v0.7.7

Full Changelog: v0.7.6...v0.7.7

v0.7.6

Full Changelog: v0.7.3...v0.7.6

Hodor v0.7.3

Hodor 0.7.3 fixes GitLab reviews after rebases and adds support for regional OpenAI models on Amazon Bedrock.

• Recalculate the current GitLab merge-request base after force-pushed rebases.
• Review the current MR diff instead of unrelated target-branch commits after history rewrites.
• Resolve regional Bedrock inference-profile IDs through their base model capabilities.
• Pass OpenAI reasoning effort through Bedrock additional model request fields.

Full changelog: v0.7.2...v0.7.3

Hodor v0.7.0

Hodor v0.7.0

Hodor 0.7.0 adds reusable review profiles, moves the shared Bedrock runtime to Claude Opus 5, and makes repeat reviews faster and more reliable.

Review profiles

Hodor can now run specialized security, code-quality, migration, or domain-focused reviews without replacing its review harness.

• --review-instructions <path> selects a profile that replaces the bundled review profile.
• --additional-instructions <text> adds a narrow request after the selected profile.
• The bundled default profile remains the default when no profile is supplied.
• Hodor still owns diff scope, read-only behavior, priorities, tool discipline, and structured output.
• Profile files are validated as non-empty UTF-8 regular files and are included in review-cache identity.

hodor <PR_OR_MR_URL> \
  --review-instructions review-profiles/security.md \
  --additional-instructions "Check the migration rollback path."

See the review-profile guide for complete security and code-quality examples, CI setup, repository skills, migration guidance, and troubleshooting.

Claude Opus 5 on Bedrock

• Upgraded the Pi runtime to 0.82.1.
• Added registered support for global.anthropic.claude-opus-5 on Amazon Bedrock.
• Routine and incremental reviews use high reasoning by default.
• Risky, large, and full reviews automatically use xhigh reasoning.
• The Opus 5 model entry supports a 1,000,000-token context window and up to 128,000 output tokens.

Faster repeat reviews

• Successful reviews can reuse the exact reviewed commit without another model request.
• Incremental reviews compare the latest reviewed snapshot directly with the current head.
• Small and medium diffs are embedded in the first prompt, reducing setup turns and repeated Git commands.
• --full forces a from-scratch source-versus-target review.
• --target-branch selects the base branch for full reviews.

More reliable review delivery

• Finding locations can be corrected from the model's exact existing_code snippet before comments are posted.
• Snippet matching is bounded to the checked-out workspace and uses surrounding context to resolve duplicate code.
• GitLab review history is preserved across pagination and repeat reviews.
• Structured review recovery handles models that return valid review JSON without calling submit_review.
• Review profiles, additional instructions, and Hodor's protocol are composed at the system-prompt level while the PR task remains the first user message.

Release safety

• npm and Docker releases now run a private-content disclosure gate before publication.
• GitHub secret scanning and push protection are enabled for the repository.
• npm releases use trusted publishing with provenance.

Migration from legacy prompt flags

The old custom-prompt flags have been removed:

Previous	Replacement
--prompt "Check authorization"	--additional-instructions "Check authorization"
--prompt-file review.md	--review-instructions review.md

A previous prompt file that contains a complete review task, tool directions, placeholders, or output schema should be rewritten as a profile. Keep only the review mission, investigation areas, and finding standard.

Install

npx @mrkaran/hodor@0.7.0 <PR_OR_MR_URL>

docker pull ghcr.io/mr-karan/hodor:0.7.0

Full changelog: v0.6.1...v0.7.0

v0.6.1

What's New

Gitea and Forgejo PR Reviews

Hodor now supports Gitea and Forgejo pull request URLs:

npx @mrkaran/hodor https://git.example.com/owner/repo/pulls/123

• Fetches PR metadata from Gitea/Forgejo APIs
• Checks out source branches, including fork PRs when source clone URLs are available
• Supports posting review comments with GITEA_TOKEN or FORGEJO_TOKEN

Thanks @abhinavxd for the Gitea support work.

Advanced GitLab MR Reviews

GitLab review posting is much more complete now:

• Inline diff comments for findings
• Draft note batching to avoid notification spam
• Suggestion blocks for apply-in-GitLab fixes
• --review-style summary|inline|hybrid
• --commit-status for pass/fail status checks
• --code-quality for GitLab Code Quality artifacts
• Cleanup of stale Hodor summary and inline comments on reruns

Closes #7.

More Model Providers

Hodor now uses the pi-ai provider registry and accepts provider/model-id strings across more providers:

npx @mrkaran/hodor <PR_URL> --model openai/gpt-5
npx @mrkaran/hodor <PR_URL> --model openrouter/moonshotai/kimi-k2.6
npx @mrkaran/hodor <PR_URL> --model bedrock/converse/anthropic.claude-sonnet-4-5-v2

OpenRouter slugs are handled more flexibly so newer models can be used before they land in the registry.

Closes #15.

Review Reliability

Several failure modes in the review loop were fixed:

• Recover structured reviews when the model returns JSON text instead of calling submit_review
• Validate recovered review schemas before accepting them
• Tighten diff-focused analysis so reviews stay scoped to PR changes
• Improve path handling for local and custom workspaces

CI Workspace Fix

Hodor now validates CI workspaces before using them. In GitHub Actions container jobs, if GITHUB_WORKSPACE is empty or not a git checkout, Hodor falls back to cloning instead of failing with:

fatal: not a git repository

Closes #19.

Metrics and Dashboard

• Added --prometheus-push support for review metrics
• Added token, cost, duration, tool-call, verdict, and finding-count metrics
• Added a generic Grafana dashboard in docs/grafana/

Documentation

• Reworked CI setup docs for GitHub Actions and GitLab CI
• Added model/provider docs
• Added OpenRouter docs
• Added skills documentation for .agents/skills
• Cleaned up generated-looking docs and restored the useful parts

Fixes

• Set Content-Type for GitLab API POST/PUT calls. Closes #20.
• Fixed GitHub Actions invocation in the README. Closes #18.
• Hardened Gitea PR checkout for source branches and forks.
• Improved GitLab cleanup behavior for custom workspaces. Closes #16.

Release

Published packages:

• npm: @mrkaran/hodor@0.6.1
• GitHub release: v0.6.1

Full diff: v0.5.0...v0.6.1

v0.5.0

What's New

Local Mode

Review local git diffs without a PR URL — works with any git repo (Bitbucket, local branches, pre-push review):

npx @mrkaran/hodor --local                         # diff against origin/main
npx @mrkaran/hodor --local --diff-against HEAD~1   # diff against specific ref

• Includes uncommitted (staged + unstaged) changes
• Resolves to git repo root when invoked from subdirectories
• --post is validated upfront (disabled in local mode)

Closes #8.

npm Package

Published as @mrkaran/hodor on npm:

npx @mrkaran/hodor <PR_URL>

Other

• Use in-memory auth storage to avoid loading ~/.pi/auth.json (closes #10, thanks @vedang)
• Simplified README — npx-first install, documented all new flags

v0.4.1

Bug Fixes

• Fix glab --paginate JSON parsing: Replaced naive regex (][ → ,) with a JSON-aware parser that tracks bracket depth and string state. The regex could corrupt note bodies containing ][ and broke on empty pages.

Tests

• 17 new tests for parseGlabPaginatedJson (single/multi page, empty pages, string values containing ][, escaped quotes, nested arrays)
• Tests for summarizeGitlabNotes (system note filtering, trivial comments, maxEntries)
• Fixed pre-existing metrics test assertion for corrected totalInput = fresh + cached display

v0.4.0

What's Changed

Token Optimization (biggest impact)

• Pre-embed diff: For PRs ≤200KB, the full diff is embedded directly in the prompt, eliminating per-file git diff tool calls. Tested on a 300-line PR: 61→20 turns, 2.28M→1.17M tokens.
• Incremental reviews: Posts a <!-- hodor:sha:HEAD --> marker in review comments. On re-runs, only diffs changes since the last review (three-dot syntax, excludes upstream changes). Handles force-push gracefully.
• Enable compaction: SDK auto-summarizes older turns when context grows too large (safety net for large PRs).

SDK Upgrade

• Upgraded @mariozechner/pi-ai and pi-coding-agent from 0.55.1 → 0.62.0
• 1M context window for Claude Opus 4.6/Sonnet 4.6 (was 200K)
• Better auto-compaction resilience
• Faster startup via lazy-loaded provider SDKs
• Added promptSnippet to submit_review tool (required since SDK v0.60.0)

New Features

• --bedrock-tags '{"team":"platform"}' — AWS Bedrock cost allocation tagging (appears in Cost Explorer)
• --prometheus-push <url> — Push review metrics (tokens, cost, turns, duration) to Prometheus Pushgateway. Best-effort, never fails the CI run.

Bug Fixes

• Fixed metrics display: inputTokens from the SDK is fresh-only, not total. Now correctly computes totalInput = fresh + cached for accurate percentages.