miucr

miucr: owned AI code-review CLI (v0.65.0)

miucr (the miu-cr project) is a fast, pure-Go (CGO_ENABLED=0) AI code reviewer. It keeps the correctness-critical parts deterministic (file selection, context assembly, line-anchoring, severity gating, dedupe) and uses the LLM only for judgment (finding bugs, proposing fixes). It runs five review ways:

• Local review: miucr review over a staged diff, a commit, or a ref range.
• GitHub PR review: miucr review --pr (dry-run by default; --post reacts 👀, upserts ONE summary issue comment, and posts inline comments as a PR review).
• serve daemon: HMAC webhook (default) and/or opt-in poll trigger; optional REST API + GitHub App auth.
• MCP server: miucr mcp exposes review_run / review_get over stdio to any agent host.
• Evaluation: miucr eval compares miu-cr and other reviewer commands against JSON expected findings.

Review behavior worth knowing (design choices that prevent noise):

• One upserted summary, posted first. --post writes ONE summary issue comment, edited in place on re-runs (never stacked), and acknowledges the PR with 👀. If no summary exists yet, it also creates a short Review running placeholder before the LLM starts; on later commits it keeps the prior completed summary visible until the new result is ready. The final summary replaces that same comment and is posted BEFORE the inline review so it anchors on top (overview → details). Inline findings are a separate PR review. review_id is NOT shown in the comment (it only resolves on the local store; it stays in the JSON envelope). On a fatal review failure after miucr's internal retries, --post upserts that SAME summary comment with a visible GitHub alert instead of failing silently: operational/provider/infrastructure failures (agent.unavailable, provider.rate_limited, quota.exceeded, review.timeout, github.unavailable, etc.) render as [!WARNING], while unknown internal.error failures render as [!CAUTION]; a later successful run replaces it with findings.
• The summary is a per-finding lifecycle ledger, not just the latest run. Below a concise ≤5-bullet "What changed" summary, it renders two always-visible tracking tables - ⚠️ Open (N) and ✅ Resolved (N) - each finding tracked by its line-independent fingerprint across commits: a Priority column (P0-P4), status (open / resolved / reopened), the origin commit it was first raised on and the resolved commit it disappeared on (both linked), priority before→after for escalations, and first-seen / resolved timestamps. A clean review uses natural all-clear prose like Review passed! No findings on the first review pass. or Review passed! 3 findings resolved. Good cleanup. The deterministic note gets stronger as more findings are cleared and adapts to focused vs broad diffs. The footer is Last reviewed commit + review attempts + the miu-cr release. Lifecycle state is storeless: it lives in a hidden <!-- miu-cr-ledger:<base64> --> marker inside the comment (like the runs counter), so it survives ephemeral CI with no DB. A finding resolves only when it is absent AND its file is still in the diff (absence off-diff ≠ fix).
• Inline comments persist; resolving the threads is left to you / your coding agent. Each finding's inline comment is posted ONCE and deduped across re-runs via a hidden <!-- miucr:fp=… --> marker, so a re-review never re-posts or deletes it. miucr does NOT click "Resolve conversation": when a finding is fixed, GitHub auto-marks the thread Outdated and the summary ledger moves it to ✅ Resolved, but the inline thread itself stays open for the developer/coding agent to resolve. A host config may opt into thread_resolution_sync.mode: poll to mirror manual GitHub "Resolve conversation" state into the summary (the Resolved row shows a clean 💬 conversation marker linked to the discussion thread, distinct from a commit-resolved row's open → resolved SHA arrow); this never starts an LLM review and never feeds approval. So an agent acting on a review should read the inline threads, apply the fixes, reply on each handled inline thread with what changed and why, then resolve the thread.
• Repeat-run stability is deterministic inputs + low-variance generation. For the same repo/ref/config, file selection, context assembly, rules, anchoring, gating, fingerprints, and comment dedupe are deterministic. SDK-backed Anthropic/OpenAI calls use temperature: 0; exact model output can still vary, so PR posting is idempotent rather than duplicate-prone.
• One-click suggestions and approvals are explicit write actions. --suggest emits a native GitHub ```suggestion block ONLY for findings at or above the suggestion floor (medium) when the patch deterministically replaces the exact anchored line(s) and the model is certain of a grounded mechanical fix (a cited rule or an obvious best practice). It NEVER guesses an unverifiable value (a URL, path, route, ID, version, config key, API signature); such concerns become a verification-question in the rationale instead. --patch-repair (requires --suggest) runs one focused 2nd LLM pass to recover a repairable near-miss patch. --approval clean|threshold submits APPROVE only when the policy and safety gates pass; the first approval body is short (LGTM) and links to the code review summary unless --approval-note none is set. Approval is head-SHA scoped: a later clean push can be approved again bodyless, threshold re-approvals carry the threshold note, and the same commit is not approved twice. Permission/self-approval failures warn and degrade rather than failing the review.
• -o pretty is the human-readable local format; -o json is for agents; -o sarif for editors/CI.
• Multi-provider profiles. Add a named provider (e.g. z.ai/glm) with kind, base_url, model, auth, and either auth_env or auth_command; select with --provider <name>. Built-in kinds: anthropic, openai (ChatGPT-plan OAuth via miucr login). Transient GitHub/network errors auto-retry with backoff. Optionally cap a provider instance's usage with [providers.<name>.quota] (dimension = tokens|requests, limit, window = <Go duration like 5h/24h>|monthly); uncapped by default, fail-closed, over-quota → typed quota.exceeded.
• Thinking on by default; deterministic fallback. Capable models (Claude, gpt-5/o-series, codex, z.ai GLM 4.5+) review with extended thinking/reasoning (deeper analysis; temperature is omitted because thinking forces temp 1). Models without thinking (gpt-4o, plain glm-4 chat) sample at temperature 0 for stable, reproducible findings. Both are config-exposed: [review].thinking (auto|off|low|medium|high, default auto) and [review].temperature (0-2, default 0). Set MIUCR_TRACE_REASONING=true to capture that reasoning into the review trace (miucr trace <id>).