@krotovm/gitlab-ai-review 1.0.41 → 1.0.43

package/README.md

@@ -76,7 +76,7 @@ Set these in your project/group CI settings:
 - `OPENAI_BASE_URL` (optional, for OpenAI-compatible providers/proxies)
 - `AI_MODEL` (optional, default: `gpt-4o-mini`; example: `gpt-4o`)
 - `AI_PROMPT_PROFILE` (optional, default: `default`; one of `default` \| `weak`). Use `weak` for small or heavily-quantized models (≤ ~7B, local Ollama, etc.). The `weak` profile uses shorter system prompts, positive rules instead of negations, and inline few-shot examples for triage / per-file review / consolidation / verification, which dramatically improves output-format adherence on weak models. When the variable is not set, the profile is auto-detected: if the triage pass returns unparseable JSON with `default` prompts, triage is retried once with `weak` and, on success, the whole run continues with it. Set the variable explicitly to pin a profile and disable auto-detection.
-- `PROJECT_ACCESS_TOKEN` (optional for public projects, but required for most private projects; token with `api` scope)
+- `PROJECT_ACCESS_TOKEN` (required; project or personal access token with `api` scope — `CI_JOB_TOKEN` can't post MR comments or use the search API)
 - `GITLAB_TOKEN` (optional alias for `PROJECT_ACCESS_TOKEN`)
 - `AI_REVIEW_CONCURRENCY` (optional) — same as `--max-review-concurrency`, handy as a CI/CD variable; the flag wins when both are set.
 - `AI_REVIEW_ARTIFACT_HTML_FILE` (optional, default: `ai-review-report.html`; used with `--include-artifacts`)
@@ -88,7 +88,7 @@ GitLab provides these automatically in Merge Request pipelines:
 - `CI_API_V4_URL`
 - `CI_PROJECT_ID`
 - `CI_MERGE_REQUEST_IID`
-- `CI_JOB_TOKEN` (used only when `PROJECT_ACCESS_TOKEN` is not provided)
+- `CI_MERGE_REQUEST_PROJECT_ID` (the MR's target project; used instead of `CI_PROJECT_ID`, so MRs from forks work)
 
 ## Flags
 

package/dist/cli/ci-review.js

@@ -3,7 +3,7 @@ import OpenAI from "openai";
 import { buildAnswer, buildConsolidatePrompt, buildFileReviewPrompt, buildPrompt, buildTriagePrompt, buildVerificationPrompt, DEFAULT_PROMPT_PROFILE, extractCompletionText, isEmptyReviewBody, NO_FINDINGS_SENTENCE, parseTriageResponseDetailed, parseTriageResponse, } from "../prompt/index.js";
 import { fetchFileAtRef, searchRepository, } from "../gitlab/services.js";
 import { parseReviewFindings, truncateWithMarker } from "../prompt/utils.js";
-import { logToolUsageMinimal, MAX_FILE_TOOL_ROUNDS, MAX_TOOL_ROUNDS, MAX_VERIFICATION_TOOL_ROUNDS, TOOL_NAME_GET_FILE, TOOL_NAME_GREP, } from "./tooling.js";
+import { logToolFailure, logToolUsageMinimal, MAX_FILE_TOOL_ROUNDS, MAX_TOOL_ROUNDS, MAX_VERIFICATION_TOOL_ROUNDS, TOOL_NAME_GET_FILE, TOOL_NAME_GREP, } from "./tooling.js";
 /** Hard deadline per model call, retries included. Must exceed the gateway's own
  *  proxy timeout so the SDK's 5xx retries stay the first line of defense. */
 const COMPLETION_TIMEOUT_MS = 180_000;
@@ -14,6 +14,7 @@ let streamUsageSupported = true;
  *  round, so oversized results multiply prefill time on self-hosted models. */
 const MAX_TOOL_FILE_CHARS = 12_000;
 const MAX_TOOL_GREP_CHARS = 800;
+const MAX_TOOL_GREP_RESULTS = 10;
 function buildTriageDecisions(params) {
     const { changes, triageResult } = params;
     const triageMap = new Map(triageResult.files.map((f) => [f.path, f]));
@@ -143,13 +144,13 @@ function buildReviewMetadata(changes, refs) {
         changed_files: files,
         tool_usage_guidance: [
             "If diff context is insufficient, call get_file_at_ref to read a specific file.",
-            "Use grep_repository to search for usages, definitions, or patterns across the codebase.",
+            "Use grep_repository to find usages or definitions by literal text (no regex) across the codebase.",
             "Use refs.base to inspect pre-change content and refs.head for current content.",
             "Prefer targeted searches and file fetches; avoid broad context requests.",
         ],
     }, null, 2);
 }
-async function handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers) {
+async function handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers, logStep) {
     try {
         const parsed = JSON.parse(argsRaw);
         const path = parsed.path?.trim();
@@ -161,16 +162,18 @@ async function handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers) {
             });
         }
         const fileText = await fetchFileAtRef({
-            gitLabBaseUrl: gitLabProjectApiUrl,
+            gitLabProjectApiUrl: gitLabProjectApiUrl,
             headers,
             filePath: path,
             ref,
         });
         if (fileText instanceof Error) {
+            logToolFailure(logStep, TOOL_NAME_GET_FILE, fileText);
             return JSON.stringify({
                 ok: false,
                 path,
                 ref,
+                status: fileText.statusCode,
                 error: fileText.message,
             });
         }
@@ -183,46 +186,57 @@ async function handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers) {
         });
     }
     catch (error) {
+        logToolFailure(logStep, TOOL_NAME_GET_FILE, error);
         return JSON.stringify({
             ok: false,
-            error: `Failed to parse tool arguments: ${String(error?.message ?? error)}`,
+            error: `Tool call failed: ${String(error?.message ?? error)}`,
             raw: argsRaw,
         });
     }
 }
-async function handleGrepTool(argsRaw, defaultRef, gitLabProjectApiUrl, headers, projectId) {
+async function handleGrepTool(argsRaw, refs, gitLabProjectApiUrl, headers, logStep) {
     try {
         const parsed = JSON.parse(argsRaw);
         const query = parsed.query?.trim();
         if (!query)
             return JSON.stringify({ ok: false, error: "query is required." });
-        const ref = parsed.ref?.trim() || defaultRef;
+        // GitLab search answers 200 [] for unknown refs, so only the MR's own refs are searched.
+        const ref = parsed.ref?.trim() === refs.base ? refs.base : refs.head;
         const results = await searchRepository({
-            gitLabBaseUrl: gitLabProjectApiUrl,
+            gitLabProjectApiUrl: gitLabProjectApiUrl,
             headers,
             query,
             ref,
-            projectId,
         });
         if (results instanceof Error) {
+            logToolFailure(logStep, TOOL_NAME_GREP, results);
             return JSON.stringify({
                 ok: false,
                 query,
                 ref,
+                status: results.statusCode,
                 error: results.message,
             });
         }
-        const trimmed = results.map((r) => ({
+        // GitLab lists file-name matches (file head, startline 1) before content matches;
+        // rank hits that contain the query first so they aren't crowded out.
+        const needle = query.toLowerCase();
+        const hasNeedle = (r) => (r.data ?? "").toLowerCase().includes(needle);
+        const trimmed = results
+            .sort((a, b) => Number(hasNeedle(b)) - Number(hasNeedle(a)))
+            .slice(0, MAX_TOOL_GREP_RESULTS)
+            .map((r) => ({
             path: r.path,
             startline: r.startline,
-            data: r.data.slice(0, MAX_TOOL_GREP_CHARS),
+            data: (r.data ?? "").slice(0, MAX_TOOL_GREP_CHARS),
         }));
         return JSON.stringify({ ok: true, query, ref, matches: trimmed });
     }
     catch (error) {
+        logToolFailure(logStep, TOOL_NAME_GREP, error);
         return JSON.stringify({
             ok: false,
-            error: `Failed to parse tool arguments: ${String(error?.message ?? error)}`,
+            error: `Tool call failed: ${String(error?.message ?? error)}`,
             raw: argsRaw,
         });
     }
@@ -241,8 +255,8 @@ async function mapWithConcurrency(items, concurrency, fn) {
     await Promise.all(workers);
     return results;
 }
-export async function reviewMergeRequestWithTools(params) {
-    const { openaiInstance, aiModel, promptLimits, changes, refs, gitLabProjectApiUrl, projectId, headers, forceTools, promptProfile = DEFAULT_PROMPT_PROFILE, loggers, debugDumpFile, debugRecordWriter, } = params;
+async function reviewMergeRequestWithTools(params) {
+    const { openaiInstance, aiModel, promptLimits, changes, refs, gitLabProjectApiUrl, headers, forceTools, promptProfile = DEFAULT_PROMPT_PROFILE, loggers, debugDumpFile, debugRecordWriter, } = params;
     const { logDebug, logStep } = loggers;
     logStep(`Single-pass review started for ${changes.length} file(s) (fallback mode).`);
     const messages = buildPrompt({
@@ -279,14 +293,14 @@ export async function reviewMergeRequestWithTools(params) {
             type: "function",
             function: {
                 name: TOOL_NAME_GREP,
-                description: "Search the repository for a keyword or pattern. Returns up to 10 matching code fragments with file paths and line numbers.",
+                description: "Search the repository for literal text (case-insensitive substring match). Regular expressions are not supported: `a|b` or `foo.*bar` are searched as literal text, so query one identifier at a time. Returns up to 10 matching code fragments with file paths and line numbers.",
                 parameters: {
                     type: "object",
                     additionalProperties: false,
                     properties: {
                         query: {
                             type: "string",
-                            description: "Search string (keyword, function name, variable, etc.).",
+                            description: "Literal text to find, e.g. a function or variable name (no regex).",
                         },
                         ref: {
                             type: "string",
@@ -343,10 +357,10 @@ export async function reviewMergeRequestWithTools(params) {
             logToolUsageMinimal(logStep, toolName, argsRaw);
             let toolContent;
             if (toolName === TOOL_NAME_GET_FILE) {
-                toolContent = await handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers);
+                toolContent = await handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers, logStep);
             }
             else if (toolName === TOOL_NAME_GREP) {
-                toolContent = await handleGrepTool(argsRaw, refs.head, gitLabProjectApiUrl, headers, projectId);
+                toolContent = await handleGrepTool(argsRaw, refs, gitLabProjectApiUrl, headers, logStep);
             }
             else {
                 toolContent = JSON.stringify({
@@ -390,7 +404,7 @@ export async function reviewMergeRequestWithTools(params) {
     return buildAnswer(finalCompletion);
 }
 async function runFileReviewWithTools(params) {
-    const { openaiInstance, aiModel, filePath, fileDiff, summary, otherChangedFiles, refs, gitLabProjectApiUrl, projectId, headers, forceTools, promptProfile, loggers, debugDumpFile, debugRecordWriter, } = params;
+    const { openaiInstance, aiModel, filePath, fileDiff, summary, otherChangedFiles, refs, gitLabProjectApiUrl, headers, forceTools, promptProfile, loggers, debugDumpFile, debugRecordWriter, } = params;
     const { logDebug, logStep } = loggers;
     const messages = buildFileReviewPrompt({
         filePath,
@@ -424,14 +438,14 @@ async function runFileReviewWithTools(params) {
             type: "function",
             function: {
                 name: TOOL_NAME_GREP,
-                description: "Search the repository for a keyword or pattern. Returns up to 10 matching code fragments with file paths and line numbers.",
+                description: "Search the repository for literal text (case-insensitive substring match). Regular expressions are not supported: `a|b` or `foo.*bar` are searched as literal text, so query one identifier at a time. Returns up to 10 matching code fragments with file paths and line numbers.",
                 parameters: {
                     type: "object",
                     additionalProperties: false,
                     properties: {
                         query: {
                             type: "string",
-                            description: "Search string (keyword, function name, variable, etc.).",
+                            description: "Literal text to find, e.g. a function or variable name (no regex).",
                         },
                         ref: {
                             type: "string",
@@ -487,10 +501,10 @@ async function runFileReviewWithTools(params) {
             logToolUsageMinimal(logStep, toolName, argsRaw, filePath);
             let toolContent;
             if (toolName === TOOL_NAME_GET_FILE) {
-                toolContent = await handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers);
+                toolContent = await handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers, logStep);
             }
             else if (toolName === TOOL_NAME_GREP) {
-                toolContent = await handleGrepTool(argsRaw, refs.head, gitLabProjectApiUrl, headers, projectId);
+                toolContent = await handleGrepTool(argsRaw, refs, gitLabProjectApiUrl, headers, logStep);
             }
             else {
                 toolContent = JSON.stringify({
@@ -537,7 +551,7 @@ function draftHasStructuredFindings(consolidatedText) {
     return /-\s*\[(?:high|medium)\]/i.test(consolidatedText);
 }
 async function runVerificationWithTools(params) {
-    const { openaiInstance, aiModel, baseMessages, refs, gitLabProjectApiUrl, projectId, headers, forceTools, consolidatedDraft, loggers, debugDumpFile, debugRecordWriter, } = params;
+    const { openaiInstance, aiModel, baseMessages, refs, gitLabProjectApiUrl, headers, forceTools, consolidatedDraft, loggers, debugDumpFile, debugRecordWriter, } = params;
     const { logDebug, logStep } = loggers;
     const messages = [...baseMessages];
     const tools = [
@@ -564,14 +578,14 @@ async function runVerificationWithTools(params) {
             type: "function",
             function: {
                 name: TOOL_NAME_GREP,
-                description: "Search the repository for a keyword or pattern. Returns up to 10 matching code fragments with file paths and line numbers.",
+                description: "Search the repository for literal text (case-insensitive substring match). Regular expressions are not supported: `a|b` or `foo.*bar` are searched as literal text, so query one identifier at a time. Returns up to 10 matching code fragments with file paths and line numbers.",
                 parameters: {
                     type: "object",
                     additionalProperties: false,
                     properties: {
                         query: {
                             type: "string",
-                            description: "Search string (keyword, function name, variable, etc.).",
+                            description: "Literal text to find, e.g. a function or variable name (no regex).",
                         },
                         ref: {
                             type: "string",
@@ -627,10 +641,10 @@ async function runVerificationWithTools(params) {
             logToolUsageMinimal(logStep, toolName, argsRaw, "(verify)");
             let toolContent;
             if (toolName === TOOL_NAME_GET_FILE) {
-                toolContent = await handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers);
+                toolContent = await handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers, logStep);
             }
             else if (toolName === TOOL_NAME_GREP) {
-                toolContent = await handleGrepTool(argsRaw, refs.head, gitLabProjectApiUrl, headers, projectId);
+                toolContent = await handleGrepTool(argsRaw, refs, gitLabProjectApiUrl, headers, logStep);
             }
             else {
                 toolContent = JSON.stringify({
@@ -672,7 +686,7 @@ async function runVerificationWithTools(params) {
     });
 }
 export async function reviewMergeRequestMultiPass(params) {
-    const { openaiInstance, aiModel, promptLimits, triageDiffChars, changes, refs, gitLabProjectApiUrl, projectId, headers, maxFindings, reviewConcurrency, forceTools, promptProfile = DEFAULT_PROMPT_PROFILE, allowProfileAutoDemote = false, loggers, debugDumpFile, debugRecordWriter, } = params;
+    const { openaiInstance, aiModel, promptLimits, triageDiffChars, changes, refs, gitLabProjectApiUrl, headers, maxFindings, reviewConcurrency, forceTools, promptProfile = DEFAULT_PROMPT_PROFILE, allowProfileAutoDemote = false, loggers, debugDumpFile, debugRecordWriter, } = params;
     const { logStep } = loggers;
     let effectiveProfile = promptProfile;
     logStep(`Pass 1/4: triaging ${changes.length} file(s) ` +
@@ -773,7 +787,6 @@ export async function reviewMergeRequestMultiPass(params) {
             changes,
             refs,
             gitLabProjectApiUrl,
-            projectId,
             headers,
             forceTools,
             promptProfile: effectiveProfile,
@@ -821,7 +834,6 @@ export async function reviewMergeRequestMultiPass(params) {
                 otherChangedFiles: otherFiles,
                 refs,
                 gitLabProjectApiUrl,
-                projectId,
                 headers,
                 forceTools,
                 promptProfile: effectiveProfile,
@@ -909,7 +921,6 @@ export async function reviewMergeRequestMultiPass(params) {
                 baseMessages: verificationMessages,
                 refs,
                 gitLabProjectApiUrl,
-                projectId,
                 headers,
                 forceTools,
                 consolidatedDraft: consolidatedText,

package/dist/cli/tooling.js

@@ -27,3 +27,9 @@ export function logToolUsageMinimal(logStep, toolName, argsRaw, contextFile) {
     const suffix = contextFile ? ` review_file=${contextFile}` : "";
     logStep(`[tools] ${toolName} args=${argsRaw.slice(0, 120)}${suffix}`);
 }
+/** Operator-facing line for a failed tool call: GitLab status and request URL when known. */
+export function logToolFailure(logStep, toolName, error) {
+    const status = error?.statusCode != null ? ` status=${error.statusCode}` : "";
+    const url = typeof error?.cause?.url === "string" ? ` url=${error.cause.url}` : "";
+    logStep(`[tools] ${toolName} failed: ${String(error?.message ?? error)}${status}${url}`);
+}

package/dist/cli.js

@@ -8,43 +8,41 @@ import { reviewMergeRequestMultiPass } from "./cli/ci-review.js";
 import { fetchMergeRequestChanges, postMergeRequestNote, } from "./gitlab/services.js";
 import { renderDebugArtifactsHtml } from "./cli/debug-artifacts-html.js";
 function printHelp() {
-    process.stdout.write([
-        "gitlab-ai-review",
-        "",
-        "Usage:",
-        "  gitlab-ai-review",
-        "  gitlab-ai-review --help",
-        "  gitlab-ai-review --debug",
-        "  gitlab-ai-review --ignore-ext=md,lock",
-        "",
-        "Debug:",
-        "  --debug        Print full error details (stack, API error fields).",
-        "  --include-artifacts  Generate local HTML artifact without printing payloads to console.",
-        "  --force-tools  Force at least one tool-call round in tool-enabled review paths.",
-        "  --ignore-ext   Ignore file extensions (comma-separated only). Example: --ignore-ext=md,lock",
-        "  --max-diffs=50",
-        "  --max-diff-chars=16000",
-        "  --max-total-prompt-chars=220000",
-        "  --triage-diff-chars=2000   Max chars per file diff in triage pass (Pass 1).",
-        "  --max-findings=5          Max findings in final review (CI multi-pass only).",
-        "  --max-review-concurrency=2  Parallel per-file review calls (CI multi-pass only).",
-        "",
-        "Env vars:",
-        "  OPENAI_API_KEY (required)  OpenAI API key.",
-        "  OPENAI_BASE_URL (optional)  Custom OpenAI-compatible API base URL.",
-        "  AI_MODEL      (optional)  OpenAI chat model, e.g. gpt-4o. Default: gpt-4o-mini.",
-        "  AI_REVIEW_CONCURRENCY (optional)  Same as --max-review-concurrency; the flag wins.",
-        "  AI_PROMPT_PROFILE (optional)  Prompt style: \"default\" | \"weak\". Default: default.",
-        "                              Use \"weak\" for small/quantized models — shorter prompts,",
-        "                              positive rules, and few-shot examples.",
-        "                              When unset, an unparseable triage response auto-retries",
-        "                              with \"weak\" and keeps it for the whole run.",
-        "  PROJECT_ACCESS_TOKEN (optional)  GitLab Project/Personal Access Token for API calls (required for most private repos; should have api scope).",
-        "",
-        "CI-only env vars (provided by GitLab):",
-        "  CI_API_V4_URL, CI_PROJECT_ID, CI_MERGE_REQUEST_IID, CI_JOB_TOKEN (only if PROJECT_ACCESS_TOKEN is not set)",
-        "",
-    ].join("\n"));
+    process.stdout.write(`gitlab-ai-review
+
+Usage:
+  gitlab-ai-review
+  gitlab-ai-review --help
+  gitlab-ai-review --debug
+  gitlab-ai-review --ignore-ext=md,lock
+
+Debug:
+  --debug        Print full error details (stack, API error fields).
+  --include-artifacts  Generate local HTML artifact without printing payloads to console.
+  --force-tools  Force at least one tool-call round in tool-enabled review paths.
+  --ignore-ext   Ignore file extensions (comma-separated only). Example: --ignore-ext=md,lock
+  --max-diffs=50
+  --max-diff-chars=16000
+  --max-total-prompt-chars=220000
+  --triage-diff-chars=2000   Max chars per file diff in triage pass (Pass 1).
+  --max-findings=5          Max findings in final review (CI multi-pass only).
+  --max-review-concurrency=2  Parallel per-file review calls (CI multi-pass only).
+
+Env vars:
+  OPENAI_API_KEY (required)  OpenAI API key.
+  OPENAI_BASE_URL (optional)  Custom OpenAI-compatible API base URL.
+  AI_MODEL      (optional)  OpenAI chat model, e.g. gpt-4o. Default: gpt-4o-mini.
+  AI_REVIEW_CONCURRENCY (optional)  Same as --max-review-concurrency; the flag wins.
+  AI_PROMPT_PROFILE (optional)  Prompt style: "default" | "weak". Default: default.
+                              Use "weak" for small/quantized models — shorter prompts,
+                              positive rules, and few-shot examples.
+                              When unset, an unparseable triage response auto-retries
+                              with "weak" and keeps it for the whole run.
+  PROJECT_ACCESS_TOKEN (required)  GitLab project/personal access token with api scope (alias: GITLAB_TOKEN). CI_JOB_TOKEN can't post MR comments.
+
+CI-only env vars (provided by GitLab):
+  CI_API_V4_URL, CI_PROJECT_ID, CI_MERGE_REQUEST_PROJECT_ID, CI_MERGE_REQUEST_IID
+`);
 }
 const DEBUG_MODE = hasDebugFlag(process.argv);
 const FORCE_TOOLS = hasForceToolsFlag(process.argv);
@@ -109,24 +107,24 @@ async function main() {
         "CI_PROJECT_ID",
         "CI_MERGE_REQUEST_IID",
     ];
+    // CI_JOB_TOKEN can't post MR notes or call the search API, so a real token is required.
     if (projectAccessToken == null)
-        gitlabRequired.push("CI_JOB_TOKEN");
+        gitlabRequired.push("PROJECT_ACCESS_TOKEN");
     const envs = requireEnvs(gitlabRequired);
     const openaiApiKey = envs["OPENAI_API_KEY"];
     const ciApiV4Url = envs["CI_API_V4_URL"];
-    const projectId = envs["CI_PROJECT_ID"];
+    // MR endpoints live in the MR's target project; in fork pipelines CI_PROJECT_ID is the fork.
+    const projectId = envOrUndefined("CI_MERGE_REQUEST_PROJECT_ID") ?? envs["CI_PROJECT_ID"];
     const mergeRequestIid = envs["CI_MERGE_REQUEST_IID"];
-    const headers = {};
-    if (projectAccessToken != null)
-        headers["PRIVATE-TOKEN"] = projectAccessToken;
-    else
-        headers["JOB-TOKEN"] = envs["CI_JOB_TOKEN"];
+    const gitLabProjectApiUrl = new URL(`${ciApiV4Url}/projects/${projectId}`);
+    const headers = {
+        "PRIVATE-TOKEN": projectAccessToken,
+    };
     try {
         logStep("Fetching merge request changes");
         const mrChanges = await fetchMergeRequestChanges({
-            gitLabBaseUrl: new URL(ciApiV4Url),
+            gitLabProjectApiUrl: gitLabProjectApiUrl,
             headers,
-            projectId,
             mergeRequestIid,
         });
         if (mrChanges instanceof Error)
@@ -149,8 +147,7 @@ async function main() {
                 base: mrChanges.diff_refs?.base_sha ?? "HEAD",
                 head: mrChanges.diff_refs?.head_sha ?? "HEAD",
             },
-            gitLabProjectApiUrl: new URL(`${ciApiV4Url}/projects/${projectId}`),
-            projectId,
+            gitLabProjectApiUrl: gitLabProjectApiUrl,
             headers,
             maxFindings,
             reviewConcurrency,
@@ -162,10 +159,11 @@ async function main() {
         });
         logStep("Posting AI review note to merge request");
         const noteRes = await postMergeRequestNote({
-            gitLabBaseUrl: new URL(`${ciApiV4Url}/projects/${projectId}`),
+            gitLabProjectApiUrl: gitLabProjectApiUrl,
             headers,
             mergeRequestIid,
-        }, { body: answer });
+            note: answer,
+        });
         if (noteRes instanceof Error)
             throw noteRes;
         process.stdout.write("Posted AI review comment to merge request.\n");

package/dist/gitlab/services.js

@@ -1,49 +1,7 @@
 /** @format */
-import OpenAI from "openai";
-import { AI_MODEL_TEMPERATURE } from "../prompt/index.js";
-import { GitLabError, OpenAIError, } from "./types.js";
-export const fetchPreEditFiles = async ({ gitLabBaseUrl, headers, changesOldPaths, ref }) => {
-    const oldFilesRequestUrls = changesOldPaths.map((filePath) => {
-        const url = new URL(`${gitLabBaseUrl}/repository/files/${encodeURIComponent(filePath)}/raw`);
-        url.searchParams.set("ref", ref);
-        return url;
-    });
-    let oldFiles;
-    try {
-        oldFiles = await Promise.allSettled(oldFilesRequestUrls.map(async (url) => {
-            const res = await fetch(url, { headers: { ...headers } });
-            if (!res.ok) {
-                const bodyText = await res.text().catch(() => "");
-                throw new Error(`Failed to fetch old file: ${url.toString()} (status ${res.status} ${res.statusText}, body: ${bodyText.slice(0, 500)})`);
-            }
-            return await res.text();
-        }));
-    }
-    catch (error) {
-        oldFiles = error;
-    }
-    if (oldFiles instanceof Error) {
-        return new GitLabError({
-            name: "MISSING_OLD_FILES",
-            message: "Failed to fetch old files",
-            cause: {
-                message: oldFiles.message,
-                stack: oldFiles.stack,
-            },
-        });
-    }
-    return oldFiles.reduce((acc, file, index) => {
-        if (file.status === "fulfilled") {
-            acc.push({
-                fileName: changesOldPaths[index],
-                fileContent: file.value,
-            });
-        }
-        return acc;
-    }, []);
-};
-export const fetchFileAtRef = async ({ gitLabBaseUrl, headers, filePath, ref }) => {
-    const url = new URL(`${gitLabBaseUrl}/repository/files/${encodeURIComponent(filePath)}/raw`);
+import { GitLabError, } from "./types.js";
+export const fetchFileAtRef = async ({ gitLabProjectApiUrl, headers, filePath, ref }) => {
+    const url = new URL(`${gitLabProjectApiUrl}/repository/files/${encodeURIComponent(filePath)}/raw`);
     url.searchParams.set("ref", ref);
     let res;
     try {
@@ -81,30 +39,8 @@ export const fetchFileAtRef = async ({ gitLabBaseUrl, headers, filePath, ref })
     }
     return await res.text();
 };
-export async function generateAICompletion(messages, openaiInstance, aiModel) {
-    let completion;
-    try {
-        completion = await openaiInstance.chat.completions.create({
-            model: aiModel,
-            temperature: AI_MODEL_TEMPERATURE,
-            stream: false,
-            messages,
-        });
-    }
-    catch (error) {
-        completion = error;
-    }
-    if (completion instanceof Error) {
-        return new OpenAIError({
-            name: "MISSING_AI_COMPLETION",
-            message: "Failed to generate AI completion",
-            cause: completion,
-        });
-    }
-    return completion;
-}
-export const postMergeRequestNote = async ({ gitLabBaseUrl, headers, mergeRequestIid }, commentPayload) => {
-    const commentUrl = new URL(`${gitLabBaseUrl}/merge_requests/${mergeRequestIid}/notes`);
+export const postMergeRequestNote = async ({ gitLabProjectApiUrl, headers, mergeRequestIid, note }) => {
+    const commentUrl = new URL(`${gitLabProjectApiUrl}/merge_requests/${mergeRequestIid}/notes`);
     let aiComment;
     try {
         aiComment = await fetch(commentUrl, {
@@ -113,7 +49,7 @@ export const postMergeRequestNote = async ({ gitLabBaseUrl, headers, mergeReques
                 ...headers,
                 "Content-Type": "application/json",
             },
-            body: JSON.stringify(commentPayload),
+            body: JSON.stringify({ body: note }),
         });
     }
     catch (error) {
@@ -147,12 +83,13 @@ export const postMergeRequestNote = async ({ gitLabBaseUrl, headers, mergeReques
         });
     }
 };
-export const searchRepository = async ({ gitLabBaseUrl, headers, query, ref, projectId }) => {
-    const url = new URL(`${gitLabBaseUrl}/projects/${projectId}/search`);
+export const searchRepository = async ({ gitLabProjectApiUrl, headers, query, ref }) => {
+    const url = new URL(`${gitLabProjectApiUrl}/search`);
     url.searchParams.set("scope", "blobs");
     url.searchParams.set("search", query);
     url.searchParams.set("ref", ref);
-    url.searchParams.set("per_page", "10");
+    // Name matches come before content matches; the grep tool re-ranks and keeps 10.
+    url.searchParams.set("per_page", "50");
     let res;
     try {
         res = await fetch(url, { headers: { ...headers } });
@@ -185,8 +122,8 @@ export const searchRepository = async ({ gitLabBaseUrl, headers, query, ref, pro
     }
     return (await res.json());
 };
-export const fetchMergeRequestChanges = async ({ gitLabBaseUrl, headers, projectId, mergeRequestIid }) => {
-    const url = new URL(`${gitLabBaseUrl}/projects/${projectId}/merge_requests/${mergeRequestIid}/changes`);
+export const fetchMergeRequestChanges = async ({ gitLabProjectApiUrl, headers, mergeRequestIid }) => {
+    const url = new URL(`${gitLabProjectApiUrl}/merge_requests/${mergeRequestIid}/changes`);
     // Ask GitLab for raw diffs to reduce truncation on larger merge requests.
     url.searchParams.set("access_raw_diffs", "true");
     let res;

package/dist/gitlab/types.js

@@ -1,5 +1,3 @@
 import { BaseError } from '../errors.js';
 export class GitLabError extends BaseError {
 }
-export class OpenAIError extends BaseError {
-}

package/dist/prompt/index.js

@@ -1,7 +1,7 @@
 /** @format */
 import { buildFileReviewSystemMessage, buildMainSystemMessages, buildTriageSystemMessage, } from "./messages.js";
 import { extractFirstJsonObject, normalizeReviewFindingsMarkdown, sanitizeGitLabMarkdown, truncateWithMarker, } from "./utils.js";
-import { getConsolidateSystemLines, getVerificationSystemLines, } from "./templates/postprocess-system.js";
+import { getConsolidateSystemPrompt, getVerificationSystemPrompt, } from "./templates/postprocess-system.js";
 import { buildConsolidateUserContent, buildFileReviewUserContent, buildMainReviewUserContent, buildTriageUserContent, buildVerificationUserContent, } from "./templates/user-prompts.js";
 import { DEFAULT_PROMPT_PROFILE, isEmptyReviewBody } from "./profile.js";
 export { DEFAULT_PROMPT_PROFILE, NO_FINDINGS_SENTENCE, isEmptyReviewBody, parsePromptProfile, } from "./profile.js";
@@ -12,8 +12,6 @@ export const DEFAULT_PROMPT_LIMITS = {
 };
 /** Max chars of each file diff sent to the triage pass (Pass 1). */
 export const DEFAULT_TRIAGE_DIFF_CHARS = 2000;
-export const AI_MODEL_TEMPERATURE = 0.2;
-export const AI_MAX_OUTPUT_TOKENS = 600;
 export const buildPrompt = ({ changes, limits, allowTools = false, profile = DEFAULT_PROMPT_PROFILE, }) => {
     const effectiveLimits = {
         ...DEFAULT_PROMPT_LIMITS,
@@ -160,7 +158,7 @@ export function buildConsolidatePrompt(params) {
     return [
         {
             role: "system",
-            content: getConsolidateSystemLines(profile, maxFindings).join("\n"),
+            content: getConsolidateSystemPrompt(profile, maxFindings),
         },
         {
             role: "user",
@@ -180,7 +178,7 @@ export function buildVerificationPrompt(params) {
     return [
         {
             role: "system",
-            content: getVerificationSystemLines(profile, maxFindings).join("\n"),
+            content: getVerificationSystemPrompt(profile, maxFindings),
         },
         {
             role: "user",

package/dist/prompt/messages.js

@@ -1,22 +1,18 @@
 /** @format */
-import { getFileReviewSystemLines, getMainSystemLines, } from "./templates/review-system.js";
-import { getTriageSystemLines } from "./templates/triage-system.js";
+import { getFileReviewSystemPrompt, getMainSystemPrompt, } from "./templates/review-system.js";
+import { getTriageSystemPrompt } from "./templates/triage-system.js";
 import { DEFAULT_PROMPT_PROFILE } from "./profile.js";
 export const buildMainSystemMessages = (profile = DEFAULT_PROMPT_PROFILE) => [
     {
         role: "system",
-        content: getMainSystemLines(profile).join("\n"),
+        content: getMainSystemPrompt(profile),
     },
 ];
 export const buildTriageSystemMessage = (profile = DEFAULT_PROMPT_PROFILE) => ({
     role: "system",
-    content: getTriageSystemLines(profile).join("\n"),
+    content: getTriageSystemPrompt(profile),
 });
 export const buildFileReviewSystemMessage = (profile = DEFAULT_PROMPT_PROFILE) => ({
     role: "system",
-    content: getFileReviewSystemLines(profile).join("\n"),
+    content: getFileReviewSystemPrompt(profile),
 });
-/** @deprecated kept for backward compatibility — use buildTriageSystemMessage(). */
-export const TRIAGE_SYSTEM = buildTriageSystemMessage();
-/** @deprecated kept for backward compatibility — use buildFileReviewSystemMessage(). */
-export const FILE_REVIEW_SYSTEM = buildFileReviewSystemMessage();