@krotovm/gitlab-ai-review 1.0.42 → 1.0.43

package/README.md

@@ -76,7 +76,7 @@ Set these in your project/group CI settings:
 - `OPENAI_BASE_URL` (optional, for OpenAI-compatible providers/proxies)
 - `AI_MODEL` (optional, default: `gpt-4o-mini`; example: `gpt-4o`)
 - `AI_PROMPT_PROFILE` (optional, default: `default`; one of `default` \| `weak`). Use `weak` for small or heavily-quantized models (≤ ~7B, local Ollama, etc.). The `weak` profile uses shorter system prompts, positive rules instead of negations, and inline few-shot examples for triage / per-file review / consolidation / verification, which dramatically improves output-format adherence on weak models. When the variable is not set, the profile is auto-detected: if the triage pass returns unparseable JSON with `default` prompts, triage is retried once with `weak` and, on success, the whole run continues with it. Set the variable explicitly to pin a profile and disable auto-detection.
-- `PROJECT_ACCESS_TOKEN` (optional for public projects, but required for most private projects; token with `api` scope)
+- `PROJECT_ACCESS_TOKEN` (required; project or personal access token with `api` scope — `CI_JOB_TOKEN` can't post MR comments or use the search API)
 - `GITLAB_TOKEN` (optional alias for `PROJECT_ACCESS_TOKEN`)
 - `AI_REVIEW_CONCURRENCY` (optional) — same as `--max-review-concurrency`, handy as a CI/CD variable; the flag wins when both are set.
 - `AI_REVIEW_ARTIFACT_HTML_FILE` (optional, default: `ai-review-report.html`; used with `--include-artifacts`)
@@ -88,7 +88,7 @@ GitLab provides these automatically in Merge Request pipelines:
 - `CI_API_V4_URL`
 - `CI_PROJECT_ID`
 - `CI_MERGE_REQUEST_IID`
-- `CI_JOB_TOKEN` (used only when `PROJECT_ACCESS_TOKEN` is not provided)
+- `CI_MERGE_REQUEST_PROJECT_ID` (the MR's target project; used instead of `CI_PROJECT_ID`, so MRs from forks work)
 
 ## Flags
 

package/dist/cli/ci-review.js

@@ -3,7 +3,7 @@ import OpenAI from "openai";
 import { buildAnswer, buildConsolidatePrompt, buildFileReviewPrompt, buildPrompt, buildTriagePrompt, buildVerificationPrompt, DEFAULT_PROMPT_PROFILE, extractCompletionText, isEmptyReviewBody, NO_FINDINGS_SENTENCE, parseTriageResponseDetailed, parseTriageResponse, } from "../prompt/index.js";
 import { fetchFileAtRef, searchRepository, } from "../gitlab/services.js";
 import { parseReviewFindings, truncateWithMarker } from "../prompt/utils.js";
-import { logToolUsageMinimal, MAX_FILE_TOOL_ROUNDS, MAX_TOOL_ROUNDS, MAX_VERIFICATION_TOOL_ROUNDS, TOOL_NAME_GET_FILE, TOOL_NAME_GREP, } from "./tooling.js";
+import { logToolFailure, logToolUsageMinimal, MAX_FILE_TOOL_ROUNDS, MAX_TOOL_ROUNDS, MAX_VERIFICATION_TOOL_ROUNDS, TOOL_NAME_GET_FILE, TOOL_NAME_GREP, } from "./tooling.js";
 /** Hard deadline per model call, retries included. Must exceed the gateway's own
  *  proxy timeout so the SDK's 5xx retries stay the first line of defense. */
 const COMPLETION_TIMEOUT_MS = 180_000;
@@ -14,6 +14,7 @@ let streamUsageSupported = true;
  *  round, so oversized results multiply prefill time on self-hosted models. */
 const MAX_TOOL_FILE_CHARS = 12_000;
 const MAX_TOOL_GREP_CHARS = 800;
+const MAX_TOOL_GREP_RESULTS = 10;
 function buildTriageDecisions(params) {
     const { changes, triageResult } = params;
     const triageMap = new Map(triageResult.files.map((f) => [f.path, f]));
@@ -149,7 +150,7 @@ function buildReviewMetadata(changes, refs) {
         ],
     }, null, 2);
 }
-async function handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers) {
+async function handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers, logStep) {
     try {
         const parsed = JSON.parse(argsRaw);
         const path = parsed.path?.trim();
@@ -167,10 +168,12 @@ async function handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers) {
             ref,
         });
         if (fileText instanceof Error) {
+            logToolFailure(logStep, TOOL_NAME_GET_FILE, fileText);
             return JSON.stringify({
                 ok: false,
                 path,
                 ref,
+                status: fileText.statusCode,
                 error: fileText.message,
             });
         }
@@ -183,46 +186,57 @@ async function handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers) {
         });
     }
     catch (error) {
+        logToolFailure(logStep, TOOL_NAME_GET_FILE, error);
         return JSON.stringify({
             ok: false,
-            error: `Failed to parse tool arguments: ${String(error?.message ?? error)}`,
+            error: `Tool call failed: ${String(error?.message ?? error)}`,
             raw: argsRaw,
         });
     }
 }
-async function handleGrepTool(argsRaw, defaultRef, gitLabProjectApiUrl, headers, projectId) {
+async function handleGrepTool(argsRaw, refs, gitLabProjectApiUrl, headers, logStep) {
     try {
         const parsed = JSON.parse(argsRaw);
         const query = parsed.query?.trim();
         if (!query)
             return JSON.stringify({ ok: false, error: "query is required." });
-        const ref = parsed.ref?.trim() || defaultRef;
+        // GitLab search answers 200 [] for unknown refs, so only the MR's own refs are searched.
+        const ref = parsed.ref?.trim() === refs.base ? refs.base : refs.head;
         const results = await searchRepository({
             gitLabProjectApiUrl: gitLabProjectApiUrl,
             headers,
             query,
             ref,
-            projectId,
         });
         if (results instanceof Error) {
+            logToolFailure(logStep, TOOL_NAME_GREP, results);
             return JSON.stringify({
                 ok: false,
                 query,
                 ref,
+                status: results.statusCode,
                 error: results.message,
             });
         }
-        const trimmed = results.map((r) => ({
+        // GitLab lists file-name matches (file head, startline 1) before content matches;
+        // rank hits that contain the query first so they aren't crowded out.
+        const needle = query.toLowerCase();
+        const hasNeedle = (r) => (r.data ?? "").toLowerCase().includes(needle);
+        const trimmed = results
+            .sort((a, b) => Number(hasNeedle(b)) - Number(hasNeedle(a)))
+            .slice(0, MAX_TOOL_GREP_RESULTS)
+            .map((r) => ({
             path: r.path,
             startline: r.startline,
-            data: r.data.slice(0, MAX_TOOL_GREP_CHARS),
+            data: (r.data ?? "").slice(0, MAX_TOOL_GREP_CHARS),
         }));
         return JSON.stringify({ ok: true, query, ref, matches: trimmed });
     }
     catch (error) {
+        logToolFailure(logStep, TOOL_NAME_GREP, error);
         return JSON.stringify({
             ok: false,
-            error: `Failed to parse tool arguments: ${String(error?.message ?? error)}`,
+            error: `Tool call failed: ${String(error?.message ?? error)}`,
             raw: argsRaw,
         });
     }
@@ -241,8 +255,8 @@ async function mapWithConcurrency(items, concurrency, fn) {
     await Promise.all(workers);
     return results;
 }
-export async function reviewMergeRequestWithTools(params) {
-    const { openaiInstance, aiModel, promptLimits, changes, refs, gitLabProjectApiUrl, projectId, headers, forceTools, promptProfile = DEFAULT_PROMPT_PROFILE, loggers, debugDumpFile, debugRecordWriter, } = params;
+async function reviewMergeRequestWithTools(params) {
+    const { openaiInstance, aiModel, promptLimits, changes, refs, gitLabProjectApiUrl, headers, forceTools, promptProfile = DEFAULT_PROMPT_PROFILE, loggers, debugDumpFile, debugRecordWriter, } = params;
     const { logDebug, logStep } = loggers;
     logStep(`Single-pass review started for ${changes.length} file(s) (fallback mode).`);
     const messages = buildPrompt({
@@ -343,10 +357,10 @@ export async function reviewMergeRequestWithTools(params) {
             logToolUsageMinimal(logStep, toolName, argsRaw);
             let toolContent;
             if (toolName === TOOL_NAME_GET_FILE) {
-                toolContent = await handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers);
+                toolContent = await handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers, logStep);
             }
             else if (toolName === TOOL_NAME_GREP) {
-                toolContent = await handleGrepTool(argsRaw, refs.head, gitLabProjectApiUrl, headers, projectId);
+                toolContent = await handleGrepTool(argsRaw, refs, gitLabProjectApiUrl, headers, logStep);
             }
             else {
                 toolContent = JSON.stringify({
@@ -390,7 +404,7 @@ export async function reviewMergeRequestWithTools(params) {
     return buildAnswer(finalCompletion);
 }
 async function runFileReviewWithTools(params) {
-    const { openaiInstance, aiModel, filePath, fileDiff, summary, otherChangedFiles, refs, gitLabProjectApiUrl, projectId, headers, forceTools, promptProfile, loggers, debugDumpFile, debugRecordWriter, } = params;
+    const { openaiInstance, aiModel, filePath, fileDiff, summary, otherChangedFiles, refs, gitLabProjectApiUrl, headers, forceTools, promptProfile, loggers, debugDumpFile, debugRecordWriter, } = params;
     const { logDebug, logStep } = loggers;
     const messages = buildFileReviewPrompt({
         filePath,
@@ -487,10 +501,10 @@ async function runFileReviewWithTools(params) {
             logToolUsageMinimal(logStep, toolName, argsRaw, filePath);
             let toolContent;
             if (toolName === TOOL_NAME_GET_FILE) {
-                toolContent = await handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers);
+                toolContent = await handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers, logStep);
             }
             else if (toolName === TOOL_NAME_GREP) {
-                toolContent = await handleGrepTool(argsRaw, refs.head, gitLabProjectApiUrl, headers, projectId);
+                toolContent = await handleGrepTool(argsRaw, refs, gitLabProjectApiUrl, headers, logStep);
             }
             else {
                 toolContent = JSON.stringify({
@@ -537,7 +551,7 @@ function draftHasStructuredFindings(consolidatedText) {
     return /-\s*\[(?:high|medium)\]/i.test(consolidatedText);
 }
 async function runVerificationWithTools(params) {
-    const { openaiInstance, aiModel, baseMessages, refs, gitLabProjectApiUrl, projectId, headers, forceTools, consolidatedDraft, loggers, debugDumpFile, debugRecordWriter, } = params;
+    const { openaiInstance, aiModel, baseMessages, refs, gitLabProjectApiUrl, headers, forceTools, consolidatedDraft, loggers, debugDumpFile, debugRecordWriter, } = params;
     const { logDebug, logStep } = loggers;
     const messages = [...baseMessages];
     const tools = [
@@ -627,10 +641,10 @@ async function runVerificationWithTools(params) {
             logToolUsageMinimal(logStep, toolName, argsRaw, "(verify)");
             let toolContent;
             if (toolName === TOOL_NAME_GET_FILE) {
-                toolContent = await handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers);
+                toolContent = await handleGetFileTool(argsRaw, gitLabProjectApiUrl, headers, logStep);
             }
             else if (toolName === TOOL_NAME_GREP) {
-                toolContent = await handleGrepTool(argsRaw, refs.head, gitLabProjectApiUrl, headers, projectId);
+                toolContent = await handleGrepTool(argsRaw, refs, gitLabProjectApiUrl, headers, logStep);
             }
             else {
                 toolContent = JSON.stringify({
@@ -672,7 +686,7 @@ async function runVerificationWithTools(params) {
     });
 }
 export async function reviewMergeRequestMultiPass(params) {
-    const { openaiInstance, aiModel, promptLimits, triageDiffChars, changes, refs, gitLabProjectApiUrl, projectId, headers, maxFindings, reviewConcurrency, forceTools, promptProfile = DEFAULT_PROMPT_PROFILE, allowProfileAutoDemote = false, loggers, debugDumpFile, debugRecordWriter, } = params;
+    const { openaiInstance, aiModel, promptLimits, triageDiffChars, changes, refs, gitLabProjectApiUrl, headers, maxFindings, reviewConcurrency, forceTools, promptProfile = DEFAULT_PROMPT_PROFILE, allowProfileAutoDemote = false, loggers, debugDumpFile, debugRecordWriter, } = params;
     const { logStep } = loggers;
     let effectiveProfile = promptProfile;
     logStep(`Pass 1/4: triaging ${changes.length} file(s) ` +
@@ -773,7 +787,6 @@ export async function reviewMergeRequestMultiPass(params) {
             changes,
             refs,
             gitLabProjectApiUrl,
-            projectId,
             headers,
             forceTools,
             promptProfile: effectiveProfile,
@@ -821,7 +834,6 @@ export async function reviewMergeRequestMultiPass(params) {
                 otherChangedFiles: otherFiles,
                 refs,
                 gitLabProjectApiUrl,
-                projectId,
                 headers,
                 forceTools,
                 promptProfile: effectiveProfile,
@@ -909,7 +921,6 @@ export async function reviewMergeRequestMultiPass(params) {
                 baseMessages: verificationMessages,
                 refs,
                 gitLabProjectApiUrl,
-                projectId,
                 headers,
                 forceTools,
                 consolidatedDraft: consolidatedText,

package/dist/cli/tooling.js

@@ -27,3 +27,9 @@ export function logToolUsageMinimal(logStep, toolName, argsRaw, contextFile) {
     const suffix = contextFile ? ` review_file=${contextFile}` : "";
     logStep(`[tools] ${toolName} args=${argsRaw.slice(0, 120)}${suffix}`);
 }
+/** Operator-facing line for a failed tool call: GitLab status and request URL when known. */
+export function logToolFailure(logStep, toolName, error) {
+    const status = error?.statusCode != null ? ` status=${error.statusCode}` : "";
+    const url = typeof error?.cause?.url === "string" ? ` url=${error.cause.url}` : "";
+    logStep(`[tools] ${toolName} failed: ${String(error?.message ?? error)}${status}${url}`);
+}

package/dist/cli.js

@@ -38,10 +38,10 @@ Env vars:
                               positive rules, and few-shot examples.
                               When unset, an unparseable triage response auto-retries
                               with "weak" and keeps it for the whole run.
-  PROJECT_ACCESS_TOKEN (optional)  GitLab Project/Personal Access Token for API calls (required for most private repos; should have api scope).
+  PROJECT_ACCESS_TOKEN (required)  GitLab project/personal access token with api scope (alias: GITLAB_TOKEN). CI_JOB_TOKEN can't post MR comments.
 
 CI-only env vars (provided by GitLab):
-  CI_API_V4_URL, CI_PROJECT_ID, CI_MERGE_REQUEST_IID, CI_JOB_TOKEN (only if PROJECT_ACCESS_TOKEN is not set)
+  CI_API_V4_URL, CI_PROJECT_ID, CI_MERGE_REQUEST_PROJECT_ID, CI_MERGE_REQUEST_IID
 `);
 }
 const DEBUG_MODE = hasDebugFlag(process.argv);
@@ -107,25 +107,24 @@ async function main() {
         "CI_PROJECT_ID",
         "CI_MERGE_REQUEST_IID",
     ];
+    // CI_JOB_TOKEN can't post MR notes or call the search API, so a real token is required.
     if (projectAccessToken == null)
-        gitlabRequired.push("CI_JOB_TOKEN");
+        gitlabRequired.push("PROJECT_ACCESS_TOKEN");
     const envs = requireEnvs(gitlabRequired);
     const openaiApiKey = envs["OPENAI_API_KEY"];
     const ciApiV4Url = envs["CI_API_V4_URL"];
-    const projectId = envs["CI_PROJECT_ID"];
+    // MR endpoints live in the MR's target project; in fork pipelines CI_PROJECT_ID is the fork.
+    const projectId = envOrUndefined("CI_MERGE_REQUEST_PROJECT_ID") ?? envs["CI_PROJECT_ID"];
     const mergeRequestIid = envs["CI_MERGE_REQUEST_IID"];
     const gitLabProjectApiUrl = new URL(`${ciApiV4Url}/projects/${projectId}`);
-    const headers = {};
-    if (projectAccessToken != null)
-        headers["PRIVATE-TOKEN"] = projectAccessToken;
-    else
-        headers["JOB-TOKEN"] = envs["CI_JOB_TOKEN"];
+    const headers = {
+        "PRIVATE-TOKEN": projectAccessToken,
+    };
     try {
         logStep("Fetching merge request changes");
         const mrChanges = await fetchMergeRequestChanges({
             gitLabProjectApiUrl: gitLabProjectApiUrl,
             headers,
-            projectId,
             mergeRequestIid,
         });
         if (mrChanges instanceof Error)
@@ -149,7 +148,6 @@ async function main() {
                 head: mrChanges.diff_refs?.head_sha ?? "HEAD",
             },
             gitLabProjectApiUrl: gitLabProjectApiUrl,
-            projectId,
             headers,
             maxFindings,
             reviewConcurrency,
@@ -164,7 +162,8 @@ async function main() {
             gitLabProjectApiUrl: gitLabProjectApiUrl,
             headers,
             mergeRequestIid,
-        }, { body: answer });
+            note: answer,
+        });
         if (noteRes instanceof Error)
             throw noteRes;
         process.stdout.write("Posted AI review comment to merge request.\n");

package/dist/gitlab/services.js

@@ -1,47 +1,5 @@
 /** @format */
-import OpenAI from "openai";
-import { AI_MODEL_TEMPERATURE } from "../prompt/index.js";
-import { GitLabError, OpenAIError, } from "./types.js";
-export const fetchPreEditFiles = async ({ gitLabProjectApiUrl, headers, changesOldPaths, ref }) => {
-    const oldFilesRequestUrls = changesOldPaths.map((filePath) => {
-        const url = new URL(`${gitLabProjectApiUrl}/repository/files/${encodeURIComponent(filePath)}/raw`);
-        url.searchParams.set("ref", ref);
-        return url;
-    });
-    let oldFiles;
-    try {
-        oldFiles = await Promise.allSettled(oldFilesRequestUrls.map(async (url) => {
-            const res = await fetch(url, { headers: { ...headers } });
-            if (!res.ok) {
-                const bodyText = await res.text().catch(() => "");
-                throw new Error(`Failed to fetch old file: ${url.toString()} (status ${res.status} ${res.statusText}, body: ${bodyText.slice(0, 500)})`);
-            }
-            return await res.text();
-        }));
-    }
-    catch (error) {
-        oldFiles = error;
-    }
-    if (oldFiles instanceof Error) {
-        return new GitLabError({
-            name: "MISSING_OLD_FILES",
-            message: "Failed to fetch old files",
-            cause: {
-                message: oldFiles.message,
-                stack: oldFiles.stack,
-            },
-        });
-    }
-    return oldFiles.reduce((acc, file, index) => {
-        if (file.status === "fulfilled") {
-            acc.push({
-                fileName: changesOldPaths[index],
-                fileContent: file.value,
-            });
-        }
-        return acc;
-    }, []);
-};
+import { GitLabError, } from "./types.js";
 export const fetchFileAtRef = async ({ gitLabProjectApiUrl, headers, filePath, ref }) => {
     const url = new URL(`${gitLabProjectApiUrl}/repository/files/${encodeURIComponent(filePath)}/raw`);
     url.searchParams.set("ref", ref);
@@ -81,29 +39,7 @@ export const fetchFileAtRef = async ({ gitLabProjectApiUrl, headers, filePath, r
     }
     return await res.text();
 };
-export async function generateAICompletion(messages, openaiInstance, aiModel) {
-    let completion;
-    try {
-        completion = await openaiInstance.chat.completions.create({
-            model: aiModel,
-            temperature: AI_MODEL_TEMPERATURE,
-            stream: false,
-            messages,
-        });
-    }
-    catch (error) {
-        completion = error;
-    }
-    if (completion instanceof Error) {
-        return new OpenAIError({
-            name: "MISSING_AI_COMPLETION",
-            message: "Failed to generate AI completion",
-            cause: completion,
-        });
-    }
-    return completion;
-}
-export const postMergeRequestNote = async ({ gitLabProjectApiUrl, headers, mergeRequestIid }, commentPayload) => {
+export const postMergeRequestNote = async ({ gitLabProjectApiUrl, headers, mergeRequestIid, note }) => {
     const commentUrl = new URL(`${gitLabProjectApiUrl}/merge_requests/${mergeRequestIid}/notes`);
     let aiComment;
     try {
@@ -113,7 +49,7 @@ export const postMergeRequestNote = async ({ gitLabProjectApiUrl, headers, merge
                 ...headers,
                 "Content-Type": "application/json",
             },
-            body: JSON.stringify(commentPayload),
+            body: JSON.stringify({ body: note }),
         });
     }
     catch (error) {
@@ -152,7 +88,8 @@ export const searchRepository = async ({ gitLabProjectApiUrl, headers, query, re
     url.searchParams.set("scope", "blobs");
     url.searchParams.set("search", query);
     url.searchParams.set("ref", ref);
-    url.searchParams.set("per_page", "10");
+    // Name matches come before content matches; the grep tool re-ranks and keeps 10.
+    url.searchParams.set("per_page", "50");
     let res;
     try {
         res = await fetch(url, { headers: { ...headers } });

package/dist/gitlab/types.js

@@ -1,5 +1,3 @@
 import { BaseError } from '../errors.js';
 export class GitLabError extends BaseError {
 }
-export class OpenAIError extends BaseError {
-}

package/dist/prompt/index.js

@@ -12,8 +12,6 @@ export const DEFAULT_PROMPT_LIMITS = {
 };
 /** Max chars of each file diff sent to the triage pass (Pass 1). */
 export const DEFAULT_TRIAGE_DIFF_CHARS = 2000;
-export const AI_MODEL_TEMPERATURE = 0.2;
-export const AI_MAX_OUTPUT_TOKENS = 600;
 export const buildPrompt = ({ changes, limits, allowTools = false, profile = DEFAULT_PROMPT_PROFILE, }) => {
     const effectiveLimits = {
         ...DEFAULT_PROMPT_LIMITS,

package/dist/prompt/messages.js

@@ -16,7 +16,3 @@ export const buildFileReviewSystemMessage = (profile = DEFAULT_PROMPT_PROFILE) =
     role: "system",
     content: getFileReviewSystemPrompt(profile),
 });
-/** @deprecated kept for backward compatibility — use buildTriageSystemMessage(). */
-export const TRIAGE_SYSTEM = buildTriageSystemMessage();
-/** @deprecated kept for backward compatibility — use buildFileReviewSystemMessage(). */
-export const FILE_REVIEW_SYSTEM = buildFileReviewSystemMessage();

package/dist/prompt/templates/review-system.js

@@ -106,7 +106,3 @@ export function getMainSystemPrompt(profile) {
 export function getFileReviewSystemPrompt(profile) {
     return profile === "weak" ? FILE_WEAK : FILE_DEFAULT;
 }
-/** @deprecated kept for backward compatibility — use getMainSystemPrompt("default"). */
-export const MAIN_SYSTEM_LINES = MAIN_DEFAULT.split("\n");
-/** @deprecated kept for backward compatibility — use getFileReviewSystemPrompt("default"). */
-export const FILE_REVIEW_SYSTEM_LINES = FILE_DEFAULT.split("\n");

package/dist/prompt/templates/triage-system.js

@@ -42,5 +42,3 @@ Example output (copy this exactly — one line, one JSON object, nothing else):
 export function getTriageSystemPrompt(profile) {
     return profile === "weak" ? WEAK : DEFAULT;
 }
-/** @deprecated kept for backward compatibility — use getTriageSystemPrompt("default"). */
-export const TRIAGE_SYSTEM_LINES = DEFAULT.split("\n");

package/package.json

@@ -1,7 +1,7 @@
 {
   "type": "module",
   "name": "@krotovm/gitlab-ai-review",
-  "version": "1.0.42",
+  "version": "1.0.43",
   "description": "CLI tool to generate AI code reviews for GitLab merge requests.",
   "main": "dist/cli.js",
   "bin": {