@in-the-loop-labs/pair-review 3.9.1 → 4.1.0

package/src/routes/github-collections.js

@@ -16,12 +16,15 @@
 const express = require('express');
 const { query, run, withTransaction } = require('../database');
 const { GitHubClient } = require('../github/client');
-const { getGitHubToken } = require('../config');
+const { getGitHubToken, resolveHostBinding } = require('../config');
 const logger = require('../utils/logger');
 
 const router = express.Router();
 
-const SELECT_COLUMNS = 'owner, repo, number, title, author, updated_at, html_url, state, fetched_at';
+// `host` is additive: NULL for github.com rows, the repo's `api_host` URL for
+// alt-host rows. Both GET and the refresh re-read echo it so the frontend can
+// open a PR against the system it actually lives on without re-probing.
+const SELECT_COLUMNS = 'owner, repo, number, title, author, updated_at, html_url, state, fetched_at, host';
 
 // Valid `org/team` slug: two non-empty segments of GitHub-allowed characters.
 // Used to guard against query injection when interpolating the team into the
@@ -40,11 +43,18 @@ const TEAM_SLUG_PATTERN = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
  * namespaced cache entry for a query whose results are identical to the
  * unfiltered view.
  */
+// Each definition also carries a `classifyAlt(pr, login, team)` predicate that
+// buckets a REST-listed alt-host PR into this collection. Alt-hosts generally
+// have no Search API, so the collection semantics that `buildQuery` expresses
+// as a github.com search string are re-expressed here as a local predicate
+// over the fields `client.listOpenPullRequests` returns. `pr.requested_teams`
+// holds team *slugs*; `team`, when set, is a validated `org/team` slug.
 const COLLECTIONS = [
   {
     name: 'review-requests',
     label: 'review requests',
-    buildQuery: (login) => `is:pr is:open archived:false user-review-requested:${login}`
+    buildQuery: (login) => `is:pr is:open archived:false user-review-requested:${login}`,
+    classifyAlt: (pr, login) => pr.requested_reviewers.includes(login)
   },
   {
     name: 'team-reviews',
@@ -63,15 +73,128 @@ const COLLECTIONS = [
         return `is:pr is:open archived:false team-review-requested:${team}`;
       }
       return `is:pr is:open archived:false review-requested:${login} -user-review-requested:${login}`;
+    },
+    // A specific `team` filters to PRs requesting that team's slug (the part
+    // after the slash, since REST `requested_teams` carries bare slugs, not
+    // `org/team`); the all-teams view keeps the same "exclude direct requests"
+    // rule as the github.com search so a directly-requested PR shows under
+    // review-requests, not here.
+    classifyAlt: (pr, login, team) => {
+      if (pr.requested_teams.length === 0) return false;
+      if (team) {
+        const slug = team.slice(team.indexOf('/') + 1);
+        return pr.requested_teams.includes(slug);
+      }
+      return !pr.requested_reviewers.includes(login);
     }
   },
   {
     name: 'my-prs',
     label: 'your pull requests',
-    buildQuery: (login) => `is:pr is:open archived:false author:${login}`
+    buildQuery: (login) => `is:pr is:open archived:false author:${login}`,
+    classifyAlt: (pr, login) => pr.author === login
   }
 ];
 
+/**
+ * Derive an `owner/repo` pair from a `config.repos` key. Alt-host config
+ * entries are keyed by the canonical `owner/repo`; monorepo-style entries can
+ * be keyed by something else and matched to PRs via `url_pattern`, but the
+ * collections sweep needs a concrete owner/repo to call `pulls.list`, so those
+ * keys are skipped rather than guessed at.
+ * @param {string} repoKey - A `config.repos` key.
+ * @returns {{ owner: string, repo: string }|null} Null when not owner/repo shaped.
+ */
+function ownerRepoFromKey(repoKey) {
+  if (typeof repoKey !== 'string') return null;
+  const parts = repoKey.split('/');
+  if (parts.length !== 2 || !parts[0] || !parts[1]) return null;
+  return { owner: parts[0], repo: parts[1] };
+}
+
+/**
+ * Sweep every alt-host repo in config for open PRs belonging to `collection`,
+ * classifying each with `def.classifyAlt`. Best-effort per host: a failure for
+ * one repo is captured in the returned `hosts` array and never thrown, so the
+ * github.com results already gathered by the caller are never lost. Rows are
+ * stamped with the repo's `api_host` string for the `host` column.
+ *
+ * `credentialedRepoCount` counts alt-host repos that resolved a non-empty
+ * token (i.e. could authenticate), regardless of whether the subsequent fetch
+ * then succeeded. The refresh route uses it to decide whether ANY source can
+ * authenticate before returning 401 on an install with no github.com token.
+ *
+ * @param {Object} config - Server config (from loadConfig()).
+ * @param {Object} def - The collection definition (needs `classifyAlt`).
+ * @param {string|null} team - Validated `org/team` filter, or null.
+ * @returns {Promise<{ rows: Array<Object>, hosts: Array<{host: string, repo: string, ok: boolean, error?: string}>, credentialedRepoCount: number }>}
+ */
+async function sweepAltHosts(config, def, team) {
+  const rows = [];
+  const hosts = [];
+  let credentialedRepoCount = 0;
+  const repos = (config && config.repos) || {};
+  if (typeof def.classifyAlt !== 'function') {
+    return { rows, hosts, credentialedRepoCount };
+  }
+
+  // One `GET /user` per (host, token) per refresh — multiple repos can share a
+  // host, and a login lookup per repo would be wasteful. Keyed by token too so
+  // distinct credentials on the same host resolve their own identity.
+  const loginCache = new Map();
+
+  for (const [repoKey, repoEntry] of Object.entries(repos)) {
+    if (!repoEntry || typeof repoEntry !== 'object') continue;
+    const apiHost = (typeof repoEntry.api_host === 'string' && repoEntry.api_host) ? repoEntry.api_host : null;
+    if (!apiHost) continue;
+
+    const ownerRepo = ownerRepoFromKey(repoKey);
+    if (!ownerRepo) {
+      logger.warn(`Collections: skipping alt-host repo "${repoKey}" (${apiHost}) — key is not an owner/repo pair, cannot derive a repo for pulls.list`);
+      hosts.push({ host: apiHost, repo: repoKey, ok: false, error: 'config key is not an owner/repo pair' });
+      continue;
+    }
+
+    try {
+      const binding = resolveHostBinding(repoKey, config, { host: apiHost });
+
+      // A repo with `api_host` but no repo-scoped token yields an empty-token
+      // binding. Probing anyway would 401 once per collection per refresh and
+      // spam error logs; surface it as a per-host status instead (debug, not
+      // error — it's a config gap, not a runtime failure).
+      if (!binding.token) {
+        logger.debug(`Collections: skipping alt-host repo "${repoKey}" (${apiHost}) — no repo-scoped credentials configured`);
+        hosts.push({ host: apiHost, repo: repoKey, ok: false, error: 'no credentials configured' });
+        continue;
+      }
+      credentialedRepoCount++;
+
+      const client = new GitHubClient(binding);
+
+      const loginKey = `${apiHost}\u0000${binding.token}`;
+      let login = loginCache.get(loginKey);
+      if (login === undefined) {
+        const user = await client.getAuthenticatedUser();
+        login = user.login;
+        loginCache.set(loginKey, login);
+      }
+
+      const prs = await client.listOpenPullRequests(ownerRepo.owner, ownerRepo.repo);
+      for (const pr of prs) {
+        if (def.classifyAlt(pr, login, team)) {
+          rows.push({ ...pr, host: apiHost });
+        }
+      }
+      hosts.push({ host: apiHost, repo: repoKey, ok: true });
+    } catch (error) {
+      logger.error(`Collections: alt-host refresh failed for ${repoKey} (${apiHost}): ${error.message}`);
+      hosts.push({ host: apiHost, repo: repoKey, ok: false, error: error.message });
+    }
+  }
+
+  return { rows, hosts, credentialedRepoCount };
+}
+
 /**
  * Derive the cache storage key for a collection, namespacing by team so a
  * filtered view never clobbers the all-teams cache. Both the GET (read) and
@@ -161,17 +284,40 @@ function registerCollection(def) {
       }
 
       const config = req.app.get('config');
+      const db = req.app.get('db');
+
+      // The dashboard has two independent PR sources: the github.com search
+      // (top-level token) and the per-repo alt-host sweep. Treat them
+      // independently so an alt-host-only install (repo-scoped alt credentials,
+      // NO global github token) can still refresh. A missing github token skips
+      // ONLY the github branch; a per-source status is recorded instead.
       // Cross-repo search on github.com — no per-repo binding applies here.
       // Explicit `undefined` repository selects the no-repo (top-level) path.
       const githubToken = getGitHubToken(config, undefined);
-      if (!githubToken) {
-        return res.status(401).json({ success: false, error: 'GitHub token not configured' });
+      const sourceStatuses = [];
+      let prs = [];
+      if (githubToken) {
+        const client = new GitHubClient(githubToken);
+        const user = await client.getAuthenticatedUser();
+        prs = await client.searchPullRequests(buildQuery(user.login, { team }));
+      } else {
+        // host:null, repo:null identifies the github.com cross-repo source
+        // (mirrors the NULL-host = github.com convention used for cache rows).
+        sourceStatuses.push({ host: null, repo: null, ok: false, error: 'no github.com token configured' });
       }
 
-      const db = req.app.get('db');
-      const client = new GitHubClient(githubToken);
-      const user = await client.getAuthenticatedUser();
-      const prs = await client.searchPullRequests(buildQuery(user.login, { team }));
+      // Alt-host repos (both exclusive and dual) have no Search API, so sweep
+      // them via REST and classify locally. Best-effort: a failing host is
+      // reported in `hosts` and never aborts the github.com rows below. Done
+      // BEFORE the transaction so a slow alt host doesn't hold a write lock.
+      const { rows: altRows, hosts, credentialedRepoCount } = await sweepAltHosts(config, def, team);
+
+      // Only 401 when NO source can authenticate at all: no github token AND no
+      // alt-host repo with credentials. If either can authenticate, proceed and
+      // report the unavailable source in the response.
+      if (!githubToken && credentialedRepoCount === 0) {
+        return res.status(401).json({ success: false, error: 'GitHub token not configured' });
+      }
 
       // Namespace the cache so a filtered view never clobbers the all-teams
       // cache. Every distinct team string the user tries creates its own cached
@@ -179,18 +325,34 @@ function registerCollection(def) {
       // home-page feature.
       const key = cacheKey(name, team);
       await withTransaction(db, async () => {
+        // DELETE-then-INSERT clears prior github AND alt rows for this key, so a
+        // retry re-derives the whole view rather than duplicating. github rows
+        // stamp host NULL; alt rows carry their api_host string.
         await run(db, 'DELETE FROM github_pr_cache WHERE collection = ?', [key]);
         for (const pr of prs) {
           await run(db,
-            'INSERT INTO github_pr_cache (owner, repo, number, title, author, updated_at, html_url, state, collection) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)',
-            [pr.owner, pr.repo, pr.number, pr.title, pr.author, pr.updated_at, pr.html_url, pr.state, key]
+            'INSERT INTO github_pr_cache (owner, repo, number, title, author, updated_at, html_url, state, collection, host) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+            [pr.owner, pr.repo, pr.number, pr.title, pr.author, pr.updated_at, pr.html_url, pr.state, key, null]
+          );
+        }
+        for (const pr of altRows) {
+          await run(db,
+            'INSERT INTO github_pr_cache (owner, repo, number, title, author, updated_at, html_url, state, collection, host) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+            [pr.owner, pr.repo, pr.number, pr.title, pr.author, pr.updated_at, pr.html_url, pr.state, key, pr.host]
           );
         }
       });
 
       const rows = await getCachedRows(db, key);
       const fetchedAt = rows.length > 0 ? rows[0].fetched_at : null;
-      res.json({ success: true, prs: rows, fetched_at: fetchedAt });
+      // `hosts` is additive; omit it entirely when every source is healthy (no
+      // alt-host repos and a working github token) so the github-only happy-path
+      // response shape is byte-identical to before. A skipped github source or
+      // any alt-host status makes it appear.
+      const allStatuses = sourceStatuses.concat(hosts);
+      const payload = { success: true, prs: rows, fetched_at: fetchedAt };
+      if (allStatuses.length > 0) payload.hosts = allStatuses;
+      res.json(payload);
     } catch (error) {
       if (error.status === 401 || error.status === 403) {
         return res.status(401).json({ success: false, error: 'GitHub token is invalid or expired' });

package/src/routes/local.js

@@ -49,7 +49,7 @@ const {
   activeAnalyses,
   localReviewDiffs,
   reviewToAnalysisId,
-  getModel,
+  resolveProviderModel,
   determineCompletionInfo,
   broadcastProgress,
   CancellationError,
@@ -1412,6 +1412,9 @@ router.post('/api/local/:reviewId/analyses', async (req, res) => {
     // wins and falls through to the single-provider path unchanged below.
     // For repos with no default_council_id the resolver returns type:'single' and
     // we fall through, so single-provider behavior is byte-identical to before.
+    // (A CLI --provider override arrives here as a populated requestProvider —
+    // the frontend forces the single-provider path when an override is active —
+    // so this council branch is correctly skipped for delegated overrides.)
     if (!requestProvider && !requestModel) {
       const reviewConfig = await resolveReviewConfig(
         db,
@@ -1439,25 +1442,13 @@ router.post('/api/local/:reviewId/analyses', async (req, res) => {
       }
     }
 
-    // Determine provider: request body > repo settings > config > default ('claude')
-    let selectedProvider;
-    if (requestProvider) {
-      selectedProvider = requestProvider;
-    } else if (repoSettings && repoSettings.default_provider) {
-      selectedProvider = repoSettings.default_provider;
-    } else {
-      selectedProvider = appConfig.default_provider || appConfig.provider || 'claude';
-    }
-
-    // Determine model: request body > repo settings > config/CLI > default
-    let selectedModel;
-    if (requestModel) {
-      selectedModel = requestModel;
-    } else if (repoSettings && repoSettings.default_model) {
-      selectedModel = repoSettings.default_model;
-    } else {
-      selectedModel = getModel(req);
-    }
+    // Resolve provider/model: request body > env/CLI > repo settings > config/legacy > default.
+    // Shared with the PR route (src/routes/pr.js) so both paths resolve identically.
+    const { provider: selectedProvider, model: selectedModel } = resolveProviderModel(req, {
+      requestProvider,
+      requestModel,
+      repoSettings
+    });
 
     // Get repo instructions from settings
     const repoInstructions = repoSettings?.default_instructions || null;

package/src/routes/pr.js

@@ -27,6 +27,7 @@ const { v4: uuidv4 } = require('uuid');
 const fs = require('fs').promises;
 const path = require('path');
 const { resolveHostBinding, resolveBindingRepositoryFromPR, getWorktreeDisplayName, resolveLoadSkills, buildCouncilProviderOverrides, getRepoSkipBulkFetch, getSummaryEnabled, getTourEnabled } = require('../config');
+const { storedHostToOption, isDualHostRepo } = require('../utils/host-resolution');
 const { resolveHostName } = require('../links/repo-links');
 const { backgroundQueue } = require('../ai/background-queue');
 const logger = require('../utils/logger');
@@ -42,7 +43,7 @@ const tourGenerator = require('../ai/tour-generator');
 const {
   activeAnalyses,
   reviewToAnalysisId,
-  getModel,
+  resolveProviderModel,
   determineCompletionInfo,
   broadcastProgress,
   createProgressCallback,
@@ -130,12 +131,12 @@ module.exports._attachHunkHashes = attachHunkHashes;
  *
  * @param {import('express').Request} req
  * @param {string} repository - "owner/repo" identifier
- * @returns {{ binding: {apiHost: string|null, token: string, features: Object, source: string}, token: string }|null}
+ * @returns {Promise<{ binding: {apiHost: string|null, host: string|null, token: string, features: Object, source: string}, token: string, bindingRepository: string }|null>}
  *   `null` when no token can be resolved AND the repo is github.com (so
  *   callers can fall through to optional behaviour). Throws for alt-host
- *   misconfiguration.
+ *   misconfiguration and for a stale stored host that no longer matches config.
  */
-function resolveBindingForRequest(req, repository) {
+async function resolveBindingForRequest(req, repository) {
   const config = req.app.get('config') || {};
   // `repository` here is the PR-identity `${owner}/${repo}`. For
   // monorepo-style configs the binding-key in `config.repos` can differ;
@@ -143,7 +144,23 @@ function resolveBindingForRequest(req, repository) {
   // the host binding so per-repo tokens/api_host/features apply.
   const [owner, repo] = String(repository).split('/');
   const bindingRepository = resolveBindingRepositoryFromPR(owner, repo, config);
-  const binding = resolveHostBinding(bindingRepository, config);
+
+  // PR-aware host resolution. Every caller is an `/:owner/:repo/:number` route,
+  // so a per-PR host may already be stored. When a pr_metadata row exists, bind
+  // to its stored host (github for NULL, the api_host string for an alt host);
+  // when no row exists, fall back to the ambiguity rule (two-arg resolve). A
+  // stale stored host (config changed) makes resolveHostBinding throw — that
+  // surfaces to the route's error handler as a clear failure rather than a
+  // silent bind to a dead host.
+  const prNumber = parseInt(req.params && req.params.number, 10);
+  let hostOptions;
+  if (Number.isInteger(prNumber) && prNumber > 0) {
+    const prMetadataRepo = new PRMetadataRepository(req.app.get('db'));
+    const storedHost = await prMetadataRepo.getPRHost(repository, prNumber);
+    // Apply the legacy-NULL back-compat convention (see storedHostToOption).
+    hostOptions = storedHostToOption(config, bindingRepository, storedHost);
+  }
+  const binding = resolveHostBinding(bindingRepository, config, hostOptions || {});
   if (binding.token) {
     return { binding, token: binding.token, bindingRepository };
   }
@@ -343,7 +360,7 @@ router.get('/api/pr/:owner/:repo/:number', async (req, res) => {
     {
       let resolved = null;
       try {
-        resolved = resolveBindingForRequest(req, repository);
+        resolved = await resolveBindingForRequest(req, repository);
       } catch (configErr) {
         // Alt-host repo with no token configured — surface the message
         // but don't fail the GET (draft info is supplementary).
@@ -383,7 +400,7 @@ router.get('/api/pr/:owner/:repo/:number', async (req, res) => {
     {
       let resolved = null;
       try {
-        resolved = resolveBindingForRequest(req, repository);
+        resolved = await resolveBindingForRequest(req, repository);
       } catch (configErr) {
         logger.warn(configErr.message);
       }
@@ -542,7 +559,7 @@ router.post('/api/pr/:owner/:repo/:number/refresh', async (req, res) => {
     // Resolve host binding for this repo (validates alt-host token presence).
     let binding;
     try {
-      const resolved = resolveBindingForRequest(req, repository);
+      const resolved = await resolveBindingForRequest(req, repository);
       if (!resolved) {
         return res.status(401).json({ error: 'GitHub token not configured' });
       }
@@ -653,7 +670,7 @@ router.post('/api/pr/:owner/:repo/:number/refresh', async (req, res) => {
     {
       let resolved = null;
       try {
-        resolved = resolveBindingForRequest(req, repository);
+        resolved = await resolveBindingForRequest(req, repository);
       } catch (configErr) {
         logger.warn(configErr.message);
       }
@@ -915,7 +932,7 @@ router.get('/api/pr/:owner/:repo/:number/check-stale', async (req, res) => {
     // Fetch current PR from GitHub
     let binding;
     try {
-      const resolved = resolveBindingForRequest(req, repository);
+      const resolved = await resolveBindingForRequest(req, repository);
       if (!resolved) {
         return res.json({ isStale: null, error: 'GitHub token not configured' });
       }
@@ -987,7 +1004,7 @@ router.get('/api/pr/:owner/:repo/:number/github-drafts', async (req, res) => {
     // Initialize GitHub client and check for pending drafts on GitHub
     let binding;
     try {
-      const resolved = resolveBindingForRequest(req, repository);
+      const resolved = await resolveBindingForRequest(req, repository);
       if (!resolved) {
         return res.status(500).json({
           error: 'GitHub token not configured. Please check your ~/.pair-review/config.json'
@@ -1467,7 +1484,7 @@ router.post('/api/pr/:owner/:repo/:number/submit-review', async (req, res) => {
     // Resolve host binding (repo-aware: alt-host repos require their own token).
     let binding;
     try {
-      const resolved = resolveBindingForRequest(req, repository);
+      const resolved = await resolveBindingForRequest(req, repository);
       if (!resolved) {
         return res.status(500).json({
           error: 'GitHub token not configured. Please check your ~/.pair-review/config.json'
@@ -1747,9 +1764,12 @@ router.post('/api/pr/:owner/:repo/:number/submit-review', async (req, res) => {
       // Send success response after all database operations complete.
       // Use the configured remote-host display name (e.g. "Meteorite")
       // instead of the literal "GitHub". Resolve via the binding repository
-      // so monorepo url_pattern configs map to the right repos[...] entry.
+      // so monorepo url_pattern configs map to the right repos[...] entry, and
+      // pass the PR's resolved host (`binding.host`: null=github, api_host
+      // string=alt) so a dual-host repo names the system this PR was submitted
+      // to rather than its repo-level default.
       const cfg = req.app.get('config') || {};
-      const hostName = resolveHostName(cfg, resolveBindingRepositoryFromPR(owner, repo, cfg));
+      const hostName = resolveHostName(cfg, resolveBindingRepositoryFromPR(owner, repo, cfg), binding.host);
       res.json({
         success: true,
         message: `${event === 'DRAFT' ? 'Draft review created' : 'Review submitted'} successfully ${event === 'DRAFT' ? 'on' : 'to'} ${hostName}`,
@@ -1946,11 +1966,28 @@ router.post('/api/parse-pr-url', (req, res) => {
   const result = parser.parsePRUrl(url);
 
   if (result) {
+    // Report whether the resolved repo is DUAL (github + alt-host). A github URL
+    // (host === null) for a dual repo must be forwarded to setup as an explicit
+    // github pick (the "github" sentinel) so it does not probe alt-first; for a
+    // plain or exclusive repo the client omits host (no probe / avoids the
+    // exclusive-null throw). Resolve the binding key first (url_pattern match
+    // supplies it; otherwise derive from owner/repo).
+    const safeConfig = config || {};
+    const bindingRepository = result.bindingRepository
+      || resolveBindingRepositoryFromPR(result.owner, result.repo, safeConfig);
     return res.json({
       valid: true,
       owner: result.owner,
       repo: result.repo,
-      prNumber: result.number
+      prNumber: result.number,
+      // `host` tells the setup call which system the PR lives on: `null` =
+      // github.com (a github/graphite URL), an api_host URL string = that alt
+      // host (a `url_pattern` match), or absent when the parser could not tell.
+      // `bindingRepository` is the matched `repos[...]` config key (may differ
+      // from owner/repo for monorepo-style url_pattern configs).
+      host: result.host,
+      bindingRepository: result.bindingRepository,
+      isDualHost: isDualHostRepo(safeConfig, bindingRepository)
     });
   }
 
@@ -2067,7 +2104,7 @@ async function launchPrCouncilAnalysis(req, {
   // Build a GitHubClient for analyzer-side dedup pre-fetch (PR mode only).
   let councilGithubClient;
   try {
-    const resolved = resolveBindingForRequest(req, repository);
+    const resolved = await resolveBindingForRequest(req, repository);
     councilGithubClient = resolved ? new GitHubClient(resolved.binding) : undefined;
   } catch (configErr) {
     logger.warn(`Skipping GitHub dedup pre-fetch (council): ${configErr.message}`);
@@ -2190,7 +2227,7 @@ router.post('/api/pr/:owner/:repo/:number/analyses', async (req, res) => {
     // for github.com repos we fall back to the server-startup cached token.
     let analyzerGithubClient;
     try {
-      const resolved = resolveBindingForRequest(req, repository);
+      const resolved = await resolveBindingForRequest(req, repository);
       analyzerGithubClient = resolved ? new GitHubClient(resolved.binding) : undefined;
     } catch (configErr) {
       // Alt-host misconfiguration — skip dedup pre-fetch with a clear log.
@@ -2205,23 +2242,13 @@ router.post('/api/pr/:owner/:repo/:number/analyses', async (req, res) => {
       const repoSettingsRepo = new RepoSettingsRepository(db);
       const fetchedRepoSettings = await repoSettingsRepo.getRepoSettings(repository);
 
-      let selectedProvider;
-      if (requestProvider) {
-        selectedProvider = requestProvider;
-      } else if (fetchedRepoSettings && fetchedRepoSettings.default_provider) {
-        selectedProvider = fetchedRepoSettings.default_provider;
-      } else {
-        selectedProvider = appConfig.default_provider || appConfig.provider || 'claude';
-      }
-
-      let selectedModel;
-      if (requestModel) {
-        selectedModel = requestModel;
-      } else if (fetchedRepoSettings && fetchedRepoSettings.default_model) {
-        selectedModel = fetchedRepoSettings.default_model;
-      } else {
-        selectedModel = getModel(req);
-      }
+      // Resolve provider/model: request body > env/CLI > repo settings > config/legacy > default.
+      // Shared with the local route (src/routes/local.js) so both paths resolve identically.
+      const { provider: selectedProvider, model: selectedModel } = resolveProviderModel(req, {
+        requestProvider,
+        requestModel,
+        repoSettings: fetchedRepoSettings
+      });
 
       const fetchedRepoInstructions = fetchedRepoSettings?.default_instructions || null;
       const mergedInstructions = mergeInstructions({ globalInstructions, repoInstructions: fetchedRepoInstructions, requestInstructions });
@@ -2709,7 +2736,7 @@ router.get('/api/pr/:owner/:repo/:number/share', async (req, res) => {
     // an alt-host's `getAuthenticatedUser` resolves the user on that host.
     let sharedBy = null;
     try {
-      const resolved = resolveBindingForRequest(req, repository);
+      const resolved = await resolveBindingForRequest(req, repository);
       if (resolved) {
         const githubClient = new GitHubClient(resolved.binding);
         const user = await githubClient.getAuthenticatedUser();
@@ -2843,7 +2870,7 @@ router.get('/api/pr/:owner/:repo/:number/stack-info', async (req, res) => {
 
     let binding;
     try {
-      const resolved = resolveBindingForRequest(req, repository);
+      const resolved = await resolveBindingForRequest(req, repository);
       if (!resolved) {
         return res.json({ stack: [] });
       }

package/src/routes/setup.js

@@ -15,10 +15,12 @@ const crypto = require('crypto');
 const { activeSetups, broadcastSetupProgress } = require('./shared');
 const { setupPRReview } = require('../setup/pr-setup');
 const { setupLocalReview } = require('../setup/local-setup');
-const { getGitHubToken, expandPath, resolveBindingRepositoryFromPR } = require('../config');
+const { expandPath, resolveBindingRepositoryFromPR } = require('../config');
+const { resolvePreflightBinding } = require('../utils/host-resolution');
 const { queryOne, ReviewRepository } = require('../database');
 const { normalizeRepository } = require('../utils/paths');
 const { rejectUrlLikeLocalReviewPath } = require('../utils/local-path-input');
+const { parseScopeArg, VALID_SCOPE_RANGES } = require('../local-scope');
 const logger = require('../utils/logger');
 
 const router = express.Router();
@@ -60,18 +62,38 @@ router.post('/api/setup/pr/:owner/:repo/:number', async (req, res) => {
       return res.status(400).json({ error: 'Invalid owner, repo, or PR number' });
     }
 
+    // Optional per-PR host override. Contract: `null` = github.com, an api_host
+    // URL string = that alt host, absent/undefined = unknown (server derives via
+    // stored host or a probe). A dashboard row (alt-host PR) and a URL paste both
+    // send this so setup binds to the right system without probing. Reject other
+    // shapes; the "must match the repo's api_host" check is enforced downstream
+    // by resolveHostBinding (a mismatch surfaces as a setup error).
+    const bodyHost = req.body ? req.body.host : undefined;
+    if (bodyHost !== undefined && bodyHost !== null && typeof bodyHost !== 'string') {
+      return res.status(400).json({ error: 'Invalid host: expected null or an api_host URL string' });
+    }
+
     const db = req.app.get('db');
     const config = req.app.get('config');
 
-    // GitHub token is required for PR setup. Resolve the binding key
-    // first so monorepo-style `repos[...]` entries (matched via
-    // `url_pattern` named captures) supply their per-repo token even when
-    // the captured owner/repo differs from the config key.
+    // GitHub token is required for PR setup. Resolve the binding key first so
+    // monorepo-style `repos[...]` entries (matched via `url_pattern` named
+    // captures) supply their per-repo token even when the captured owner/repo
+    // differs from the config key.
     const repositoryForToken = resolveBindingRepositoryFromPR(owner, repo, config);
-    const githubToken = getGitHubToken(config, repositoryForToken);
-    if (!githubToken) {
+    // Preflight the credential. resolvePreflightBinding gates on ANY usable
+    // binding — including a dual repo's alt-only token or a token pinned by an
+    // explicit body host — so an alt-host setup isn't falsely 401'd.
+    const preflightBinding = resolvePreflightBinding(repositoryForToken, config, bodyHost);
+    if (!preflightBinding.token) {
       return res.status(401).json({ error: 'GitHub token not configured' });
     }
+    // Split the two roles: the gate above accepts an alt token, but only a
+    // github.com token may be forwarded downstream as the github FALLBACK.
+    // resolvePrHostBinding can drop `githubToken` into a github.com client on the
+    // 404 probe fallback (clientArgFor's github-flavored branch), so an alt token
+    // must NEVER reach it — the CLI (main.js) applies the identical guard.
+    const githubToken = preflightBinding.apiHost === null ? preflightBinding.token : '';
 
     // Concurrency guard: if a setup is already running for this PR, return its ID
     const setupKey = `pr:${owner}/${repo}/${prNumber}`;
@@ -149,6 +171,7 @@ router.post('/api/setup/pr/:owner/:repo/:number', async (req, res) => {
           githubToken,
           bindingRepository: repositoryForToken,
           config,
+          host: bodyHost,
           poolLifecycle: req.app.get('poolLifecycle'),
           restoreMetadata,
           onProgress: (progress) => {
@@ -186,7 +209,7 @@ router.post('/api/setup/pr/:owner/:repo/:number', async (req, res) => {
  */
 router.post('/api/setup/local', async (req, res) => {
   try {
-    const { path: rawPath } = req.body;
+    const { path: rawPath, scope: rawScope, base: rawBase } = req.body;
 
     if (!rawPath) {
       return res.status(400).json({ error: 'Missing required field: path' });
@@ -198,6 +221,37 @@ router.post('/api/setup/local', async (req, res) => {
       return res.status(400).json({ error: err.message });
     }
 
+    // Re-validate scope/base server-side — NEVER trust the delegated URL. Mirrors
+    // the CLI checks in main() so a delegated launch is held to the same contract.
+    let flags = {};
+    if (rawScope !== undefined && rawScope !== null && rawScope !== '') {
+      const parsed = parseScopeArg(rawScope);
+      if (!parsed) {
+        return res.status(400).json({
+          error: `Invalid scope value "${rawScope}". Valid ranges are: ${VALID_SCOPE_RANGES.join(', ')}. ` +
+            "The range must be two stops joined by '..' and must include 'unstaged'."
+        });
+      }
+      flags.scope = rawScope;
+      if (rawBase !== undefined && rawBase !== null && rawBase !== '') {
+        // --base only applies to a branch-relative scope, and must be a safe branch name.
+        if (parsed.start !== 'branch') {
+          return res.status(400).json({
+            error: "base requires a branch-relative scope (starting at 'branch', e.g. branch..untracked)."
+          });
+        }
+        if (!/^[\w.\-/]+$/.test(rawBase)) {
+          return res.status(400).json({ error: `Invalid base branch name "${rawBase}".` });
+        }
+        flags.base = rawBase;
+      }
+    } else if (rawBase !== undefined && rawBase !== null && rawBase !== '') {
+      // base without scope is meaningless (mirrors main()'s "base requires branch scope").
+      return res.status(400).json({
+        error: "base requires a branch-relative scope (starting at 'branch', e.g. branch..untracked)."
+      });
+    }
+
     const targetPath = expandPath(rawPath);
     const db = req.app.get('db');
 
@@ -216,6 +270,7 @@ router.post('/api/setup/local', async (req, res) => {
           db,
           targetPath,
           config: req.app.get('config') || {},
+          flags,
           onProgress: (progress) => {
             sendSetupEvent(setupId, 'step', progress);
           }