts-html.js";
 function printHelp() {
-    process.stdout.write([
-        "gitlab-ai-review",
-        "",
-        "Usage:",
-        "  gitlab-ai-review",
-        "  gitlab-ai-review --help",
-        "  gitlab-ai-review --debug",
-        "  gitlab-ai-review --ignore-ext=md,lock",
-        "",
-        "Debug:",
-        "  --debug        Print full error details (stack, API error fields).",
-        "  --include-artifacts  Generate local HTML artifact without printing payloads to console.",
-        "  --force-tools  Force at least one tool-call round in tool-enabled review paths.",
-        "  --ignore-ext   Ignore file extensions (comma-separated only). Example: --ignore-ext=md,lock",
-        "  --max-diffs=50",
-        "  --max-diff-chars=16000",
-        "  --max-total-prompt-chars=220000",
-        "  --triage-diff-chars=2000   Max chars per file diff in triage pass (Pass 1).",
-        "  --max-findings=5          Max findings in final review (CI multi-pass only).",
-        "  --max-review-concurrency=2  Parallel per-file review calls (CI multi-pass only).",
-        "",
-        "Env vars:",
-        "  OPENAI_API_KEY (required)  OpenAI API key.",
-        "  OPENAI_BASE_URL (optional)  Custom OpenAI-compatible API base URL.",
-        "  AI_MODEL      (optional)  OpenAI chat model, e.g. gpt-4o. Default: gpt-4o-mini.",
-        "  AI_REVIEW_CONCURRENCY (optional)  Same as --max-review-concurrency; the flag wins.",
-        "  AI_PROMPT_PROFILE (optional)  Prompt style: \"default\" | \"weak\". Default: default.",
-        "                              Use \"weak\" for small/quantized models — shorter prompts,",
-        "                              positive rules, and few-shot examples.",
-        "                              When unset, an unparseable triage response auto-retries",
-        "                              with \"weak\" and keeps it for the whole run.",
-        "  PROJECT_ACCESS_TOKEN (optional)  GitLab Project/Personal Access Token for API calls (required for most private repos; should have api scope).",
-        "",
-        "CI-only env vars (provided by GitLab):",
-        "  CI_API_V4_URL, CI_PROJECT_ID, CI_MERGE_REQUEST_IID, CI_JOB_TOKEN (only if PROJECT_ACCESS_TOKEN is not set)",
-        "",
-    ].join("\n"));
+    process.stdout.write(`gitlab-ai-review
+
+Usage:
+  gitlab-ai-review
+  gitlab-ai-review --help
+  gitlab-ai-review --debug
+  gitlab-ai-review --ignore-ext=md,lock
+
+Debug:
+  --debug        Print full error details (stack, API error fields).
+  --include-artifacts  Generate local HTML artifact without printing payloads to console.
+  --force-tools  Force at least one tool-call round in tool-enabled review paths.
+  --ignore-ext   Ignore file extensions (comma-separated only). Example: --ignore-ext=md,lock
+  --max-diffs=50
+  --max-diff-chars=16000
+  --max-total-prompt-chars=220000
+  --triage-diff-chars=2000   Max chars per file diff in triage pass (Pass 1).
+  --max-findings=5          Max findings in final review (CI multi-pass only).
+  --max-review-concurrency=2  Parallel per-file review calls (CI multi-pass only).
+
+Env vars:
+  OPENAI_API_KEY (required)  OpenAI API key.
+  OPENAI_BASE_URL (optional)  Custom OpenAI-compatible API base URL.
+  AI_MODEL      (optional)  OpenAI chat model, e.g. gpt-4o. Default: gpt-4o-mini.
+  AI_REVIEW_CONCURRENCY (optional)  Same as --max-review-concurrency; the flag wins.
+  AI_PROMPT_PROFILE (optional)  Prompt style: "default" | "weak". Default: default.
+                              Use "weak" for small/quantized models — shorter prompts,
+                              positive rules, and few-shot examples.
+                              When unset, an unparseable triage response auto-retries
+                              with "weak" and keeps it for the whole run.
+  PROJECT_ACCESS_TOKEN (optional)  GitLab Project/Personal Access Token for API calls (required for most private repos; should have api scope).
+
+CI-only env vars (provided by GitLab):
+  CI_API_V4_URL, CI_PROJECT_ID, CI_MERGE_REQUEST_IID, CI_JOB_TOKEN (only if PROJECT_ACCESS_TOKEN is not set)
+`);
 }
 const DEBUG_MODE = hasDebugFlag(process.argv);
 const FORCE_TOOLS = hasForceToolsFlag(process.argv);
@@ -116,6 +114,7 @@ async function main() {
     const ciApiV4Url = envs["CI_API_V4_URL"];
     const projectId = envs["CI_PROJECT_ID"];
     const mergeRequestIid = envs["CI_MERGE_REQUEST_IID"];
+    const gitLabProjectApiUrl = new URL(`${ciApiV4Url}/projects/${projectId}`);
     const headers = {};
     if (projectAccessToken != null)
         headers["PRIVATE-TOKEN"] = projectAccessToken;
@@ -124,7 +123,7 @@ async function main() {
     try {
         logStep("Fetching merge request changes");
         const mrChanges = await fetchMergeRequestChanges({
-            gitLabBaseUrl: new URL(ciApiV4Url),
+            gitLabProjectApiUrl: gitLabProjectApiUrl,
             headers,
             projectId,
             mergeRequestIid,
@@ -149,7 +148,7 @@ async function main() {
                 base: mrChanges.diff_refs?.base_sha ?? "HEAD",
                 head: mrChanges.diff_refs?.head_sha ?? "HEAD",
             },
-            gitLabProjectApiUrl: new URL(`${ciApiV4Url}/projects/${projectId}`),
+            gitLabProjectApiUrl: gitLabProjectApiUrl,
             projectId,
             headers,
             maxFindings,
@@ -162,7 +161,7 @@ async function main() {
         });
         logStep("Posting AI review note to merge request");
         const noteRes = await postMergeRequestNote({
-            gitLabBaseUrl: new URL(`${ciApiV4Url}/projects/${projectId}`),
+            gitLabProjectApiUrl: gitLabProjectApiUrl,
             headers,
             mergeRequestIid,
         }, { body: answer });

package/dist/gitlab/services.js

@@ -2,9 +2,9 @@
 import OpenAI from "openai";
 import { AI_MODEL_TEMPERATURE } from "../prompt/index.js";
 import { GitLabError, OpenAIError, } from "./types.js";
-export const fetchPreEditFiles = async ({ gitLabBaseUrl, headers, changesOldPaths, ref }) => {
+export const fetchPreEditFiles = async ({ gitLabProjectApiUrl, headers, changesOldPaths, ref }) => {
     const oldFilesRequestUrls = changesOldPaths.map((filePath) => {
-        const url = new URL(`${gitLabBaseUrl}/repository/files/${encodeURIComponent(filePath)}/raw`);
+        const url = new URL(`${gitLabProjectApiUrl}/repository/files/${encodeURIComponent(filePath)}/raw`);
         url.searchParams.set("ref", ref);
         return url;
     });
@@ -42,8 +42,8 @@ export const fetchPreEditFiles = async ({ gitLabBaseUrl, headers, changesOldPath
         return acc;
     }, []);
 };
-export const fetchFileAtRef = async ({ gitLabBaseUrl, headers, filePath, ref }) => {
-    const url = new URL(`${gitLabBaseUrl}/repository/files/${encodeURIComponent(filePath)}/raw`);
+export const fetchFileAtRef = async ({ gitLabProjectApiUrl, headers, filePath, ref }) => {
+    const url = new URL(`${gitLabProjectApiUrl}/repository/files/${encodeURIComponent(filePath)}/raw`);
     url.searchParams.set("ref", ref);
     let res;
     try {
@@ -103,8 +103,8 @@ export async function generateAICompletion(messages, openaiInstance, aiModel) {
     }
     return completion;
 }
-export const postMergeRequestNote = async ({ gitLabBaseUrl, headers, mergeRequestIid }, commentPayload) => {
-    const commentUrl = new URL(`${gitLabBaseUrl}/merge_requests/${mergeRequestIid}/notes`);
+export const postMergeRequestNote = async ({ gitLabProjectApiUrl, headers, mergeRequestIid }, commentPayload) => {
+    const commentUrl = new URL(`${gitLabProjectApiUrl}/merge_requests/${mergeRequestIid}/notes`);
     let aiComment;
     try {
         aiComment = await fetch(commentUrl, {
@@ -147,8 +147,8 @@ export const postMergeRequestNote = async ({ gitLabBaseUrl, headers, mergeReques
         });
     }
 };
-export const searchRepository = async ({ gitLabBaseUrl, headers, query, ref, projectId }) => {
-    const url = new URL(`${gitLabBaseUrl}/projects/${projectId}/search`);
+export const searchRepository = async ({ gitLabProjectApiUrl, headers, query, ref }) => {
+    const url = new URL(`${gitLabProjectApiUrl}/search`);
     url.searchParams.set("scope", "blobs");
     url.searchParams.set("search", query);
     url.searchParams.set("ref", ref);
@@ -185,8 +185,8 @@ export const searchRepository = async ({ gitLabBaseUrl, headers, query, ref, pro
     }
     return (await res.json());
 };
-export const fetchMergeRequestChanges = async ({ gitLabBaseUrl, headers, projectId, mergeRequestIid }) => {
-    const url = new URL(`${gitLabBaseUrl}/projects/${projectId}/merge_requests/${mergeRequestIid}/changes`);
+export const fetchMergeRequestChanges = async ({ gitLabProjectApiUrl, headers, mergeRequestIid }) => {
+    const url = new URL(`${gitLabProjectApiUrl}/merge_requests/${mergeRequestIid}/changes`);
     // Ask GitLab for raw diffs to reduce truncation on larger merge requests.
     url.searchParams.set("access_raw_diffs", "true");
     let res;

package/dist/prompt/index.js

@@ -1,7 +1,7 @@
 /** @format */
 import { buildFileReviewSystemMessage, buildMainSystemMessages, buildTriageSystemMessage, } from "./messages.js";
 import { extractFirstJsonObject, normalizeReviewFindingsMarkdown, sanitizeGitLabMarkdown, truncateWithMarker, } from "./utils.js";
-import { getConsolidateSystemLines, getVerificationSystemLines, } from "./templates/postprocess-system.js";
+import { getConsolidateSystemPrompt, getVerificationSystemPrompt, } from "./templates/postprocess-system.js";
 import { buildConsolidateUserContent, buildFileReviewUserContent, buildMainReviewUserContent, buildTriageUserContent, buildVerificationUserContent, } from "./templates/user-prompts.js";
 import { DEFAULT_PROMPT_PROFILE, isEmptyReviewBody } from "./profile.js";
 export { DEFAULT_PROMPT_PROFILE, NO_FINDINGS_SENTENCE, isEmptyReviewBody, parsePromptProfile, } from "./profile.js";
@@ -160,7 +160,7 @@ export function buildConsolidatePrompt(params) {
     return [
         {
             role: "system",
-            content: getConsolidateSystemLines(profile, maxFindings).join("\n"),
+            content: getConsolidateSystemPrompt(profile, maxFindings),
         },
         {
             role: "user",
@@ -180,7 +180,7 @@ export function buildVerificationPrompt(params) {
     return [
         {
             role: "system",
-            content: getVerificationSystemLines(profile, maxFindings).join("\n"),
+            content: getVerificationSystemPrompt(profile, maxFindings),
         },
         {
             role: "user",

package/dist/prompt/messages.js

@@ -1,20 +1,20 @@
 /** @format */
-import { getFileReviewSystemLines, getMainSystemLines, } from "./templates/review-system.js";
-import { getTriageSystemLines } from "./templates/triage-system.js";
+import { getFileReviewSystemPrompt, getMainSystemPrompt, } from "./templates/review-system.js";
+import { getTriageSystemPrompt } from "./templates/triage-system.js";
 import { DEFAULT_PROMPT_PROFILE } from "./profile.js";
 export const buildMainSystemMessages = (profile = DEFAULT_PROMPT_PROFILE) => [
     {
         role: "system",
-        content: getMainSystemLines(profile).join("\n"),
+        content: getMainSystemPrompt(profile),
     },
 ];
 export const buildTriageSystemMessage = (profile = DEFAULT_PROMPT_PROFILE) => ({
     role: "system",
-    content: getTriageSystemLines(profile).join("\n"),
+    content: getTriageSystemPrompt(profile),
 });
 export const buildFileReviewSystemMessage = (profile = DEFAULT_PROMPT_PROFILE) => ({
     role: "system",
-    content: getFileReviewSystemLines(profile).join("\n"),
+    content: getFileReviewSystemPrompt(profile),
 });
 /** @deprecated kept for backward compatibility — use buildTriageSystemMessage(). */
 export const TRIAGE_SYSTEM = buildTriageSystemMessage();

package/dist/prompt/templates/postprocess-system.js

@@ -1,118 +1,104 @@
 /** @format */
 import { NO_FINDINGS_SENTENCE } from "../profile.js";
-function buildConsolidateDefaultLines(maxFindings) {
-    return [
-        "You consolidate per-file code review findings into a final ranked list.",
-        `Select the top ${maxFindings} most important findings. Deduplicate overlapping issues.`,
-        "Preserve this exact per-finding markdown block:",
-        "`- [high|medium] <title>`",
-        "`  File: <path>`",
-        "`  Line: ~<N>`",
-        "`  Why: <one concise sentence with key evidence>`",
-        "Rank by: (1) [high] before [medium], (2) correctness > security > perf.",
-        "Do not add new findings. Do not add headings, summaries, or commentary.",
-        "Drop any finding that: claims a syntax error without quoting the invalid token, claims a function/variable is missing without concrete proof, or flags a refactoring rename as a bug.",
-        `If fewer than ${maxFindings} findings exist, return all of them.`,
-        `If all findings are low quality or dubious after dedup, return exactly: "${NO_FINDINGS_SENTENCE}"`,
-        "GitLab-flavoured markdown.",
-    ];
+function buildConsolidateDefaultPrompt(maxFindings) {
+    return `You consolidate per-file code review findings into a final ranked list.
+Select the top ${maxFindings} most important findings. Deduplicate overlapping issues.
+Preserve this exact per-finding markdown block:
+\`- [high|medium] <title>\`
+\`  File: <path>\`
+\`  Line: ~<N>\`
+\`  Why: <one concise sentence with key evidence>\`
+Rank by: (1) [high] before [medium], (2) correctness > security > perf.
+Do not add new findings. Do not add headings, summaries, or commentary.
+Drop any finding that: claims a syntax error without quoting the invalid token, claims a function/variable is missing without concrete proof, or flags a refactoring rename as a bug.
+If fewer than ${maxFindings} findings exist, return all of them.
+If all findings are low quality or dubious after dedup, return exactly: "${NO_FINDINGS_SENTENCE}"
+GitLab-flavoured markdown.`;
 }
-function buildConsolidateWeakLines(maxFindings) {
-    return [
-        "You merge per-file review findings into one ranked list.",
-        "Output bullets only — no preamble, no headings, no code fences.",
-        `Keep at most ${maxFindings} findings. Do not invent new ones.`,
-        "",
-        "Steps:",
-        "1. Drop duplicates and findings that are reworded versions of each other (keep the clearest).",
-        "2. Drop a finding if it has no concrete evidence (no file/line, vague reasoning, or just \"this might be wrong\").",
-        "3. Sort the remainder: all [high] before any [medium]; within a tier, correctness bugs before security before perf.",
-        "4. Take the top items up to the limit.",
-        "",
-        "Output format — copy spacing and case exactly, do not wrap bullets in backticks:",
-        "- [high|medium] <short title>",
-        "  File: <path>",
-        "  Line: ~<N>",
-        "  Why: <one sentence pointing at the evidence>",
-        "",
-        "Example output (two findings, ranked):",
-        "- [high] Null pointer dereference in user lookup",
-        "  File: src/user/service.ts",
-        "  Line: ~42",
-        "  Why: getUser() can return null but the next line calls user.id without a guard.",
-        "",
-        "- [medium] Off-by-one in pagination loop",
-        "  File: src/api/list.ts",
-        "  Line: ~88",
-        "  Why: loop runs while i <= total but indices are 0-based, so the last item is read past the array end.",
-        "",
-        `If after dedup nothing survives, output exactly this single line and nothing else: ${NO_FINDINGS_SENTENCE}`,
-    ];
+function buildConsolidateWeakPrompt(maxFindings) {
+    return `You merge per-file review findings into one ranked list.
+Output bullets only — no preamble, no headings, no code fences.
+Keep at most ${maxFindings} findings. Do not invent new ones.
+
+Steps:
+1. Drop duplicates and findings that are reworded versions of each other (keep the clearest).
+2. Drop a finding if it has no concrete evidence (no file/line, vague reasoning, or just "this might be wrong").
+3. Sort the remainder: all [high] before any [medium]; within a tier, correctness bugs before security before perf.
+4. Take the top items up to the limit.
+
+Output format — copy spacing and case exactly, do not wrap bullets in backticks:
+- [high|medium] <short title>
+  File: <path>
+  Line: ~<N>
+  Why: <one sentence pointing at the evidence>
+
+Example output (two findings, ranked):
+- [high] Null pointer dereference in user lookup
+  File: src/user/service.ts
+  Line: ~42
+  Why: getUser() can return null but the next line calls user.id without a guard.
+
+- [medium] Off-by-one in pagination loop
+  File: src/api/list.ts
+  Line: ~88
+  Why: loop runs while i <= total but indices are 0-based, so the last item is read past the array end.
+
+If after dedup nothing survives, output exactly this single line and nothing else: ${NO_FINDINGS_SENTENCE}`;
 }
-function buildVerificationDefaultLines(maxFindings) {
-    return [
-        "You are a skeptical verifier of a merge request review.",
-        "Your job is to remove weak, speculative, or unsupported findings from the draft list.",
-        "Tools get_file_at_ref and grep_repository are available. Use them to check claims about current code against the repository at the MR head ref.",
-        "Drop a finding if file contents at refs.head contradict it, or if it cannot be verified after reasonable tool use.",
-        "Do not add new findings. Keep, rewrite for clarity, or remove existing findings only.",
-        "A finding can stay only if supported by the per-file evidence pool and not contradicted by tools when the claim is about code that exists at refs.head.",
-        "If confidence is not high, drop the finding.",
-        "Preserve this exact per-finding markdown block:",
-        "`- [high|medium] <title>`",
-        "`  File: <path>`",
-        "`  Line: ~<N>`",
-        "`  Why: <one concise sentence with key evidence>`",
-        "Do not add headings, summaries, or extra commentary.",
-        `Return at most ${maxFindings} findings.`,
-        `If no findings survive verification, return exactly: "${NO_FINDINGS_SENTENCE}"`,
-        "GitLab-flavoured markdown.",
-    ];
+function buildVerificationDefaultPrompt(maxFindings) {
+    return `You are a skeptical verifier of a merge request review.
+Your job is to remove weak, speculative, or unsupported findings from the draft list.
+Tools get_file_at_ref and grep_repository are available. Use them to check claims about current code against the repository at the MR head ref.
+Drop a finding if file contents at refs.head contradict it, or if it cannot be verified after reasonable tool use.
+Do not add new findings. Keep, rewrite for clarity, or remove existing findings only.
+A finding can stay only if supported by the per-file evidence pool and not contradicted by tools when the claim is about code that exists at refs.head.
+If confidence is not high, drop the finding.
+Preserve this exact per-finding markdown block:
+\`- [high|medium] <title>\`
+\`  File: <path>\`
+\`  Line: ~<N>\`
+\`  Why: <one concise sentence with key evidence>\`
+Do not add headings, summaries, or extra commentary.
+Return at most ${maxFindings} findings.
+If no findings survive verification, return exactly: "${NO_FINDINGS_SENTENCE}"
+GitLab-flavoured markdown.`;
 }
-function buildVerificationWeakLines(maxFindings) {
-    return [
-        "You verify a draft list of merge-request review findings against the actual repository.",
-        "Output bullets only — no preamble, no headings, no code fences. Do not invent new findings.",
-        `Return at most ${maxFindings} findings.`,
-        "",
-        "For each draft finding, follow these steps in order:",
-        "1. Look it up in the per-file evidence pool. If it is not in the evidence pool, drop it.",
-        "2. If the finding makes a claim about code that exists at refs.head, call get_file_at_ref(path, refs.head) and confirm the offending text really sits at the cited line (±10 lines is fine).",
-        "3. If the file contents at refs.head do not contain the offending text, or contain a corrected version of it, drop the finding.",
-        "4. If you cannot confirm the claim with one or two tool calls, drop the finding.",
-        "",
-        "Keep a finding only after step 3 succeeds. Otherwise drop it.",
-        "",
-        "Output format — copy spacing and case exactly, do not wrap bullets in backticks:",
-        "- [high|medium] <short title>",
-        "  File: <path>",
-        "  Line: ~<N>",
-        "  Why: <one sentence pointing at the evidence you confirmed>",
-        "",
-        "Example — KEEP this finding because get_file_at_ref shows the cited code at refs.head:",
-        "- [high] Null pointer dereference in user lookup",
-        "  File: src/user/service.ts",
-        "  Line: ~42",
-        "  Why: getUser() returns null on miss and the next line calls user.id without a guard (confirmed in src/user/service.ts at refs.head).",
-        "",
-        "Example — DROP a finding when refs.head shows the bug is already gone (do not output it).",
-        "",
-        `If after verification nothing survives, output exactly this single line and nothing else: ${NO_FINDINGS_SENTENCE}`,
-    ];
+function buildVerificationWeakPrompt(maxFindings) {
+    return `You verify a draft list of merge-request review findings against the actual repository.
+Output bullets only — no preamble, no headings, no code fences. Do not invent new findings.
+Return at most ${maxFindings} findings.
+
+For each draft finding, follow these steps in order:
+1. Look it up in the per-file evidence pool. If it is not in the evidence pool, drop it.
+2. If the finding makes a claim about code that exists at refs.head, call get_file_at_ref(path, refs.head) and confirm the offending text really sits at the cited line (±10 lines is fine).
+3. If the file contents at refs.head do not contain the offending text, or contain a corrected version of it, drop the finding.
+4. If you cannot confirm the claim with one or two tool calls, drop the finding.
+
+Keep a finding only after step 3 succeeds. Otherwise drop it.
+
+Output format — copy spacing and case exactly, do not wrap bullets in backticks:
+- [high|medium] <short title>
+  File: <path>
+  Line: ~<N>
+  Why: <one sentence pointing at the evidence you confirmed>
+
+Example — KEEP this finding because get_file_at_ref shows the cited code at refs.head:
+- [high] Null pointer dereference in user lookup
+  File: src/user/service.ts
+  Line: ~42
+  Why: getUser() returns null on miss and the next line calls user.id without a guard (confirmed in src/user/service.ts at refs.head).
+
+Example — DROP a finding when refs.head shows the bug is already gone (do not output it).
+
+If after verification nothing survives, output exactly this single line and nothing else: ${NO_FINDINGS_SENTENCE}`;
 }
-export function buildConsolidateSystemLines(maxFindings) {
-    return buildConsolidateDefaultLines(maxFindings);
-}
-export function buildVerificationSystemLines(maxFindings) {
-    return buildVerificationDefaultLines(maxFindings);
-}
-export function getConsolidateSystemLines(profile, maxFindings) {
+export function getConsolidateSystemPrompt(profile, maxFindings) {
     return profile === "weak"
-        ? buildConsolidateWeakLines(maxFindings)
-        : buildConsolidateDefaultLines(maxFindings);
+        ? buildConsolidateWeakPrompt(maxFindings)
+        : buildConsolidateDefaultPrompt(maxFindings);
 }
-export function getVerificationSystemLines(profile, maxFindings) {
+export function getVerificationSystemPrompt(profile, maxFindings) {
     return profile === "weak"
-        ? buildVerificationWeakLines(maxFindings)
-        : buildVerificationDefaultLines(maxFindings);
+        ? buildVerificationWeakPrompt(maxFindings)
+        : buildVerificationDefaultPrompt(maxFindings);
 }

package/dist/prompt/templates/review-system.js

@@ -1,120 +1,112 @@
 /** @format */
 import { NO_FINDINGS_SENTENCE } from "../profile.js";
-const MAIN_DEFAULT_LINES = [
-    "You are an AI code reviewer for pull requests.",
-    "Find only real bugs introduced by the diff.",
-    "Return at most 3 findings. Prefer no finding over a weak one.",
-    "",
-    "Rules:",
-    "- Focus on changed lines.",
-    "- Ignore style, refactoring suggestions, and general best practices.",
-    "- If uncertain, use tools: get_file_at_ref and grep_repository.",
-    "- Report only issues clearly visible in diff or verified by tools.",
-    `- If uncertain after checking, return exactly: "${NO_FINDINGS_SENTENCE}"`,
-    "",
-    "Severity:",
-    "- [high]: deterministic runtime/security breakage with clear path.",
-    "- [medium]: likely bug with strong evidence.",
-    "",
-    "Output format (strict):",
-    "- `- [high|medium] <title>`",
-    "- `  File: <path>`",
-    "- `  Line: ~<N>`",
-    "- `  Why: <one concise sentence with evidence>`",
-    `- If no issues: exactly "${NO_FINDINGS_SENTENCE}"`,
-];
-const MAIN_WEAK_LINES = [
-    "You are an AI bug-finder for a merge request.",
-    "Output bullets only — no preamble, no headings, no code fences, no closing remarks.",
-    "Return at most 3 findings.",
-    "",
-    "Report a finding ONLY when ALL of these are true:",
-    "1. The bug is on a line added or modified in the diff (or a direct consequence of one).",
-    "2. You can quote the offending text from the diff or from get_file_at_ref output.",
-    "3. The bug causes wrong behavior, a crash, a security issue, or data loss — not a style nit.",
-    "If any of those is not true, do not include the finding.",
-    "",
-    "When the diff is unclear, call the tools: get_file_at_ref(path, ref) or grep_repository(query, ref). Prefer the head ref.",
-    "",
-    "Severity tags:",
-    "- [high] = will break at runtime or leak data.",
-    "- [medium] = strong evidence of a bug, but conditions matter.",
-    "",
-    "Output format — copy spacing and case exactly, do not wrap in backticks or fences:",
-    "- [high|medium] <short title>",
-    "  File: <path>",
-    "  Line: ~<N>",
-    "  Why: <one sentence pointing at the evidence>",
-    "",
-    "Example of a valid finding:",
-    "- [high] Null pointer dereference in user lookup",
-    "  File: src/user/service.ts",
-    "  Line: ~42",
-    "  Why: getUser() can return null but the next line calls user.id without a guard.",
-    "",
-    `If you cannot meet all three conditions for any finding, output exactly this single line and nothing else: ${NO_FINDINGS_SENTENCE}`,
-];
-const FILE_DEFAULT_LINES = [
-    "You are an AI reviewer for a single-file diff.",
-    "Find only real bugs introduced by changed lines.",
-    "Return at most 2 findings. Prefer no finding over a weak one.",
-    "",
-    "Rules:",
-    "- Focus on changed lines only.",
-    "- Ignore style/refactor/general improvement comments.",
-    "- If uncertain, use tools: get_file_at_ref and grep_repository.",
-    "- Report only issues clearly visible in diff or verified by tools.",
-    `- If uncertain after checking, return exactly: "${NO_FINDINGS_SENTENCE}"`,
-    "",
-    "Severity:",
-    "- [high]: deterministic runtime/security breakage with clear path.",
-    "- [medium]: likely bug with strong evidence.",
-    "",
-    "Output format (strict):",
-    "- `- [high|medium] <title>`",
-    "- `  File: <path>`",
-    "- `  Line: ~<N>`",
-    "- `  Why: <one concise sentence with evidence>`",
-    `- If no issues: exactly "${NO_FINDINGS_SENTENCE}"`,
-];
-const FILE_WEAK_LINES = [
-    "You are an AI bug-finder reviewing one file's diff.",
-    "Output bullets only — no preamble, no headings, no code fences.",
-    "Return at most 2 findings.",
-    "",
-    "Report a finding ONLY when ALL of these are true:",
-    "1. The bug is on a line added or modified in this file's diff.",
-    "2. You can quote the offending text from the diff or from get_file_at_ref output.",
-    "3. The bug causes wrong behavior, a crash, a security issue, or data loss.",
-    "If any of those is not true, do not include the finding.",
-    "",
-    "When the diff is unclear, call the tools: get_file_at_ref(path, ref) or grep_repository(query, ref). Prefer the head ref.",
-    "",
-    "Severity tags:",
-    "- [high] = will break at runtime or leak data.",
-    "- [medium] = strong evidence of a bug, but conditions matter.",
-    "",
-    "Output format — copy spacing and case exactly, do not wrap in backticks or fences:",
-    "- [high|medium] <short title>",
-    "  File: <path>",
-    "  Line: ~<N>",
-    "  Why: <one sentence pointing at the evidence>",
-    "",
-    "Example of a valid finding:",
-    "- [medium] Off-by-one in pagination loop",
-    "  File: src/api/list.ts",
-    "  Line: ~88",
-    "  Why: loop runs while i <= total but indices are 0-based, so the last item is read past the array end.",
-    "",
-    `If you cannot meet all three conditions for any finding, output exactly this single line and nothing else: ${NO_FINDINGS_SENTENCE}`,
-];
-export function getMainSystemLines(profile) {
-    return profile === "weak" ? MAIN_WEAK_LINES : MAIN_DEFAULT_LINES;
+const MAIN_DEFAULT = `You are an AI code reviewer for pull requests.
+Find only real bugs introduced by the diff.
+Return at most 3 findings. Prefer no finding over a weak one.
+
+Rules:
+- Focus on changed lines.
+- Ignore style, refactoring suggestions, and general best practices.
+- If uncertain, use tools: get_file_at_ref and grep_repository.
+- Report only issues clearly visible in diff or verified by tools.
+- If uncertain after checking, return exactly: "${NO_FINDINGS_SENTENCE}"
+
+Severity:
+- [high]: deterministic runtime/security breakage with clear path.
+- [medium]: likely bug with strong evidence.
+
+Output format (strict):
+- \`- [high|medium] <title>\`
+- \`  File: <path>\`
+- \`  Line: ~<N>\`
+- \`  Why: <one concise sentence with evidence>\`
+- If no issues: exactly "${NO_FINDINGS_SENTENCE}"`;
+const MAIN_WEAK = `You are an AI bug-finder for a merge request.
+Output bullets only — no preamble, no headings, no code fences, no closing remarks.
+Return at most 3 findings.
+
+Report a finding ONLY when ALL of these are true:
+1. The bug is on a line added or modified in the diff (or a direct consequence of one).
+2. You can quote the offending text from the diff or from get_file_at_ref output.
+3. The bug causes wrong behavior, a crash, a security issue, or data loss — not a style nit.
+If any of those is not true, do not include the finding.
+
+When the diff is unclear, call the tools: get_file_at_ref(path, ref) or grep_repository(query, ref). Prefer the head ref.
+
+Severity tags:
+- [high] = will break at runtime or leak data.
+- [medium] = strong evidence of a bug, but conditions matter.
+
+Output format — copy spacing and case exactly, do not wrap in backticks or fences:
+- [high|medium] <short title>
+  File: <path>
+  Line: ~<N>
+  Why: <one sentence pointing at the evidence>
+
+Example of a valid finding:
+- [high] Null pointer dereference in user lookup
+  File: src/user/service.ts
+  Line: ~42
+  Why: getUser() can return null but the next line calls user.id without a guard.
+
+If you cannot meet all three conditions for any finding, output exactly this single line and nothing else: ${NO_FINDINGS_SENTENCE}`;
+const FILE_DEFAULT = `You are an AI reviewer for a single-file diff.
+Find only real bugs introduced by changed lines.
+Return at most 2 findings. Prefer no finding over a weak one.
+
+Rules:
+- Focus on changed lines only.
+- Ignore style/refactor/general improvement comments.
+- If uncertain, use tools: get_file_at_ref and grep_repository.
+- Report only issues clearly visible in diff or verified by tools.
+- If uncertain after checking, return exactly: "${NO_FINDINGS_SENTENCE}"
+
+Severity:
+- [high]: deterministic runtime/security breakage with clear path.
+- [medium]: likely bug with strong evidence.
+
+Output format (strict):
+- \`- [high|medium] <title>\`
+- \`  File: <path>\`
+- \`  Line: ~<N>\`
+- \`  Why: <one concise sentence with evidence>\`
+- If no issues: exactly "${NO_FINDINGS_SENTENCE}"`;
+const FILE_WEAK = `You are an AI bug-finder reviewing one file's diff.
+Output bullets only — no preamble, no headings, no code fences.
+Return at most 2 findings.
+
+Report a finding ONLY when ALL of these are true:
+1. The bug is on a line added or modified in this file's diff.
+2. You can quote the offending text from the diff or from get_file_at_ref output.
+3. The bug causes wrong behavior, a crash, a security issue, or data loss.
+If any of those is not true, do not include the finding.
+
+When the diff is unclear, call the tools: get_file_at_ref(path, ref) or grep_repository(query, ref). Prefer the head ref.
+
+Severity tags:
+- [high] = will break at runtime or leak data.
+- [medium] = strong evidence of a bug, but conditions matter.
+
+Output format — copy spacing and case exactly, do not wrap in backticks or fences:
+- [high|medium] <short title>
+  File: <path>
+  Line: ~<N>
+  Why: <one sentence pointing at the evidence>
+
+Example of a valid finding:
+- [medium] Off-by-one in pagination loop
+  File: src/api/list.ts
+  Line: ~88
+  Why: loop runs while i <= total but indices are 0-based, so the last item is read past the array end.
+
+If you cannot meet all three conditions for any finding, output exactly this single line and nothing else: ${NO_FINDINGS_SENTENCE}`;
+export function getMainSystemPrompt(profile) {
+    return profile === "weak" ? MAIN_WEAK : MAIN_DEFAULT;
 }
-export function getFileReviewSystemLines(profile) {
-    return profile === "weak" ? FILE_WEAK_LINES : FILE_DEFAULT_LINES;
+export function getFileReviewSystemPrompt(profile) {
+    return profile === "weak" ? FILE_WEAK : FILE_DEFAULT;
 }
-/** @deprecated kept for backward compatibility — use getMainSystemLines("default"). */
-export const MAIN_SYSTEM_LINES = MAIN_DEFAULT_LINES;
-/** @deprecated kept for backward compatibility — use getFileReviewSystemLines("default"). */
-export const FILE_REVIEW_SYSTEM_LINES = FILE_DEFAULT_LINES;
+/** @deprecated kept for backward compatibility — use getMainSystemPrompt("default"). */
+export const MAIN_SYSTEM_LINES = MAIN_DEFAULT.split("\n");
+/** @deprecated kept for backward compatibility — use getFileReviewSystemPrompt("default"). */
+export const FILE_REVIEW_SYSTEM_LINES = FILE_DEFAULT.split("\n");

package/dist/prompt/templates/triage-system.js

@@ -1,50 +1,46 @@
 /** @format */
-const DEFAULT_LINES = [
-    "You are a senior developer triaging files in a merge request.",
-    "For each file, decide whether it NEEDS_REVIEW (modifies logic, functionality, security, or performance) or can be SKIPPED (cosmetic-only: formatting, comments, renaming for clarity, docs, auto-generated files).",
-    "",
-    "Also produce a concise summary (2-4 sentences) of the entire merge request: what it does and which areas it touches.",
-    "",
-    "Respond with a JSON object (no markdown fences, no prose before or after) in this exact schema:",
-    '{ "summary": "<MR summary>", "files": [{ "path": "<file path>", "verdict": "NEEDS_REVIEW" | "SKIP", "reason": "<one short sentence explaining the verdict>" }] }',
-    "",
-    "The reason field is required for every file — cite what you saw in the diff (e.g. \"import reordering only\" or \"changes Input props and validation\").",
-    "",
-    "Rules:",
-    "- When in doubt, verdict is NEEDS_REVIEW.",
-    "- Look beyond comments and JSDoc: if the diff changes function signatures, return types, control flow, variable assignments, or adds/removes code lines (not just comments), it is a logic change → NEEDS_REVIEW.",
-    "- If a file mixes doc/comment edits with actual code changes, verdict is NEEDS_REVIEW.",
-    "- Refactoring (splitting/merging functions, changing data structures, renaming with signature changes) is NEEDS_REVIEW.",
-    "- Deleted files are SKIP unless the deletion could break dependents.",
-    "- New files containing logic are NEEDS_REVIEW.",
-    "- Test files that add, remove, or change assertions or expected values are NEEDS_REVIEW.",
-    "- Test-only files are SKIP only if changes are purely cosmetic (formatting, comments).",
-    "- Config/CI/docs files are SKIP unless they modify build targets, env vars, or secrets.",
-    "",
-    "Example output (copy this style exactly — single JSON object, no fences, no preamble):",
-    '{"summary":"Adds retry-with-backoff to the OpenAI client and updates the README badge.","files":[{"path":"src/openai/client.ts","verdict":"NEEDS_REVIEW","reason":"adds retry loop and error handling in API client"},{"path":"README.md","verdict":"SKIP","reason":"badge URL change only"}]}',
-];
-const WEAK_LINES = [
-    "You triage merge-request files. Output one JSON object only — no prose, no markdown, no code fences, no preamble.",
-    "",
-    "Schema (use exactly these keys):",
-    '{"summary":"<2-3 sentences about the MR>","files":[{"path":"<file path>","verdict":"NEEDS_REVIEW" | "SKIP","reason":"<one short sentence>"}]}',
-    "",
-    "Mark a file NEEDS_REVIEW when ANY of these is true:",
-    "- the diff adds or removes non-comment lines,",
-    "- the diff changes a function signature, return type, control flow, or variable value,",
-    "- the file is new and contains code,",
-    "- a test changes an assertion or expected value,",
-    "- a config/CI file changes build targets, env vars, or secrets.",
-    "",
-    "Mark a file SKIP only when the diff is purely cosmetic: whitespace, comments, JSDoc, plain docs, auto-generated files, or deletions that cannot affect callers.",
-    "When in doubt, choose NEEDS_REVIEW.",
-    "",
-    "Example output (copy this exactly — one line, one JSON object, nothing else):",
-    '{"summary":"Adds retry-with-backoff to the OpenAI client and updates the README badge.","files":[{"path":"src/openai/client.ts","verdict":"NEEDS_REVIEW","reason":"adds retry loop in API client"},{"path":"README.md","verdict":"SKIP","reason":"badge URL only"}]}',
-];
-export function getTriageSystemLines(profile) {
-    return profile === "weak" ? WEAK_LINES : DEFAULT_LINES;
+const DEFAULT = `You are a senior developer triaging files in a merge request.
+For each file, decide whether it NEEDS_REVIEW (modifies logic, functionality, security, or performance) or can be SKIPPED (cosmetic-only: formatting, comments, renaming for clarity, docs, auto-generated files).
+
+Also produce a concise summary (2-4 sentences) of the entire merge request: what it does and which areas it touches.
+
+Respond with a JSON object (no markdown fences, no prose before or after) in this exact schema:
+{ "summary": "<MR summary>", "files": [{ "path": "<file path>", "verdict": "NEEDS_REVIEW" | "SKIP", "reason": "<one short sentence explaining the verdict>" }] }
+
+The reason field is required for every file — cite what you saw in the diff (e.g. "import reordering only" or "changes Input props and validation").
+
+Rules:
+- When in doubt, verdict is NEEDS_REVIEW.
+- Look beyond comments and JSDoc: if the diff changes function signatures, return types, control flow, variable assignments, or adds/removes code lines (not just comments), it is a logic change → NEEDS_REVIEW.
+- If a file mixes doc/comment edits with actual code changes, verdict is NEEDS_REVIEW.
+- Refactoring (splitting/merging functions, changing data structures, renaming with signature changes) is NEEDS_REVIEW.
+- Deleted files are SKIP unless the deletion could break dependents.
+- New files containing logic are NEEDS_REVIEW.
+- Test files that add, remove, or change assertions or expected values are NEEDS_REVIEW.
+- Test-only files are SKIP only if changes are purely cosmetic (formatting, comments).
+- Config/CI/docs files are SKIP unless they modify build targets, env vars, or secrets.
+
+Example output (copy this style exactly — single JSON object, no fences, no preamble):
+{"summary":"Adds retry-with-backoff to the OpenAI client and updates the README badge.","files":[{"path":"src/openai/client.ts","verdict":"NEEDS_REVIEW","reason":"adds retry loop and error handling in API client"},{"path":"README.md","verdict":"SKIP","reason":"badge URL change only"}]}`;
+const WEAK = `You triage merge-request files. Output one JSON object only — no prose, no markdown, no code fences, no preamble.
+
+Schema (use exactly these keys):
+{"summary":"<2-3 sentences about the MR>","files":[{"path":"<file path>","verdict":"NEEDS_REVIEW" | "SKIP","reason":"<one short sentence>"}]}
+
+Mark a file NEEDS_REVIEW when ANY of these is true:
+- the diff adds or removes non-comment lines,
+- the diff changes a function signature, return type, control flow, or variable value,
+- the file is new and contains code,
+- a test changes an assertion or expected value,
+- a config/CI file changes build targets, env vars, or secrets.
+
+Mark a file SKIP only when the diff is purely cosmetic: whitespace, comments, JSDoc, plain docs, auto-generated files, or deletions that cannot affect callers.
+When in doubt, choose NEEDS_REVIEW.
+
+Example output (copy this exactly — one line, one JSON object, nothing else):
+{"summary":"Adds retry-with-backoff to the OpenAI client and updates the README badge.","files":[{"path":"src/openai/client.ts","verdict":"NEEDS_REVIEW","reason":"adds retry loop in API client"},{"path":"README.md","verdict":"SKIP","reason":"badge URL only"}]}`;
+export function getTriageSystemPrompt(profile) {
+    return profile === "weak" ? WEAK : DEFAULT;
 }
-/** @deprecated kept for backward compatibility — use getTriageSystemLines("default"). */
-export const TRIAGE_SYSTEM_LINES = DEFAULT_LINES;
+/** @deprecated kept for backward compatibility — use getTriageSystemPrompt("default"). */
+export const TRIAGE_SYSTEM_LINES = DEFAULT.split("\n");

package/dist/prompt/templates/user-prompts.js

@@ -2,15 +2,13 @@
 import { truncateWithMarker } from "../utils.js";
 export function buildMainReviewUserContent(params) {
     const { stats, toolNote, changesText } = params;
-    return [
-        `Review the following code changes (git diff format). ${stats}`,
-        toolNote,
-        "",
-        "Changes:",
-        changesText || "(no changes provided)",
-        "",
-        "Produce your review now. Follow the system instructions strictly.",
-    ].join("\n");
+    return `Review the following code changes (git diff format). ${stats}
+${toolNote}
+
+Changes:
+${changesText || "(no changes provided)"}
+
+Produce your review now. Follow the system instructions strictly.`;
 }
 export function buildTriageUserContent(changes, maxDiffChars) {
     const fileEntries = changes.map((c) => {
@@ -32,43 +30,37 @@ export function buildFileReviewUserContent(params) {
     const otherFilesNote = otherChangedFiles.length > 0
         ? `\nOther files changed in this MR: ${otherChangedFiles.join(", ")}`
         : "";
-    return [
-        `MR Summary: ${summary}`,
-        otherFilesNote,
-        "",
-        toolNote,
-        "",
-        `File: ${filePath}`,
-        "Diff:",
-        fileDiff,
-        "",
-        "Review this file now.",
-    ].join("\n");
+    return `MR Summary: ${summary}
+${otherFilesNote}
+
+${toolNote}
+
+File: ${filePath}
+Diff:
+${fileDiff}
+
+Review this file now.`;
 }
 export function buildConsolidateUserContent(params) {
     const { summary, findingsText, maxFindings } = params;
-    return [
-        `MR Summary: ${summary}`,
-        "",
-        "Per-file findings:",
-        findingsText,
-        "",
-        `Return the top ${maxFindings} findings in the required bullet format.`,
-    ].join("\n");
+    return `MR Summary: ${summary}
+
+Per-file findings:
+${findingsText}
+
+Return the top ${maxFindings} findings in the required bullet format.`;
 }
 export function buildVerificationUserContent(params) {
     const { summary, findingsText, consolidatedFindings, refs } = params;
-    return [
-        `MR Summary: ${summary}`,
-        "",
-        `Refs for tools: head (post-change)="${refs.head}", base="${refs.base}". Prefer head when checking whether the issue exists in the MR.`,
-        "",
-        "Per-file findings (evidence pool):",
-        findingsText,
-        "",
-        "Draft consolidated findings to verify:",
-        consolidatedFindings,
-        "",
-        "Return only the verified final findings.",
-    ].join("\n");
+    return `MR Summary: ${summary}
+
+Refs for tools: head (post-change)="${refs.head}", base="${refs.base}". Prefer head when checking whether the issue exists in the MR.
+
+Per-file findings (evidence pool):
+${findingsText}
+
+Draft consolidated findings to verify:
+${consolidatedFindings}
+
+Return only the verified final findings.`;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "type": "module",
   "name": "@krotovm/gitlab-ai-review",
-  "version": "1.0.40",
+  "version": "1.0.42",
   "description": "CLI tool to generate AI code reviews for GitLab merge requests.",
   "main": "dist/cli.js",
   "bin": {
@@ -16,8 +16,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "build:ts": "tsc",
-    "prepublishOnly": "pnpm build:ts"
+    "prepare": "tsc"
   },
   "keywords": [
     "gitlab",