@in-the-loop-labs/pair-review 3.3.7 → 3.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@in-the-loop-labs/pair-review",
-  "version": "3.3.7",
+  "version": "3.4.1",
   "description": "Your AI-powered code review partner - Close the feedback loop with AI coding agents",
   "main": "src/server.js",
   "bin": {
@@ -68,6 +68,7 @@
     "glob": "^13.0.6",
     "markdown-it": "^13.0.2",
     "open": "^9.1.0",
+    "semver": "^7.7.4",
     "simple-git": "^3.19.1",
     "update-notifier": "^5.1.0",
     "uuid": "^11.1.0",

package/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pair-review",
-  "version": "3.3.7",
+  "version": "3.4.1",
   "description": "pair-review app integration — Open PRs and local changes in the pair-review web UI, run server-side AI analysis, and address review feedback. Requires the pair-review MCP server.",
   "author": {
     "name": "in-the-loop-labs",

package/plugin-code-critic/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "code-critic",
-  "version": "3.3.7",
+  "version": "3.4.1",
   "description": "AI-powered code review analysis — Run three-level AI analysis and implement-review-fix loops directly in your coding agent. Works standalone, no server required.",
   "author": {
     "name": "in-the-loop-labs",

package/public/css/styles.css

@@ -31,7 +31,13 @@
     --color-warning-bg: #fffae6;
     --color-warning-border: #ffc552;
     --color-warning-text: #7d4e00;
-    
+
+    --color-info-bg: #eff6ff;
+    --color-info-border: #bfdbfe;
+    --color-info-accent: #3b82f6;
+    --color-info-text: #1e3a8a;
+    --color-info-text-muted: #3b5998;
+
     --color-selection: #fff5b1;
     --color-selection-num: #ffeb3b;
     
@@ -72,7 +78,13 @@
     --color-warning-bg: #3d2e00;
     --color-warning-border: #9e6a03;
     --color-warning-text: #e3b341;
-    
+
+    --color-info-bg: #152033;
+    --color-info-border: #2d4a7a;
+    --color-info-accent: #4a90e2;
+    --color-info-text: #cfe0f5;
+    --color-info-text-muted: #8aa9cf;
+
     --color-selection: #3d3300;
     --color-selection-num: #4d4000;
     

package/public/index.html

@@ -1488,6 +1488,7 @@
 
     <script src="/js/ws-client.js"></script>
     <script src="/js/components/Toast.js"></script>
+    <script src="/js/components/UpdateBanner.js"></script>
     <script src="/js/index.js"></script>
 </body>
 </html>

package/public/js/components/UpdateBanner.js

@@ -0,0 +1,143 @@
+// Copyright 2026 Tim Perkins (tjwp) | SPDX-License-Identifier: Apache-2.0
+/**
+ * UpdateBanner Component
+ * Shows a persistent, dismissible corner-card notification when a newer
+ * version of pair-review is available. Single delivery path: on construction,
+ * fetch /api/config and show the banner if a pending_update exists.
+ */
+
+const DISMISS_KEY = 'update-banner-dismissed';
+
+class UpdateBanner {
+  constructor() {
+    this._banner = null;
+    this._dismissBtn = null;
+    this._version = null;
+
+    // Single path: fetch current config at construction; show banner if a
+    // pending update exists. No event listener, no WebSocket coupling.
+    // `fetch()` returns a Promise; `.then()` chains async steps; the final
+    // `.catch()` swallows network errors because the banner is non-critical.
+    fetch('/api/config')
+      .then(r => (r.ok ? r.json() : null))
+      .then(config => {
+        if (config && config.pending_update) this.show(config.pending_update);
+      })
+      .catch(() => { /* non-critical */ });
+  }
+
+  /**
+   * Show the update banner for the given version.
+   * No-op if already showing or dismissed for this version.
+   * @param {string} version
+   */
+  show(version) {
+    if (!version) return;
+
+    // Already dismissed for this version in this session
+    if (sessionStorage.getItem(DISMISS_KEY) === version) return;
+
+    // Already showing this version
+    if (this._banner && this._version === version) return;
+
+    // Remove any existing banner (e.g., for an older version)
+    this._remove();
+
+    this._version = version;
+
+    // Theme-aware colors come from CSS custom properties (set in styles.css
+    // under :root and [data-theme="dark"]). The inline `var(..., fallback)`
+    // form keeps the banner readable even if the stylesheet hasn't loaded
+    // yet. No MutationObserver needed — CSS handles the theme switch.
+    const banner = document.createElement('div');
+    banner.setAttribute('data-update-banner', '');
+    Object.assign(banner.style, {
+      position: 'fixed',
+      top: '16px',
+      left: '16px',
+      zIndex: '1000',
+      maxWidth: '360px',
+      background: 'var(--color-info-bg, #eff6ff)',
+      border: '1px solid var(--color-info-border, #bfdbfe)',
+      borderLeft: '4px solid var(--color-info-accent, #3b82f6)',
+      borderRadius: '8px',
+      boxShadow: '0 4px 12px rgba(0, 0, 0, 0.15)',
+      padding: '12px 14px',
+      fontSize: '13px',
+      lineHeight: '1.4',
+      color: 'var(--color-info-text, #1e3a8a)',
+      display: 'flex',
+      alignItems: 'flex-start',
+      gap: '10px'
+    });
+
+    // Two-line layout: headline + restart instruction on its own line.
+    const text = document.createElement('div');
+    text.style.flex = '1';
+
+    const headline = document.createElement('div');
+    headline.textContent = `pair-review v${version} is available.`;
+
+    const instruction = document.createElement('div');
+    instruction.textContent = 'Restart the server to update.';
+    instruction.style.marginTop = '2px';
+
+    text.appendChild(headline);
+    text.appendChild(instruction);
+
+    const dismissBtn = document.createElement('button');
+    dismissBtn.textContent = '\u00d7';
+    dismissBtn.setAttribute('aria-label', 'Dismiss');
+    Object.assign(dismissBtn.style, {
+      background: 'none',
+      border: 'none',
+      color: 'var(--color-info-text-muted, #3b5998)',
+      cursor: 'pointer',
+      fontSize: '18px',
+      padding: '0',
+      lineHeight: '1',
+      flexShrink: '0',
+      opacity: '0.8'
+    });
+    dismissBtn.addEventListener('click', () => this.dismiss());
+
+    banner.appendChild(text);
+    banner.appendChild(dismissBtn);
+    document.body.appendChild(banner);
+    this._banner = banner;
+    this._dismissBtn = dismissBtn;
+  }
+
+  /** Dismiss the banner and remember the choice for this session. */
+  dismiss() {
+    if (this._version) {
+      sessionStorage.setItem(DISMISS_KEY, this._version);
+    }
+    this._remove();
+  }
+
+  /** @private */
+  _remove() {
+    if (this._banner && this._banner.parentNode) {
+      this._banner.parentNode.removeChild(this._banner);
+    }
+    this._banner = null;
+    this._dismissBtn = null;
+  }
+}
+
+// Singleton init (browser only)
+if (typeof window !== 'undefined' && !window.updateBanner) {
+  if (document.readyState === 'loading') {
+    document.addEventListener('DOMContentLoaded', () => {
+      window.updateBanner = new UpdateBanner();
+    });
+  } else {
+    window.updateBanner = new UpdateBanner();
+  }
+}
+
+// CommonJS export for unit tests
+if (typeof module !== 'undefined' && module.exports) {
+  module.exports = { UpdateBanner };
+}

package/public/js/index.js

@@ -133,6 +133,20 @@
     return div.innerHTML;
   }
 
+  const LOCAL_REVIEW_PATH_URL_ERROR = 'Local reviews require a filesystem path, not a URL. Pass GitHub or Graphite URLs as PR review inputs instead.';
+
+  function isUrlLikeLocalReviewPath(value) {
+    if (!value || typeof value !== 'string') return false;
+    const trimmed = value.trim();
+    if (!trimmed) return false;
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed)) return true;
+    if (/^(?:github\.com|app\.graphite\.(?:dev|com))\//i.test(trimmed)) return true;
+    // Keep this aligned with src/utils/local-path-input.js: only a leading
+    // user@host:path token is treated as an SSH-style remote.
+    if (/^[^@/\\\s]+@[^:/\\\s]+:[^\s]+$/.test(trimmed)) return true;
+    return false;
+  }
+
   /**
    * Set loading state for a tab's form
    * @param {string} tab - 'pr' or 'local'
@@ -710,6 +724,12 @@
       return;
     }
 
+    if (isUrlLikeLocalReviewPath(pathValue)) {
+      showError('local', LOCAL_REVIEW_PATH_URL_ERROR);
+      input.focus();
+      return;
+    }
+
     // Navigate to the setup page which shows step-by-step progress
     // The /local?path= route serves setup.html which handles the full setup flow
     let href = '/local?path=' + encodeURIComponent(pathValue);
@@ -717,6 +737,21 @@
     window.location.href = href;
   }
 
+  function handleLocalPathInput(event) {
+    const input = event && event.target ? event.target : document.getElementById('local-path-input');
+    const errorEl = document.getElementById('start-review-error-local');
+    if (!input || !errorEl) return;
+
+    if (isUrlLikeLocalReviewPath(input.value)) {
+      showError('local', LOCAL_REVIEW_PATH_URL_ERROR);
+      return;
+    }
+
+    if (errorEl.textContent === LOCAL_REVIEW_PATH_URL_ERROR) {
+      errorEl.classList.remove('visible', 'info');
+    }
+  }
+
   // ─── Browse Directory ──────────────────────────────────────────────────────
 
   /**
@@ -746,6 +781,9 @@
 
       if (!data.cancelled && data.path) {
         input.value = data.path;
+        // Setting .value in JavaScript does not fire an input event, so run the
+        // same handler used for typing to clear any stale URL-specific error.
+        handleLocalPathInput({ target: input });
         input.focus();
       }
 
@@ -1873,6 +1911,11 @@
       localForm.addEventListener('submit', handleStartLocal);
     }
 
+    const localPathInput = document.getElementById('local-path-input');
+    if (localPathInput) {
+      localPathInput.addEventListener('input', handleLocalPathInput);
+    }
+
     // Set up browse button handler
     const browseBtn = document.getElementById('browse-local-btn');
     if (browseBtn) {

package/public/js/modules/diff-renderer.js

@@ -64,6 +64,9 @@ class DiffRenderer {
     // Ruby
     'rb': 'ruby',
     'erb': 'erb',
+    // Elixir
+    'ex': 'elixir',
+    'exs': 'elixir',
     // PHP
     'php': 'php',
     // Java/Kotlin/Scala

package/public/local.html

@@ -562,6 +562,7 @@
 
     <!-- Highlight.js for syntax highlighting -->
     <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/languages/elixir.min.js"></script>
 
     <!-- Markdown-it Library for rendering markdown in comments -->
     <script src="https://cdn.jsdelivr.net/npm/markdown-it@13.0.2/dist/markdown-it.min.js"></script>
@@ -591,6 +592,7 @@
     <!-- Components -->
     <script src="/js/components/TabTitle.js"></script>
     <script src="/js/components/Toast.js"></script>
+    <script src="/js/components/UpdateBanner.js"></script>
     <script src="/js/components/ConfirmDialog.js"></script>
     <script src="/js/components/TextInputDialog.js"></script>
     <script src="/js/components/AnalysisConfigModal.js"></script>

package/public/pr.html

@@ -358,6 +358,7 @@
 
     <!-- Highlight.js for syntax highlighting -->
     <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/languages/elixir.min.js"></script>
 
     <!-- Markdown-it Library for rendering markdown in comments -->
     <script src="https://cdn.jsdelivr.net/npm/markdown-it@13.0.2/dist/markdown-it.min.js"></script>
@@ -387,6 +388,7 @@
     <!-- Components -->
     <script src="/js/components/TabTitle.js"></script>
     <script src="/js/components/Toast.js"></script>
+    <script src="/js/components/UpdateBanner.js"></script>
     <script src="/js/components/ConfirmDialog.js"></script>
     <script src="/js/components/TextInputDialog.js"></script>
     <script src="/js/components/AnalysisConfigModal.js"></script>

package/public/setup.html

@@ -528,6 +528,7 @@
 
     <!-- WebSocket client -->
     <script src="/js/ws-client.js"></script>
+    <script src="/js/components/UpdateBanner.js"></script>
     <script src="/js/utils/notification-sounds.js"></script>
 
     <script>

package/src/config.js

@@ -19,6 +19,7 @@ const DEFAULT_CONFIG = {
   github_token: "",
   github_token_command: "gh auth token",  // Shell command whose stdout is used as the GitHub token
   port: 7247,
+  single_port: true,  // When true, reuse a single server on the configured port; new invocations delegate to the running server
   theme: "light",
   default_provider: "claude",  // AI provider: 'claude', 'gemini', 'codex', 'copilot', 'opencode', 'cursor-agent', 'pi'
   default_model: "opus",       // Model within the provider (e.g., 'opus' for Claude, 'gemini-2.5-pro' for Gemini)
@@ -128,7 +129,7 @@ async function copyExampleConfig() {
   try {
     await fs.access(sourceExample);
     await fs.copyFile(sourceExample, CONFIG_EXAMPLE_FILE);
-    console.log(`Copied config.example.json to: ${CONFIG_EXAMPLE_FILE}`);
+    logger.info(`Copied config.example.json to: ${CONFIG_EXAMPLE_FILE}`);
     return true;
   } catch (error) {
     if (error.code === 'ENOENT') {
@@ -154,13 +155,13 @@ async function ensureConfigDir() {
     if (error.code === 'ENOENT') {
       try {
         await fs.mkdir(CONFIG_DIR, { recursive: true });
-        console.log(`Created config directory: ${CONFIG_DIR}`);
+        logger.info(`Created config directory: ${CONFIG_DIR}`);
         // Copy example config to new directory
         await copyExampleConfig();
         return true; // Directory was newly created
       } catch (mkdirError) {
         if (mkdirError.code === 'EACCES' || mkdirError.code === 'EPERM') {
-          console.error(`Cannot create configuration directory at ~/.pair-review/`);
+          logger.error(`Cannot create configuration directory at ~/.pair-review/`);
           process.exit(1);
         }
         throw mkdirError;
@@ -211,7 +212,7 @@ async function loadConfig() {
         // Optional files or managed-config-present: skip silently
       } else if (error instanceof SyntaxError) {
         if (source.required) {
-          console.error(`Invalid configuration file at ~/.pair-review/config.json`);
+          logger.error(`Invalid configuration file at ~/.pair-review/config.json`);
           process.exit(1);
         }
         logger.warn(`Malformed config at ${source.label}, skipping`);
@@ -221,23 +222,33 @@ async function loadConfig() {
     }
   }
 
-  // Normalize legacy monorepos key into repos (monorepos values are overridden by repos)
-  if (mergedConfig.monorepos) {
-    mergedConfig.repos = deepMerge(mergedConfig.monorepos, mergedConfig.repos);
-  }
-
-  // Normalize repo keys to lowercase to match the database's COLLATE NOCASE identity
-  if (mergedConfig.repos) {
-    const normalized = {};
-    for (const [key, value] of Object.entries(mergedConfig.repos)) {
-      normalized[key.toLowerCase()] = value;
+  // Normalize legacy monorepos into one canonical repos map. Lowercase both
+  // sides before merging so JS object identity matches DB COLLATE NOCASE.
+  const lowercaseKeys = (obj) => {
+    const out = {};
+    for (const [key, value] of Object.entries(obj || {})) {
+      out[key.toLowerCase()] = value;
     }
-    mergedConfig.repos = normalized;
+    return out;
+  };
+  const lowerMonorepos = lowercaseKeys(mergedConfig.monorepos);
+  const lowerRepos = lowercaseKeys(mergedConfig.repos);
+  mergedConfig.repos = deepMerge(lowerMonorepos, lowerRepos);
+  delete mergedConfig.monorepos;
+
+  // PORT env var overrides all config layers (used by Preview and similar harnesses)
+  if (process.env.PORT) {
+    const envPort = Number(process.env.PORT);
+    if (!validatePort(envPort)) {
+      logger.error(`Invalid PORT env var "${process.env.PORT}" (must be an integer between 1024 and 65535)`);
+      process.exit(1);
+    }
+    mergedConfig.port = envPort;
   }
 
   // Validate port
   if (!validatePort(mergedConfig.port)) {
-    console.error(`Invalid port number ${mergedConfig.port}`);
+    logger.error(`Invalid port number ${mergedConfig.port}`);
     process.exit(1);
   }
 
@@ -269,7 +280,7 @@ async function saveConfig(config) {
     await fs.writeFile(CONFIG_FILE, JSON.stringify(config, null, 2));
   } catch (error) {
     if (error.code === 'EACCES' || error.code === 'EPERM') {
-      console.error(`Cannot create configuration directory at ~/.pair-review/`);
+      logger.error(`Cannot create configuration directory at ~/.pair-review/`);
       process.exit(1);
     }
     throw error;
@@ -413,12 +424,15 @@ function expandPath(p) {
  * @returns {object|null}
  */
 function getRepoConfig(config, repository) {
+  const key = String(repository).toLowerCase();
   const reposSection = config.repos || {};
-  const entry = reposSection[repository];
-  if (entry) return entry;
+  const repoEntry = reposSection[key] || reposSection[repository] || Object.entries(reposSection)
+    .find(([repoName]) => repoName.toLowerCase() === key)?.[1];
+  if (repoEntry) return repoEntry;
 
   const legacySection = config.monorepos || {};
-  return legacySection[repository] || null;
+  return legacySection[key] || legacySection[repository] || Object.entries(legacySection)
+    .find(([repoName]) => repoName.toLowerCase() === key)?.[1] || null;
 }
 
 /**
@@ -773,4 +787,4 @@ module.exports = {
   shouldSkipUpdateNotifier,
   _resetTokenCache,
   DEFAULT_CHECKOUT_TIMEOUT_MS
-};
+};

package/src/database.js

@@ -3001,6 +3001,20 @@ class RepoSettingsRepository {
     await run(this.db, `UPDATE repo_settings SET pool_fetch_finished_at = ? WHERE repository = ?`, [now, repository]);
   }
 
+  /**
+   * List repositories with pool settings stored in the database.
+   * Includes rows with a fetch interval only so callers can resolve complete
+   * pool configuration with file fallback through resolvePoolConfig().
+   * @returns {Promise<Array<{repository: string, pool_size: number|null, pool_fetch_interval_minutes: number|null}>>}
+   */
+  async findPoolConfiguredRepoSettings() {
+    return await query(this.db, `
+      SELECT repository, pool_size, pool_fetch_interval_minutes
+      FROM repo_settings
+      WHERE pool_size IS NOT NULL OR pool_fetch_interval_minutes IS NOT NULL
+    `);
+  }
+
   /**
    * Delete settings for a repository
    * @param {string} repository - Repository in owner/repo format

package/src/git/fetch-helpers.js

@@ -0,0 +1,29 @@
+// Copyright 2026 Tim Perkins (tjwp) | SPDX-License-Identifier: Apache-2.0
+
+/**
+ * Fetch from a remote without auto-following tags reachable from the fetched
+ * commits. Large monorepos can have very large tag namespaces, and pair-review
+ * only needs commits/refs for review setup.
+ * @param {Object} git - simple-git instance
+ * @param {string[]} args - Arguments after `git fetch --no-tags`
+ * @returns {Promise<*>}
+ */
+async function fetchNoTags(git, args) {
+  return git.fetch(['--no-tags', ...args]);
+}
+
+/**
+ * Raw `git fetch --no-tags` wrapper for fetch forms not exposed cleanly by
+ * simple-git helpers.
+ * @param {Object} git - simple-git instance
+ * @param {string[]} args - Arguments after `git fetch --no-tags`
+ * @returns {Promise<*>}
+ */
+async function rawFetchNoTags(git, args) {
+  return git.raw(['fetch', '--no-tags', ...args]);
+}
+
+module.exports = {
+  fetchNoTags,
+  rawFetchNoTags,
+};

package/src/git/worktree-pool-lifecycle.js

@@ -3,11 +3,11 @@
 
 const fs = require('fs');
 const logger = require('../utils/logger');
-const { WorktreePoolRepository, WorktreeRepository, generateWorktreeId } = require('../database');
+const { WorktreePoolRepository, WorktreeRepository, RepoSettingsRepository, generateWorktreeId } = require('../database');
 const { GitWorktreeManager } = require('./worktree');
 const { WorktreePoolUsageTracker } = require('./worktree-pool-usage');
 const { normalizeRepository } = require('../utils/paths');
-const { getRepoPoolSize } = require('../config');
+const { resolvePoolConfig } = require('../config');
 
 /**
  * Consolidates the worktree pool state machine: absorbs WorktreePoolManager
@@ -25,6 +25,7 @@ class WorktreePoolLifecycle {
     const defaults = {
       poolRepo: new WorktreePoolRepository(db),
       worktreeRepo: new WorktreeRepository(db),
+      repoSettingsRepo: new RepoSettingsRepository(db),
       usageTracker: new WorktreePoolUsageTracker(),
       fs: fs,
       simpleGit: require('simple-git'),
@@ -36,6 +37,7 @@ class WorktreePoolLifecycle {
     this.config = config;
     this._poolRepo = deps.poolRepo;
     this._worktreeRepo = deps.worktreeRepo;
+    this._repoSettingsRepo = deps.repoSettingsRepo;
     this._usageTracker = deps.usageTracker;
     this._fs = deps.fs;
     this._simpleGit = deps.simpleGit;
@@ -628,11 +630,20 @@ class WorktreePoolLifecycle {
    * @private
    */
   async _adoptExistingWorktrees() {
-    const repos = this.config.repos || {};
+    const config = this.config || {};
+    const repoSettingsRows = await this._repoSettingsRepo.findPoolConfiguredRepoSettings();
+    const settingsByRepo = new Map(
+      repoSettingsRows.map(row => [String(row.repository).toLowerCase(), row])
+    );
+    const repoNames = new Set(Object.keys(config.repos || {}));
+    for (const row of repoSettingsRows) {
+      repoNames.add(String(row.repository).toLowerCase());
+    }
     const adoptedInUse = [];
 
-    for (const repoName of Object.keys(repos)) {
-      const poolSize = getRepoPoolSize(this.config, repoName);
+    for (const repoName of repoNames) {
+      const repoSettings = settingsByRepo.get(String(repoName).toLowerCase()) || null;
+      const { poolSize } = resolvePoolConfig(config, repoName, repoSettings);
       if (!poolSize) continue;
 
       // Count existing pool entries for this repo

package/src/git/worktree.js

@@ -8,6 +8,7 @@ const { WorktreeRepository, generateWorktreeId } = require('../database');
 const { getGeneratedFilePatterns } = require('./gitattributes');
 const { normalizeRepository, resolveRenamedFile, resolveRenamedFileOld } = require('../utils/paths');
 const { GIT_DIFF_FLAGS_ARRAY, GIT_DIFF_SUMMARY_FLAGS_ARRAY } = require('./diff-flags');
+const { fetchNoTags, rawFetchNoTags } = require('./fetch-helpers');
 const { spawn, execSync } = require('child_process');
 
 const MISSING_COMMIT_ERROR_CODE = 'PAIR_REVIEW_MISSING_COMMIT';
@@ -250,7 +251,7 @@ class GitWorktreeManager {
 
     let fetchError = null;
     try {
-      await git.raw(['fetch', remote, sha]);
+      await rawFetchNoTags(git, [remote, sha]);
     } catch (error) {
       fetchError = error;
     }
@@ -370,7 +371,7 @@ class GitWorktreeManager {
     const prTrackingRef = `refs/remotes/${baseRemote}/pr-${prNumber}`;
 
     try {
-      await git.fetch([baseRemote, `+refs/pull/${prNumber}/head:${prTrackingRef}`]);
+      await fetchNoTags(git, [baseRemote, `+refs/pull/${prNumber}/head:${prTrackingRef}`]);
       return {
         remote: baseRemote,
         trackingRef: prTrackingRef,
@@ -387,7 +388,7 @@ class GitWorktreeManager {
         throw prRefError;
       }
 
-      await git.raw(['fetch', baseRemote, headSha]);
+      await rawFetchNoTags(git, [baseRemote, headSha]);
       return {
         remote: baseRemote,
         trackingRef: null,
@@ -591,13 +592,13 @@ class GitWorktreeManager {
       // Fetch only the specific base branch we need, with error handling for ref conflicts
       console.log(`Fetching base branch ${prData.base_branch} from ${remote}...`);
       try {
-        await git.fetch([remote, `+refs/heads/${prData.base_branch}:refs/remotes/${remote}/${prData.base_branch}`]);
+        await fetchNoTags(git, [remote, `+refs/heads/${prData.base_branch}:refs/remotes/${remote}/${prData.base_branch}`]);
       } catch (fetchError) {
         // If fetch fails due to ref conflicts, try alternative approaches
         console.log(`Standard fetch failed, trying alternative: ${fetchError.message}`);
         try {
           // Try fetching with force flag to overwrite conflicting refs
-          await git.raw(['fetch', remote, `+refs/heads/${prData.base_branch}:refs/remotes/${remote}/${prData.base_branch}`, '--force']);
+          await rawFetchNoTags(git, ['--force', remote, `+refs/heads/${prData.base_branch}:refs/remotes/${remote}/${prData.base_branch}`]);
         } catch (altFetchError) {
           console.warn(`Could not fetch base branch ${prData.base_branch}, will try to use existing ref`);
           // Continue anyway - the branch might already be available locally
@@ -658,7 +659,7 @@ class GitWorktreeManager {
         if (headBranch) {
           try {
             console.log(`Fetching head branch ${headBranch}...`);
-            await worktreeGit.fetch([remote, `+refs/heads/${headBranch}:refs/remotes/${remote}/${headBranch}`]);
+            await fetchNoTags(worktreeGit, [remote, `+refs/heads/${headBranch}:refs/remotes/${remote}/${headBranch}`]);
             // Create/update a local branch pointing to the fetched ref so tooling can reference it by name
             await worktreeGit.branch(['-f', headBranch, `${remote}/${headBranch}`]);
           } catch (branchFetchError) {
@@ -769,14 +770,14 @@ class GitWorktreeManager {
         // This mirrors the targeted fetch used in createWorktreeForPR.
         if (prData?.base_branch) {
           try {
-            await worktreeGit.fetch([remote, `+refs/heads/${prData.base_branch}:refs/remotes/${remote}/${prData.base_branch}`]);
+            await fetchNoTags(worktreeGit, [remote, `+refs/heads/${prData.base_branch}:refs/remotes/${remote}/${prData.base_branch}`]);
           } catch (fetchError) {
             console.warn(`Targeted base-branch fetch failed, will rely on existing refs: ${fetchError.message}`);
           }
         }
       } else {
         console.log(`Fetching latest changes from ${remote}...`);
-        await worktreeGit.fetch([remote, '--prune']);
+        await fetchNoTags(worktreeGit, ['--prune', remote]);
       }
 
       await this.ensureBaseShaAvailable(worktreeGit, prData, remote);

package/src/local-review.js

@@ -6,6 +6,7 @@ const path = require('path');
 const fs = require('fs').promises;
 const { loadConfig, showWelcomeMessage, resolveDbName, getGitHubToken } = require('./config');
 const logger = require('./utils/logger');
+const { rejectUrlLikeLocalReviewPath } = require('./utils/local-path-input');
 const { fireHooks, hasHooks } = require('./hooks/hook-runner');
 const { buildReviewStartedPayload, buildReviewLoadedPayload, getCachedUser } = require('./hooks/payloads');
 
@@ -699,6 +700,8 @@ async function handleLocalReview(targetPath, flags = {}) {
   let db = null;
 
   try {
+    rejectUrlLikeLocalReviewPath(targetPath);
+
     // Resolve target path
     const resolvedPath = path.resolve(targetPath || process.cwd());