Merge branch 'main' into refactor/advisor-synthetic-context

Author: cv

.github/workflows/e2e-advisor.yaml

@@ -163,8 +163,6 @@ jobs:
           E2E_ADVISOR_RUN_ANALYSIS: ${{ github.event_name == 'workflow_dispatch' && inputs.run_analysis == false && '0' || '1' }}
           # Preferred E2E advisor secret.
           E2E_ADVISOR_API_KEY: ${{ secrets.PI_E2E_ADVISOR_API_KEY }}
-          # Optional local-provider-compatible fallback for future upstream/external-advisor use.
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
         run: |
           cd "$ADVISOR_WORKDIR"
           node --experimental-strip-types "$ADVISOR_DIR/tools/e2e-advisor/analyze.mts" \
@@ -183,8 +181,6 @@ jobs:
           # Reuse the shared E2E advisor secret. The scenario advisor is a
           # separate prompt/agent but uses the same model and credential.
           E2E_ADVISOR_API_KEY: ${{ secrets.PI_E2E_ADVISOR_API_KEY }}
-          # Optional local-provider-compatible fallback for future upstream/external-advisor use.
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
         run: |
           cd "$ADVISOR_WORKDIR"
           node --experimental-strip-types "$ADVISOR_DIR/tools/e2e-advisor/scenarios.mts" \

.github/workflows/pr-review-advisor.yaml

@@ -140,8 +140,7 @@ jobs:
           PR_NUMBER: ${{ github.event.pull_request.number || inputs.target_pr }}
           PR_REVIEW_ADVISOR_RUN_ANALYSIS: ${{ github.event_name == 'workflow_dispatch' && inputs.run_analysis == false && '0' || '1' }}
           GH_TOKEN: ${{ github.token }}
-          PR_REVIEW_ADVISOR_API_KEY: ${{ secrets.PR_REVIEW_ADVISOR_API_KEY || secrets.PI_PR_REVIEW_ADVISOR_API_KEY }}
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          PR_REVIEW_ADVISOR_API_KEY: ${{ secrets.PR_REVIEW_ADVISOR_API_KEY }}
         run: |
           cd "$ADVISOR_WORKDIR"
           if [ ! -f "$ADVISOR_DIR/tools/pr-review-advisor/analyze.mts" ]; then

test/pr-review-advisor.test.ts

@@ -6,6 +6,12 @@ import path from "node:path";
 import Ajv2020 from "ajv/dist/2020.js";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { githubGraphql } from "../tools/advisors/github.mts";
+import {
+  ADVISOR_OPENAI_COMPATIBLE_BASE_URL,
+  DEFAULT_ADVISOR_MODEL,
+  DEFAULT_ADVISOR_PROVIDER,
+  openAiAdvisorProviderConfig,
+} from "../tools/advisors/session.mts";
 import {
   buildPromptTurns,
   buildSystemPrompt,
@@ -126,6 +132,34 @@ describe("PR review advisor", () => {
   afterEach(() => {
     vi.restoreAllMocks();
   });
+
+  it("configures the advisor through the hosted OpenAI-compatible service", () => {
+    const config = openAiAdvisorProviderConfig("PR_REVIEW_ADVISOR_API_KEY") as {
+      apiKey: string;
+      baseUrl: string;
+      models: Array<{
+        id: string;
+        compat?: Record<string, unknown>;
+        reasoning: boolean;
+      }>;
+    };
+
+    expect(DEFAULT_ADVISOR_PROVIDER).toBe("openai");
+    expect(DEFAULT_ADVISOR_MODEL).toBe("openai/openai/gpt-5.5");
+    expect(config.apiKey).toBe("PR_REVIEW_ADVISOR_API_KEY");
+    expect(config.baseUrl).toBe(ADVISOR_OPENAI_COMPATIBLE_BASE_URL);
+    expect(config.models[0]?.id).toBe(DEFAULT_ADVISOR_MODEL);
+    expect(config.models[0]?.reasoning).toBe(false);
+    expect(config.models[0]?.compat).toMatchObject({
+      supportsDeveloperRole: false,
+      supportsReasoningEffort: false,
+      supportsStore: false,
+      supportsStrictMode: false,
+      supportsUsageInStreaming: false,
+      maxTokensField: "max_tokens",
+    });
+  });
+
   it("normalizes advisor output into the schema-owned metadata", () => {
     const result = normalizeReviewResult(validResult(), metadata());
 
@@ -632,6 +666,13 @@ jobs:
           ref: refs/pull/\${{ github.event.pull_request.head.sha }}/merge
           path: pr-workdir
           persist-credentials: false
+      - name: Run PR review advisor
+        env:
+          PR_REVIEW_ADVISOR_API_KEY: \${{ secrets.PR_REVIEW_ADVISOR_API_KEY || secrets.PI_PR_REVIEW_ADVISOR_API_KEY }}
+          OPENAI_API_KEY: \${{ secrets.OPENAI_API_KEY }}
+        run: |
+          cd "$ADVISOR_WORKDIR"
+          node "$ADVISOR_DIR/tools/pr-review-advisor/analyze.mts" --schema "$ADVISOR_DIR/tools/pr-review-advisor/schema.json"
 `,
     );
 
@@ -644,6 +685,8 @@ jobs:
           "workflow permissions.contents must be read",
           "review job must not be globally continue-on-error",
           "PR checkout must use the pull request head SHA as inert analysis data",
+          "Run PR review advisor must receive PR_REVIEW_ADVISOR_API_KEY only from secrets.PR_REVIEW_ADVISOR_API_KEY",
+          "Run PR review advisor must not receive OPENAI_API_KEY",
         ]),
       );
       expect(errors.some((error) => error.includes("full commit SHA"))).toBe(true);

tools/advisors/session.mts

@@ -16,6 +16,7 @@ import {
 
 export const DEFAULT_ADVISOR_PROVIDER = "openai";
 export const DEFAULT_ADVISOR_MODEL = "openai/openai/gpt-5.5";
+export const ADVISOR_OPENAI_COMPATIBLE_BASE_URL = "https://inference-api.nvidia.com/v1";
 export const READ_ONLY_TOOLS = ["read", "grep", "find", "ls"];
 
 const ZERO_COST = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
@@ -29,12 +30,14 @@ const ZERO_USAGE = {
 };
 
 type AdvisorProviderConfig = Parameters<ModelRegistry["registerProvider"]>[1];
+type AdvisorModelConfig = NonNullable<AdvisorProviderConfig["models"]>[number];
 
 export type RunAdvisorResult = {
   /** Assistant text from the final turn. For single-turn callers, this is the full response. */
   text: string;
   raw: string;
   turnTexts: string[];
+  turnErrors: string[];
 };
 
 export type AdvisorSyntheticToolContentType = "diff" | "json" | "text";
@@ -84,9 +87,16 @@ export type RunReadOnlyAdvisorOptions = {
 export function openAiAdvisorProviderConfig(credentialEnv: string): AdvisorProviderConfig {
   return {
     api: "openai-completions",
-    baseUrl: "https://integrate.api.nvidia.com/v1",
+    baseUrl: ADVISOR_OPENAI_COMPATIBLE_BASE_URL,
     models: [
-      advisorModel(DEFAULT_ADVISOR_MODEL, "GPT-5.5", 256000, 32768, true, ["text", "image"]),
+      advisorModel(DEFAULT_ADVISOR_MODEL, "GPT-5.5", 256000, 32768, false, ["text", "image"], {
+        supportsDeveloperRole: false,
+        supportsReasoningEffort: false,
+        supportsStore: false,
+        supportsStrictMode: false,
+        supportsUsageInStreaming: false,
+        maxTokensField: "max_tokens",
+      }),
     ],
     ["api" + "Key"]: credentialEnv,
   } as AdvisorProviderConfig;
@@ -99,8 +109,9 @@ export function advisorModel(
   maxTokens: number,
   reasoning: boolean,
   input: ("text" | "image")[],
-): NonNullable<AdvisorProviderConfig["models"]>[number] {
-  return { id, name, reasoning, input, cost: ZERO_COST, contextWindow, maxTokens };
+  compat?: AdvisorModelConfig["compat"],
+): AdvisorModelConfig {
+  return { id, name, reasoning, input, cost: ZERO_COST, contextWindow, maxTokens, compat };
 }
 
 export async function runReadOnlyAdvisor(
@@ -112,7 +123,9 @@ export async function runReadOnlyAdvisor(
   const { authStorage, modelRegistry } = prepareAdvisorConfig(provider, options.credentialEnv);
   const model = modelRegistry.find(provider, modelId);
   if (!model || !modelRegistry.hasConfiguredAuth(model)) {
-    throw new Error(`Could not configure advisor model ${modelId}`);
+    throw new Error(
+      `Could not configure advisor model ${provider}/${modelId}; set ${options.credentialEnv}`,
+    );
   }
 
   const settingsManager = SettingsManager.inMemory({
@@ -154,20 +167,44 @@ export async function runReadOnlyAdvisor(
   const rawHeader = [
     modelFallbackMessage ? `[${options.logPrefix}] ${modelFallbackMessage}` : undefined,
     `[${options.logPrefix}] model=${model.provider}/${model.id}`,
+    `[${options.logPrefix}] base_url=${model.baseUrl}`,
     `[${options.logPrefix}] tools=${READ_ONLY_TOOLS.join(",")}`,
     `[${options.logPrefix}] prompt_turns=${promptTurns.length}`,
     "--- ASSISTANT TEXT ---",
   ].filter((line): line is string => Boolean(line));
 
   const raw = new CappedBuffer(options.maxCaptureBytes, `${rawHeader.join("\n")}\n`);
   const turnTextBuffers: CappedBuffer[] = [];
+  const turnErrors: string[] = [];
   let currentTurnText: CappedBuffer | undefined;
   let currentTurnName = "";
+  let currentTurnError: string | undefined;
+
+  const captureTurnError = (source: string, message: string | undefined): void => {
+    const normalized = normalizeProviderError(message);
+    if (!normalized) return;
+    currentTurnError ||= normalized;
+    raw.append(`\n[${options.logPrefix}] ${source}: ${normalized}\n`);
+  };
 
   const unsubscribe = session.subscribe((event: AgentSessionEvent) => {
-    if (event.type === "message_update" && event.assistantMessageEvent.type === "text_delta") {
-      currentTurnText?.append(event.assistantMessageEvent.delta);
-      raw.append(event.assistantMessageEvent.delta);
+    if (event.type === "message_update") {
+      if (event.assistantMessageEvent.type === "text_delta") {
+        currentTurnText?.append(event.assistantMessageEvent.delta);
+        raw.append(event.assistantMessageEvent.delta);
+        return;
+      }
+      if (event.assistantMessageEvent.type === "error") {
+        captureTurnError(
+          "assistant_stream_error",
+          event.assistantMessageEvent.error.errorMessage || event.assistantMessageEvent.reason,
+        );
+        return;
+      }
+      return;
+    }
+    if (event.type === "message_end") {
+      captureTurnError("assistant_message_error", assistantMessageError(event.message));
       return;
     }
     if (event.type === "tool_execution_start") {
@@ -214,6 +251,7 @@ export async function runReadOnlyAdvisor(
     for (const [index, turn] of promptTurns.entries()) {
       currentTurnName = turn.name;
       currentTurnText = new CappedBuffer(options.maxCaptureBytes);
+      currentTurnError = undefined;
       turnTextBuffers.push(currentTurnText);
       const turnIndex = `${index + 1}/${promptTurns.length}`;
       injectSyntheticToolResults({
@@ -232,6 +270,9 @@ export async function runReadOnlyAdvisor(
       raw.append(
         `\n[${options.logPrefix}] user_turn_end ${turnIndex} ${turn.name} textBytes=${turnTextBytes}\n`,
       );
+      if (currentTurnError) {
+        turnErrors.push(`${turn.name}: ${currentTurnError}`);
+      }
       currentTurnText = undefined;
       currentTurnName = "";
     }
@@ -264,7 +305,28 @@ export async function runReadOnlyAdvisor(
   if (truncationNotes.length > 0) raw.appendFooter(`\n${truncationNotes.join("\n")}\n`);
 
   const turnTexts = turnTextBuffers.map((buffer) => buffer.toString());
-  return { text: turnTexts.at(-1) || "", raw: raw.toStringWithTrailingNewline(), turnTexts };
+  return {
+    text: turnTexts.at(-1) || "",
+    raw: raw.toStringWithTrailingNewline(),
+    turnTexts,
+    turnErrors,
+  };
+}
+
+function assistantMessageError(message: unknown): string | undefined {
+  if (!message || typeof message !== "object") return undefined;
+  const record = message as { role?: unknown; stopReason?: unknown; errorMessage?: unknown };
+  if (record.role !== "assistant") return undefined;
+  if (record.stopReason !== "error" && record.stopReason !== "aborted") return undefined;
+  return typeof record.errorMessage === "string" && record.errorMessage.trim()
+    ? record.errorMessage
+    : String(record.stopReason);
+}
+
+function normalizeProviderError(message: string | undefined): string | undefined {
+  if (!message) return undefined;
+  const normalized = message.trim().replace(/\s+/g, " ");
+  return normalized || undefined;
 }
 
 function normalizePromptTurns(promptTurns: AdvisorPromptTurn[]): AdvisorPromptTurn[] {
@@ -447,7 +509,7 @@ function prepareAdvisorConfig(
 ): { authStorage: AuthStorage; modelRegistry: ModelRegistry } {
   const authStorage = AuthStorage.inMemory();
   const modelRegistry = ModelRegistry.inMemory(authStorage);
-  const credential = process.env[credentialEnv] || process.env.OPENAI_API_KEY;
+  const credential = process.env[credentialEnv]?.trim();
   if (credential) {
     authStorage.setRuntimeApiKey(provider, credential);
     modelRegistry.registerProvider(provider, openAiAdvisorProviderConfig(credentialEnv));

tools/e2e-advisor/README.md

@@ -44,7 +44,8 @@ Configure this repository secret for E2E recommendations:
 
 - `PI_E2E_ADVISOR_API_KEY`
 
-The analyzer uses the fixed `openai/openai/gpt-5.5` advisor model and also accepts `OPENAI_API_KEY` for local runs.
+The analyzer uses the fixed `openai/openai/gpt-5.5` advisor model through the
+OpenAI-compatible `https://inference-api.nvidia.com/v1` service.
 
 If advisor credentials are unavailable, the advisor writes a low-confidence unavailable result instead of
 making deterministic recommendations.
@@ -78,7 +79,8 @@ node --experimental-strip-types tools/e2e-advisor/analyze.mts \
   --out-dir artifacts/e2e-advisor
 ```
 
-Set `E2E_ADVISOR_API_KEY` or `OPENAI_API_KEY` locally, or configure the repository `PI_E2E_ADVISOR_API_KEY` secret. Run `npm install` first so the Pi SDK dependency is available.
+Set `E2E_ADVISOR_API_KEY` locally, or configure the repository `PI_E2E_ADVISOR_API_KEY`
+secret. Run `npm install` first so the Pi SDK dependency is available.
 
 ## Output contract
 

tools/e2e-advisor/analyze.mts

@@ -162,6 +162,10 @@ async function main(): Promise<void> {
         "utf8",
       )}`,
     );
+    if (sdkResult.turnErrors.length > 0) {
+      writeFailure(`Advisor SDK provider error: ${sdkResult.turnErrors.join("; ")}`);
+      process.exit(1);
+    }
   } catch (error: unknown) {
     const reason = error instanceof Error ? error.message : String(error);
     fs.writeFileSync(artifacts.raw, `Advisor SDK execution failed: ${reason}\n`);

tools/e2e-advisor/scenarios.mts

@@ -201,6 +201,10 @@ async function main(): Promise<void> {
         "utf8",
       )}`,
     );
+    if (sdkResult.turnErrors.length > 0) {
+      writeFailure(`Scenario advisor SDK provider error: ${sdkResult.turnErrors.join("; ")}`);
+      process.exit(1);
+    }
   } catch (error: unknown) {
     const reason = error instanceof Error ? error.message : String(error);
     fs.writeFileSync(artifacts.raw, `Scenario advisor SDK execution failed: ${reason}\n`);

tools/pr-review-advisor/README.md

@@ -52,9 +52,8 @@ Configure this repository secret for review analysis:
 
 - `PR_REVIEW_ADVISOR_API_KEY`
 
-The workflow also accepts the legacy `PI_PR_REVIEW_ADVISOR_API_KEY` secret as a
-fallback. The analyzer uses the fixed `openai/openai/gpt-5.5` advisor model and
-also accepts `OPENAI_API_KEY` for local runs.
+The analyzer uses the fixed `openai/openai/gpt-5.5` advisor model through the
+OpenAI-compatible `https://inference-api.nvidia.com/v1` service.
 
 If advisor credentials are unavailable, the advisor writes a low-confidence unavailable result
 instead of failing closed without artifacts.
@@ -94,7 +93,7 @@ node --experimental-strip-types tools/pr-review-advisor/analyze.mts \
   --out-dir artifacts/pr-review-advisor
 ```
 
-Set `PR_REVIEW_ADVISOR_API_KEY` or `OPENAI_API_KEY` locally, or configure the repository
+Set `PR_REVIEW_ADVISOR_API_KEY` locally, or configure the repository
 `PR_REVIEW_ADVISOR_API_KEY` secret. Run `npm install` first so the Pi SDK dependency is
 available.
 

tools/pr-review-advisor/analyze.mts

@@ -324,6 +324,10 @@ async function main(): Promise<void> {
     });
     fs.writeFileSync(artifacts.raw, sdkResult.raw);
     logProgress(`PR review advisor conversation finished: turns=${sdkResult.turnTexts.length}`);
+    if (sdkResult.turnErrors.length > 0) {
+      writeFailure(`PR review advisor SDK provider error: ${sdkResult.turnErrors.join("; ")}`);
+      process.exit(1);
+    }
   } catch (error: unknown) {
     const reason = error instanceof Error ? error.message : String(error);
     fs.writeFileSync(artifacts.raw, `PR review advisor SDK execution failed: ${reason}\n`);

tools/pr-review-advisor/workflow-boundary.mts

@@ -141,6 +141,20 @@ export function validatePrReviewAdvisorWorkflowBoundary(
   requireRunContains(errors, analyze, 'cd "$ADVISOR_WORKDIR"');
   requireRunContains(errors, analyze, "$ADVISOR_DIR/tools/pr-review-advisor/analyze.mts");
   requireRunContains(errors, analyze, "$ADVISOR_DIR/tools/pr-review-advisor/schema.json");
+  if (analyze) {
+    const analyzeEnv = asRecord(analyze.env);
+    if (
+      stringValue(analyzeEnv.PR_REVIEW_ADVISOR_API_KEY).trim() !==
+      "${{ secrets.PR_REVIEW_ADVISOR_API_KEY }}"
+    ) {
+      errors.push(
+        "Run PR review advisor must receive PR_REVIEW_ADVISOR_API_KEY only from secrets.PR_REVIEW_ADVISOR_API_KEY",
+      );
+    }
+    if (Object.hasOwn(analyzeEnv, "OPENAI_API_KEY")) {
+      errors.push("Run PR review advisor must not receive OPENAI_API_KEY");
+    }
+  }
 
   const comment = requireStep(errors, steps, "Post PR review advisor comment");
   requireRunContains(errors, comment, "$ADVISOR_DIR/tools/pr-review-advisor/comment.mts");