@in-the-loop-labs/pair-review 3.4.0 → 3.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@in-the-loop-labs/pair-review",
-  "version": "3.4.0",
+  "version": "3.4.1",
   "description": "Your AI-powered code review partner - Close the feedback loop with AI coding agents",
   "main": "src/server.js",
   "bin": {

package/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pair-review",
-  "version": "3.4.0",
+  "version": "3.4.1",
   "description": "pair-review app integration — Open PRs and local changes in the pair-review web UI, run server-side AI analysis, and address review feedback. Requires the pair-review MCP server.",
   "author": {
     "name": "in-the-loop-labs",

package/plugin-code-critic/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "code-critic",
-  "version": "3.4.0",
+  "version": "3.4.1",
   "description": "AI-powered code review analysis — Run three-level AI analysis and implement-review-fix loops directly in your coding agent. Works standalone, no server required.",
   "author": {
     "name": "in-the-loop-labs",

package/public/js/index.js

@@ -133,6 +133,20 @@
     return div.innerHTML;
   }
 
+  const LOCAL_REVIEW_PATH_URL_ERROR = 'Local reviews require a filesystem path, not a URL. Pass GitHub or Graphite URLs as PR review inputs instead.';
+
+  function isUrlLikeLocalReviewPath(value) {
+    if (!value || typeof value !== 'string') return false;
+    const trimmed = value.trim();
+    if (!trimmed) return false;
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed)) return true;
+    if (/^(?:github\.com|app\.graphite\.(?:dev|com))\//i.test(trimmed)) return true;
+    // Keep this aligned with src/utils/local-path-input.js: only a leading
+    // user@host:path token is treated as an SSH-style remote.
+    if (/^[^@/\\\s]+@[^:/\\\s]+:[^\s]+$/.test(trimmed)) return true;
+    return false;
+  }
+
   /**
    * Set loading state for a tab's form
    * @param {string} tab - 'pr' or 'local'
@@ -710,6 +724,12 @@
       return;
     }
 
+    if (isUrlLikeLocalReviewPath(pathValue)) {
+      showError('local', LOCAL_REVIEW_PATH_URL_ERROR);
+      input.focus();
+      return;
+    }
+
     // Navigate to the setup page which shows step-by-step progress
     // The /local?path= route serves setup.html which handles the full setup flow
     let href = '/local?path=' + encodeURIComponent(pathValue);
@@ -717,6 +737,21 @@
     window.location.href = href;
   }
 
+  function handleLocalPathInput(event) {
+    const input = event && event.target ? event.target : document.getElementById('local-path-input');
+    const errorEl = document.getElementById('start-review-error-local');
+    if (!input || !errorEl) return;
+
+    if (isUrlLikeLocalReviewPath(input.value)) {
+      showError('local', LOCAL_REVIEW_PATH_URL_ERROR);
+      return;
+    }
+
+    if (errorEl.textContent === LOCAL_REVIEW_PATH_URL_ERROR) {
+      errorEl.classList.remove('visible', 'info');
+    }
+  }
+
   // ─── Browse Directory ──────────────────────────────────────────────────────
 
   /**
@@ -746,6 +781,9 @@
 
       if (!data.cancelled && data.path) {
         input.value = data.path;
+        // Setting .value in JavaScript does not fire an input event, so run the
+        // same handler used for typing to clear any stale URL-specific error.
+        handleLocalPathInput({ target: input });
         input.focus();
       }
 
@@ -1873,6 +1911,11 @@
       localForm.addEventListener('submit', handleStartLocal);
     }
 
+    const localPathInput = document.getElementById('local-path-input');
+    if (localPathInput) {
+      localPathInput.addEventListener('input', handleLocalPathInput);
+    }
+
     // Set up browse button handler
     const browseBtn = document.getElementById('browse-local-btn');
     if (browseBtn) {

package/src/config.js

@@ -222,19 +222,19 @@ async function loadConfig() {
     }
   }
 
-  // Normalize legacy monorepos key into repos (monorepos values are overridden by repos)
-  if (mergedConfig.monorepos) {
-    mergedConfig.repos = deepMerge(mergedConfig.monorepos, mergedConfig.repos);
-  }
-
-  // Normalize repo keys to lowercase to match the database's COLLATE NOCASE identity
-  if (mergedConfig.repos) {
-    const normalized = {};
-    for (const [key, value] of Object.entries(mergedConfig.repos)) {
-      normalized[key.toLowerCase()] = value;
+  // Normalize legacy monorepos into one canonical repos map. Lowercase both
+  // sides before merging so JS object identity matches DB COLLATE NOCASE.
+  const lowercaseKeys = (obj) => {
+    const out = {};
+    for (const [key, value] of Object.entries(obj || {})) {
+      out[key.toLowerCase()] = value;
     }
-    mergedConfig.repos = normalized;
-  }
+    return out;
+  };
+  const lowerMonorepos = lowercaseKeys(mergedConfig.monorepos);
+  const lowerRepos = lowercaseKeys(mergedConfig.repos);
+  mergedConfig.repos = deepMerge(lowerMonorepos, lowerRepos);
+  delete mergedConfig.monorepos;
 
   // PORT env var overrides all config layers (used by Preview and similar harnesses)
   if (process.env.PORT) {
@@ -424,12 +424,15 @@ function expandPath(p) {
  * @returns {object|null}
  */
 function getRepoConfig(config, repository) {
+  const key = String(repository).toLowerCase();
   const reposSection = config.repos || {};
-  const entry = reposSection[repository];
-  if (entry) return entry;
+  const repoEntry = reposSection[key] || reposSection[repository] || Object.entries(reposSection)
+    .find(([repoName]) => repoName.toLowerCase() === key)?.[1];
+  if (repoEntry) return repoEntry;
 
   const legacySection = config.monorepos || {};
-  return legacySection[repository] || null;
+  return legacySection[key] || legacySection[repository] || Object.entries(legacySection)
+    .find(([repoName]) => repoName.toLowerCase() === key)?.[1] || null;
 }
 
 /**
@@ -784,4 +787,4 @@ module.exports = {
   shouldSkipUpdateNotifier,
   _resetTokenCache,
   DEFAULT_CHECKOUT_TIMEOUT_MS
-};
+};

package/src/database.js

@@ -3001,6 +3001,20 @@ class RepoSettingsRepository {
     await run(this.db, `UPDATE repo_settings SET pool_fetch_finished_at = ? WHERE repository = ?`, [now, repository]);
   }
 
+  /**
+   * List repositories with pool settings stored in the database.
+   * Includes rows with a fetch interval only so callers can resolve complete
+   * pool configuration with file fallback through resolvePoolConfig().
+   * @returns {Promise<Array<{repository: string, pool_size: number|null, pool_fetch_interval_minutes: number|null}>>}
+   */
+  async findPoolConfiguredRepoSettings() {
+    return await query(this.db, `
+      SELECT repository, pool_size, pool_fetch_interval_minutes
+      FROM repo_settings
+      WHERE pool_size IS NOT NULL OR pool_fetch_interval_minutes IS NOT NULL
+    `);
+  }
+
   /**
    * Delete settings for a repository
    * @param {string} repository - Repository in owner/repo format

package/src/git/fetch-helpers.js

@@ -0,0 +1,29 @@
+// Copyright 2026 Tim Perkins (tjwp) | SPDX-License-Identifier: Apache-2.0
+
+/**
+ * Fetch from a remote without auto-following tags reachable from the fetched
+ * commits. Large monorepos can have very large tag namespaces, and pair-review
+ * only needs commits/refs for review setup.
+ * @param {Object} git - simple-git instance
+ * @param {string[]} args - Arguments after `git fetch --no-tags`
+ * @returns {Promise<*>}
+ */
+async function fetchNoTags(git, args) {
+  return git.fetch(['--no-tags', ...args]);
+}
+
+/**
+ * Raw `git fetch --no-tags` wrapper for fetch forms not exposed cleanly by
+ * simple-git helpers.
+ * @param {Object} git - simple-git instance
+ * @param {string[]} args - Arguments after `git fetch --no-tags`
+ * @returns {Promise<*>}
+ */
+async function rawFetchNoTags(git, args) {
+  return git.raw(['fetch', '--no-tags', ...args]);
+}
+
+module.exports = {
+  fetchNoTags,
+  rawFetchNoTags,
+};

package/src/git/worktree-pool-lifecycle.js

@@ -3,11 +3,11 @@
 
 const fs = require('fs');
 const logger = require('../utils/logger');
-const { WorktreePoolRepository, WorktreeRepository, generateWorktreeId } = require('../database');
+const { WorktreePoolRepository, WorktreeRepository, RepoSettingsRepository, generateWorktreeId } = require('../database');
 const { GitWorktreeManager } = require('./worktree');
 const { WorktreePoolUsageTracker } = require('./worktree-pool-usage');
 const { normalizeRepository } = require('../utils/paths');
-const { getRepoPoolSize } = require('../config');
+const { resolvePoolConfig } = require('../config');
 
 /**
  * Consolidates the worktree pool state machine: absorbs WorktreePoolManager
@@ -25,6 +25,7 @@ class WorktreePoolLifecycle {
     const defaults = {
       poolRepo: new WorktreePoolRepository(db),
       worktreeRepo: new WorktreeRepository(db),
+      repoSettingsRepo: new RepoSettingsRepository(db),
       usageTracker: new WorktreePoolUsageTracker(),
       fs: fs,
       simpleGit: require('simple-git'),
@@ -36,6 +37,7 @@ class WorktreePoolLifecycle {
     this.config = config;
     this._poolRepo = deps.poolRepo;
     this._worktreeRepo = deps.worktreeRepo;
+    this._repoSettingsRepo = deps.repoSettingsRepo;
     this._usageTracker = deps.usageTracker;
     this._fs = deps.fs;
     this._simpleGit = deps.simpleGit;
@@ -628,11 +630,20 @@ class WorktreePoolLifecycle {
    * @private
    */
   async _adoptExistingWorktrees() {
-    const repos = this.config.repos || {};
+    const config = this.config || {};
+    const repoSettingsRows = await this._repoSettingsRepo.findPoolConfiguredRepoSettings();
+    const settingsByRepo = new Map(
+      repoSettingsRows.map(row => [String(row.repository).toLowerCase(), row])
+    );
+    const repoNames = new Set(Object.keys(config.repos || {}));
+    for (const row of repoSettingsRows) {
+      repoNames.add(String(row.repository).toLowerCase());
+    }
     const adoptedInUse = [];
 
-    for (const repoName of Object.keys(repos)) {
-      const poolSize = getRepoPoolSize(this.config, repoName);
+    for (const repoName of repoNames) {
+      const repoSettings = settingsByRepo.get(String(repoName).toLowerCase()) || null;
+      const { poolSize } = resolvePoolConfig(config, repoName, repoSettings);
       if (!poolSize) continue;
 
       // Count existing pool entries for this repo

package/src/git/worktree.js

@@ -8,6 +8,7 @@ const { WorktreeRepository, generateWorktreeId } = require('../database');
 const { getGeneratedFilePatterns } = require('./gitattributes');
 const { normalizeRepository, resolveRenamedFile, resolveRenamedFileOld } = require('../utils/paths');
 const { GIT_DIFF_FLAGS_ARRAY, GIT_DIFF_SUMMARY_FLAGS_ARRAY } = require('./diff-flags');
+const { fetchNoTags, rawFetchNoTags } = require('./fetch-helpers');
 const { spawn, execSync } = require('child_process');
 
 const MISSING_COMMIT_ERROR_CODE = 'PAIR_REVIEW_MISSING_COMMIT';
@@ -250,7 +251,7 @@ class GitWorktreeManager {
 
     let fetchError = null;
     try {
-      await git.raw(['fetch', remote, sha]);
+      await rawFetchNoTags(git, [remote, sha]);
     } catch (error) {
       fetchError = error;
     }
@@ -370,7 +371,7 @@ class GitWorktreeManager {
     const prTrackingRef = `refs/remotes/${baseRemote}/pr-${prNumber}`;
 
     try {
-      await git.fetch([baseRemote, `+refs/pull/${prNumber}/head:${prTrackingRef}`]);
+      await fetchNoTags(git, [baseRemote, `+refs/pull/${prNumber}/head:${prTrackingRef}`]);
       return {
         remote: baseRemote,
         trackingRef: prTrackingRef,
@@ -387,7 +388,7 @@ class GitWorktreeManager {
         throw prRefError;
       }
 
-      await git.raw(['fetch', baseRemote, headSha]);
+      await rawFetchNoTags(git, [baseRemote, headSha]);
       return {
         remote: baseRemote,
         trackingRef: null,
@@ -591,13 +592,13 @@ class GitWorktreeManager {
       // Fetch only the specific base branch we need, with error handling for ref conflicts
       console.log(`Fetching base branch ${prData.base_branch} from ${remote}...`);
       try {
-        await git.fetch([remote, `+refs/heads/${prData.base_branch}:refs/remotes/${remote}/${prData.base_branch}`]);
+        await fetchNoTags(git, [remote, `+refs/heads/${prData.base_branch}:refs/remotes/${remote}/${prData.base_branch}`]);
       } catch (fetchError) {
         // If fetch fails due to ref conflicts, try alternative approaches
         console.log(`Standard fetch failed, trying alternative: ${fetchError.message}`);
         try {
           // Try fetching with force flag to overwrite conflicting refs
-          await git.raw(['fetch', remote, `+refs/heads/${prData.base_branch}:refs/remotes/${remote}/${prData.base_branch}`, '--force']);
+          await rawFetchNoTags(git, ['--force', remote, `+refs/heads/${prData.base_branch}:refs/remotes/${remote}/${prData.base_branch}`]);
         } catch (altFetchError) {
           console.warn(`Could not fetch base branch ${prData.base_branch}, will try to use existing ref`);
           // Continue anyway - the branch might already be available locally
@@ -658,7 +659,7 @@ class GitWorktreeManager {
         if (headBranch) {
           try {
             console.log(`Fetching head branch ${headBranch}...`);
-            await worktreeGit.fetch([remote, `+refs/heads/${headBranch}:refs/remotes/${remote}/${headBranch}`]);
+            await fetchNoTags(worktreeGit, [remote, `+refs/heads/${headBranch}:refs/remotes/${remote}/${headBranch}`]);
             // Create/update a local branch pointing to the fetched ref so tooling can reference it by name
             await worktreeGit.branch(['-f', headBranch, `${remote}/${headBranch}`]);
           } catch (branchFetchError) {
@@ -769,14 +770,14 @@ class GitWorktreeManager {
         // This mirrors the targeted fetch used in createWorktreeForPR.
         if (prData?.base_branch) {
           try {
-            await worktreeGit.fetch([remote, `+refs/heads/${prData.base_branch}:refs/remotes/${remote}/${prData.base_branch}`]);
+            await fetchNoTags(worktreeGit, [remote, `+refs/heads/${prData.base_branch}:refs/remotes/${remote}/${prData.base_branch}`]);
           } catch (fetchError) {
             console.warn(`Targeted base-branch fetch failed, will rely on existing refs: ${fetchError.message}`);
           }
         }
       } else {
         console.log(`Fetching latest changes from ${remote}...`);
-        await worktreeGit.fetch([remote, '--prune']);
+        await fetchNoTags(worktreeGit, ['--prune', remote]);
       }
 
       await this.ensureBaseShaAvailable(worktreeGit, prData, remote);

package/src/local-review.js

@@ -6,6 +6,7 @@ const path = require('path');
 const fs = require('fs').promises;
 const { loadConfig, showWelcomeMessage, resolveDbName, getGitHubToken } = require('./config');
 const logger = require('./utils/logger');
+const { rejectUrlLikeLocalReviewPath } = require('./utils/local-path-input');
 const { fireHooks, hasHooks } = require('./hooks/hook-runner');
 const { buildReviewStartedPayload, buildReviewLoadedPayload, getCachedUser } = require('./hooks/payloads');
 
@@ -699,6 +700,8 @@ async function handleLocalReview(targetPath, flags = {}) {
   let db = null;
 
   try {
+    rejectUrlLikeLocalReviewPath(targetPath);
+
     // Resolve target path
     const resolvedPath = path.resolve(targetPath || process.cwd());
 

package/src/main.js

@@ -5,6 +5,7 @@ const { initializeDatabase, run, queryOne, query, migrateExistingWorktrees, Work
 const { PRArgumentParser } = require('./github/parser');
 const { GitHubClient } = require('./github/client');
 const { GitWorktreeManager } = require('./git/worktree');
+const { fetchNoTags } = require('./git/fetch-helpers');
 const { WorktreePoolLifecycle } = require('./git/worktree-pool-lifecycle');
 const { startServer } = require('./server');
 const Analyzer = require('./ai/analyzer');
@@ -13,6 +14,7 @@ const { handleLocalReview, findMainGitRoot } = require('./local-review');
 const { storePRData, registerRepositoryLocation, findRepositoryPath } = require('./setup/pr-setup');
 const { fireReviewStartedHook } = require('./hooks/payloads');
 const { normalizeRepository, resolveRenamedFile, resolveRenamedFileOld } = require('./utils/paths');
+const { rejectUrlLikeLocalReviewPath } = require('./utils/local-path-input');
 const logger = require('./utils/logger');
 const simpleGit = require('simple-git');
 const { getGeneratedFilePatterns } = require('./git/gitattributes');
@@ -288,6 +290,7 @@ function parseArgs(args) {
       flags.local = true;
       // Next argument is optional path (if not starting with -)
       if (i + 1 < args.length && !args[i + 1].startsWith('-')) {
+        rejectUrlLikeLocalReviewPath(args[i + 1]);
         flags.localPath = args[i + 1];
         i++; // Skip next argument since we consumed it
       }
@@ -723,7 +726,7 @@ async function performHeadlessReview(args, config, db, flags, options, externalP
 
       // Ensure we have the base SHA available (fetch if needed)
       try {
-        await git.fetch(['origin', prData.base_sha]);
+        await fetchNoTags(git, ['origin', prData.base_sha]);
       } catch (fetchError) {
         // Fetch by SHA may fail (not all servers support it); verify SHA is available locally
         try {
@@ -1225,7 +1228,7 @@ function startPoolBackgroundFetches(db, config) {
               const git = simpleGit(entry.path, { timeout: { block: 300000 } });
               const remotes = await git.getRemotes();
               const remote = remotes.find(r => r.name === 'origin') || remotes[0];
-              if (remote) await git.fetch([remote.name, '--prune']);
+              if (remote) await fetchNoTags(git, ['--prune', remote.name]);
               await poolRepo.updateLastFetched(entry.id);
               // Refresh the lease so the stale guard only needs to outlive
               // a single stalled fetch, not the entire serial loop.
@@ -1294,4 +1297,4 @@ if (require.main === module) {
   main();
 }
 
-module.exports = { main, parseArgs, detectPRFromGitHubEnvironment };
+module.exports = { main, parseArgs, detectPRFromGitHubEnvironment };

package/src/routes/local.js

@@ -35,6 +35,7 @@ const { getProviderClass, createProvider } = require('../ai/provider');
 const { getDefaultBranch, tryGraphiteState } = require('../git/base-branch');
 const { CommentRepository } = require('../database');
 const { runExecutableAnalysis, getChangedFiles } = require('./executable-analysis');
+const { rejectUrlLikeLocalReviewPath } = require('../utils/local-path-input');
 const {
   activeAnalyses,
   localReviewDiffs,
@@ -380,6 +381,12 @@ router.post('/api/local/start', async (req, res) => {
       });
     }
 
+    try {
+      rejectUrlLikeLocalReviewPath(inputPath);
+    } catch (err) {
+      return res.status(400).json({ error: err.message });
+    }
+
     // Required inline (not reusing top-level import) so that vi.spyOn()
     // replacements on the module exports are visible at call time in integration tests.
     const { findGitRoot, getHeadSha, getRepositoryName, getCurrentBranch } = require('../local-review');

package/src/routes/setup.js

@@ -18,6 +18,7 @@ const { setupLocalReview } = require('../setup/local-setup');
 const { getGitHubToken, expandPath } = require('../config');
 const { queryOne, ReviewRepository } = require('../database');
 const { normalizeRepository } = require('../utils/paths');
+const { rejectUrlLikeLocalReviewPath } = require('../utils/local-path-input');
 const logger = require('../utils/logger');
 
 const router = express.Router();
@@ -186,6 +187,12 @@ router.post('/api/setup/local', async (req, res) => {
       return res.status(400).json({ error: 'Missing required field: path' });
     }
 
+    try {
+      rejectUrlLikeLocalReviewPath(rawPath);
+    } catch (err) {
+      return res.status(400).json({ error: err.message });
+    }
+
     const targetPath = expandPath(rawPath);
     const db = req.app.get('db');
 

package/src/routes/stack-analysis.js

@@ -220,7 +220,7 @@ async function executeStackAnalysis(params) {
     // 2. Bulk fetch all PR refs (runs against trigger worktree)
     const refspecs = prNumbers.map(n => `+refs/pull/${n}/head:refs/remotes/origin/pr-${n}`);
     try {
-      deps.execSync(`git fetch origin ${refspecs.join(' ')}`, {
+      deps.execSync(`git fetch --no-tags origin ${refspecs.join(' ')}`, {
         cwd: triggerWorktreePath, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
         timeout: 60000
       });

package/src/setup/local-setup.js

@@ -6,6 +6,7 @@ const { fireHooks, hasHooks } = require('../hooks/hook-runner');
 const { buildReviewStartedPayload, buildReviewLoadedPayload, getCachedUser } = require('../hooks/payloads');
 const { STOPS, DEFAULT_SCOPE, reviewScope } = require('../local-scope');
 const logger = require('../utils/logger');
+const { LOCAL_REVIEW_PATH_URL_ERROR, rejectUrlLikeLocalReviewPath } = require('../utils/local-path-input');
 const path = require('path');
 const fs = require('fs').promises;
 
@@ -31,11 +32,14 @@ async function setupLocalReview({ db, targetPath, onProgress, config }) {
   let resolvedPath;
   try {
     progress({ step: 'validate', status: 'running', message: 'Validating target path...' });
+    rejectUrlLikeLocalReviewPath(targetPath);
     resolvedPath = path.resolve(targetPath);
     await fs.access(resolvedPath);
     progress({ step: 'validate', status: 'completed', message: `Path resolved to ${resolvedPath}` });
   } catch (err) {
-    const message = `Path does not exist: ${path.resolve(targetPath)}`;
+    const message = err.message === LOCAL_REVIEW_PATH_URL_ERROR
+      ? err.message
+      : `Path does not exist: ${path.resolve(targetPath)}`;
     progress({ step: 'validate', status: 'error', message });
     throw new Error(message);
   }

package/src/setup/pr-setup.js

@@ -17,7 +17,7 @@ const { WorktreePoolLifecycle } = require('../git/worktree-pool-lifecycle');
 const { GitHubClient } = require('../github/client');
 const { normalizeRepository } = require('../utils/paths');
 const { findMainGitRoot } = require('../local-review');
-const { getConfigDir, getRepoPath, resolveRepoOptions, getRepoPoolSize, getRepoResetScript, DEFAULT_CHECKOUT_TIMEOUT_MS } = require('../config');
+const { getConfigDir, getRepoPath, resolveRepoOptions, resolvePoolConfig, getRepoResetScript, DEFAULT_CHECKOUT_TIMEOUT_MS } = require('../config');
 const logger = require('../utils/logger');
 const { fireReviewStartedHook } = require('../hooks/payloads');
 const simpleGit = require('simple-git');
@@ -229,6 +229,7 @@ async function findRepositoryPath({ db, owner, repo, repository, prNumber, confi
   const worktreeManager = new GitWorktreeManager(db);
   const repoSettingsRepo = new RepoSettingsRepository(db);
   const worktreeRepo = new WorktreeRepository(db);
+  const repoSettings = await repoSettingsRepo.getRepoSettings(repository);
 
   let repositoryPath = null;
   let worktreeSourcePath = null;  // Path to use as cwd for `git worktree add` (may differ from repositoryPath)
@@ -288,7 +289,7 @@ async function findRepositoryPath({ db, owner, repo, repository, prNumber, confi
   // ------------------------------------------------------------------
   // Resolve monorepo worktree options (checkout_script, worktree_directory, worktree_name_template)
   // ------------------------------------------------------------------
-  const resolved = config ? resolveRepoOptions(config, repository) : { checkoutScript: null, checkoutTimeout: DEFAULT_CHECKOUT_TIMEOUT_MS, worktreeConfig: null };
+  const resolved = config ? resolveRepoOptions(config, repository, repoSettings) : { checkoutScript: null, checkoutTimeout: DEFAULT_CHECKOUT_TIMEOUT_MS, worktreeConfig: null };
   const { checkoutScript, checkoutTimeout, worktreeConfig } = resolved;
 
   // When a checkout script is configured, null out worktreeSourcePath —
@@ -301,7 +302,7 @@ async function findRepositoryPath({ db, owner, repo, repository, prNumber, confi
   // ------------------------------------------------------------------
   // Tier 0: Check known local path from repo_settings
   // ------------------------------------------------------------------
-  const knownPath = await repoSettingsRepo.getLocalPath(repository);
+  const knownPath = repoSettings?.local_path || null;
 
   if (!repositoryPath && knownPath && await worktreeManager.pathExists(knownPath)) {
     try {
@@ -464,7 +465,9 @@ async function setupPRReview({ db, owner, repo, prNumber, githubToken, config, o
   // Step: worktree - Create git worktree for the PR
   // ------------------------------------------------------------------
   const prInfo = { owner, repo, number: prNumber };
-  const poolSize = config ? getRepoPoolSize(config, repository) : 0;
+  const repoSettingsRepo = new RepoSettingsRepository(db);
+  const repoSettings = await repoSettingsRepo.getRepoSettings(repository);
+  const { poolSize } = resolvePoolConfig(config || {}, repository, repoSettings);
   const resetScript = config ? getRepoResetScript(config, repository) : null;
 
   let worktreePath;

package/src/single-port.js

@@ -4,6 +4,7 @@ const path = require('path');
 const semver = require('semver');
 const { PRArgumentParser } = require('./github/parser');
 const logger = require('./utils/logger');
+const { rejectUrlLikeLocalReviewPath } = require('./utils/local-path-input');
 const { version: packageVersion } = require('../package.json');
 
 const HEALTH_TIMEOUT_MS = 2000;
@@ -158,6 +159,7 @@ async function attemptDelegation(config, flags, prArgs, _deps) {
   // Determine mode and build URL
   let url;
   if (flags.local) {
+    rejectUrlLikeLocalReviewPath(flags.localPath);
     const targetPath = path.resolve(flags.localPath || process.cwd());
     url = buildDelegationUrl(port, 'local', { localPath: targetPath, analyze: flags.ai });
   } else if (prArgs.length > 0) {

package/src/utils/local-path-input.js

@@ -0,0 +1,44 @@
+// Copyright 2026 Tim Perkins (tjwp) | SPDX-License-Identifier: Apache-2.0
+
+const LOCAL_REVIEW_PATH_URL_ERROR = 'Local reviews require a filesystem path, not a URL. Pass GitHub or Graphite URLs as PR review inputs instead.';
+
+/**
+ * Detect inputs that are URLs or remote-style Git URLs rather than filesystem paths.
+ * This intentionally checks only unambiguous URL forms so normal absolute,
+ * relative, tilde, and Windows paths continue to work.
+ *
+ * @param {unknown} input
+ * @returns {boolean}
+ */
+function isUrlLikeLocalReviewPath(input) {
+  if (typeof input !== 'string') return false;
+
+  const value = input.trim();
+  if (!value) return false;
+
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(value)) return true;
+  if (/^(?:github\.com|app\.graphite\.(?:dev|com))\//i.test(value)) return true;
+  // Treat only a leading user@host:path token as SSH remote syntax; if a
+  // directory prefix contains @ and : it should remain a filesystem path.
+  if (/^[^@/\\\s]+@[^:/\\\s]+:[^\s]+$/.test(value)) return true;
+
+  return false;
+}
+
+/**
+ * Throw a user-facing error when a local review path is actually a URL.
+ *
+ * @param {unknown} input
+ * @throws {Error}
+ */
+function rejectUrlLikeLocalReviewPath(input) {
+  if (isUrlLikeLocalReviewPath(input)) {
+    throw new Error(LOCAL_REVIEW_PATH_URL_ERROR);
+  }
+}
+
+module.exports = {
+  LOCAL_REVIEW_PATH_URL_ERROR,
+  isUrlLikeLocalReviewPath,
+  rejectUrlLikeLocalReviewPath
+};