@in-the-loop-labs/pair-review 3.9.1 → 4.1.0

package/public/js/index.js

@@ -445,8 +445,14 @@
       ? ''
       : '<td class="col-author">' + authorDisplay + '</td>';
 
+    // `data-host` carries the alt-host api_host string for PRs that live on an
+    // alternate host; github.com rows have no host and render an empty
+    // attribute. The click handler threads it into the setup call so a dual
+    // repo's alt-host PR opens against the right system without re-probing.
+    var hostAttr = pr.host ? ' data-host="' + escapeHtml(pr.host) + '"' : '';
+
     return '' +
-      '<tr class="collection-pr-row" data-pr-url="' + escapeHtml(prUrl) + '" data-owner="' + escapeHtml(pr.owner) + '" data-repo="' + escapeHtml(pr.repo) + '" data-number="' + pr.number + '">' +
+      '<tr class="collection-pr-row" data-pr-url="' + escapeHtml(prUrl) + '" data-owner="' + escapeHtml(pr.owner) + '" data-repo="' + escapeHtml(pr.repo) + '" data-number="' + pr.number + '"' + hostAttr + '>' +
         '<td class="col-repo">' + escapeHtml(repoFull) + '</td>' +
         '<td class="col-pr"><span class="collection-pr-number">#' + pr.number + '</span></td>' +
         '<td class="col-title" title="' + escapeHtml(pr.title || '') + '">' + escapeHtml(pr.title || '') + '</td>' +
@@ -1293,7 +1299,14 @@
         return {
           owner: data.owner,
           repo: data.repo,
-          prNumber: data.prNumber
+          prNumber: data.prNumber,
+          // `host` tells setup which system the PR lives on: an api_host URL
+          // string = alt host, null = github.com, undefined = unknown.
+          host: data.host,
+          bindingRepository: data.bindingRepository,
+          // Whether the repo is dual (github + alt-host). Only dual repos probe,
+          // so only they need an explicit github pick when the URL is a github URL.
+          isDualHost: data.isDualHost
         };
       }
 
@@ -1343,7 +1356,22 @@
     // Navigate to the PR route which serves setup.html (with step-by-step progress)
     // for new PRs, or pr.html directly for PRs already in the database
     let href = '/pr/' + encodeURIComponent(parsed.owner) + '/' + encodeURIComponent(parsed.repo) + '/' + encodeURIComponent(parsed.prNumber);
-    if (analyze) href += '?analyze=true';
+    var params = new URLSearchParams();
+    if (analyze) params.set('analyze', 'true');
+    // Forward the parsed host so setup binds directly instead of probing:
+    //  - alt-host URL string → the api_host (setup binds that alt host)
+    //  - github URL (host === null) on a DUAL repo → the "github" sentinel, so
+    //    setup binds github.com instead of probing alt-first (which would fail
+    //    loudly if the alt host is down for a PR we KNOW is on github)
+    //  - anything else (plain/exclusive repo, unknown host) → omit; no probe
+    //    happens for those and omitting avoids the exclusive-null throw.
+    if (typeof parsed.host === 'string' && parsed.host) {
+      params.set('host', parsed.host);
+    } else if (parsed.host === null && parsed.isDualHost) {
+      params.set('host', 'github');
+    }
+    var qs = params.toString();
+    if (qs) href += '?' + qs;
     window.location.href = href;
   }
 
@@ -1385,6 +1413,11 @@
         window.__pairReview.chatProviders = chatProviders;
         window.__pairReview.defaultProvider = config.default_provider || 'claude';
         window.__pairReview.defaultModel = config.default_model || 'opus';
+        // CLI/env override (PAIR_REVIEW_PROVIDER / PAIR_REVIEW_MODEL) surfaced
+        // by /api/config. The bulk-analysis seed prepends these ahead of repo
+        // settings so a `--provider` override outranks a repo's saved default.
+        window.__pairReview.providerOverride = config.provider_override || null;
+        window.__pairReview.modelOverride = config.model_override || null;
         window.__pairReview.hasGithubToken = Boolean(config.has_github_token);
         window.__pairReview.enableGraphite = config.enable_graphite === true;
         window.__pairReview.chatSpinner = config.chat_spinner || 'dots';
@@ -1891,7 +1924,7 @@
    * Read selected collection rows as PR descriptors.
    * @param {Set} selectedIds - PR URLs (data-pr-url values)
    * @param {string} tbodyId - tbody element ID
-   * @returns {Array<{owner: string, repo: string, number: string, prUrl: string}>}
+   * @returns {Array<{owner: string, repo: string, number: string, prUrl: string, host: string|undefined}>}
    */
   function getSelectedCollectionRows(selectedIds, tbodyId) {
     var tbody = document.getElementById(tbodyId);
@@ -1908,7 +1941,11 @@
           owner: tr.dataset.owner,
           repo: tr.dataset.repo,
           number: tr.dataset.number,
-          prUrl: prUrl
+          prUrl: prUrl,
+          // Alt-host rows carry a host; github.com rows leave it undefined. The
+          // single-row click path threads this the same way (see the collection
+          // row click handler) so bulk-open binds to the right system too.
+          host: tr.dataset.host
         });
       }
     }
@@ -1917,7 +1954,14 @@
 
   function buildReviewUrlsFromRows(rows, query) {
     return rows.map(function (row) {
-      return '/pr/' + encodeURIComponent(row.owner) + '/' + encodeURIComponent(row.repo) + '/' + row.number + (query || '');
+      // Preserve any existing params (analyze / analysisConfigId) and append the
+      // alt host so setup opens the PR against the system it lives on instead of
+      // re-probing. github.com rows (no host) keep the URL unchanged.
+      var qs = query || '';
+      if (row.host) {
+        qs += (qs ? '&' : '?') + 'host=' + encodeURIComponent(row.host);
+      }
+      return '/pr/' + encodeURIComponent(row.owner) + '/' + encodeURIComponent(row.repo) + '/' + row.number + qs;
     });
   }
 
@@ -2000,10 +2044,18 @@
     };
 
     var providersInfo = await getBulkProvidersInfo();
-    var resolvedPair = window.resolveProviderModelPair([
-      { provider: repoSettings?.default_provider, model: repoSettings?.default_model },
-      { provider: window.__pairReview?.defaultProvider, model: window.__pairReview?.defaultModel }
-    ], providersInfo);
+    // Shape __pairReview into the appConfig fields buildProviderModelScopes reads
+    // so a CLI/env `--provider` override is prepended ahead of repo settings.
+    var bulkAppConfig = {
+      default_provider: window.__pairReview?.defaultProvider,
+      default_model: window.__pairReview?.defaultModel,
+      provider_override: window.__pairReview?.providerOverride || null,
+      model_override: window.__pairReview?.modelOverride || null
+    };
+    var resolvedPair = window.resolveProviderModelPair(
+      window.buildProviderModelScopes(repoSettings, bulkAppConfig),
+      providersInfo
+    );
 
     var config = await bulkAnalysisConfigModal.show({
       currentModel: resolvedPair.model,
@@ -2163,6 +2215,21 @@
         return;
       }
 
+      // Alt-host PR: we already know owner/repo/number and the host it lives
+      // on, so navigate straight to the PR route with the host as a query
+      // param (setup.html forwards it into the setup POST body). This bypasses
+      // the URL-parse round trip, which can't reliably recover the host from a
+      // pasted alt-host html_url. github.com rows (no host) keep the existing
+      // parse-and-submit flow below, byte-identical.
+      var rowHost = collectionRow.dataset.host;
+      if (rowHost) {
+        var o = encodeURIComponent(collectionRow.dataset.owner);
+        var r = encodeURIComponent(collectionRow.dataset.repo);
+        var n = encodeURIComponent(collectionRow.dataset.number);
+        window.location.href = '/pr/' + o + '/' + r + '/' + n + '?host=' + encodeURIComponent(rowHost);
+        return;
+      }
+
       var prUrl = collectionRow.dataset.prUrl;
       if (prUrl) {
         // Switch to PR tab to show loading state (do NOT persist to
@@ -2542,4 +2609,14 @@
   window.__pairReview = window.__pairReview || {};
   window.__pairReview.refreshAnalysisSpinners = fetchAndApplyActiveAnalyses;
 
+  // Test-only exports. In the browser `module` is undefined, so this is a
+  // no-op; under Vitest (CommonJS) it exposes the internal bulk-open helpers
+  // for direct unit testing rather than duplicating their logic in a test.
+  if (typeof module !== 'undefined' && module.exports) {
+    module.exports = {
+      buildReviewUrlsFromRows: buildReviewUrlsFromRows,
+      getSelectedCollectionRows: getSelectedCollectionRows
+    };
+  }
+
 })();

package/public/js/local.js

@@ -70,9 +70,17 @@ class LocalManager {
     await this.loadLocalReview();
 
     // Auto-trigger analysis if ?analyze=true is present
-    const autoAnalyze = new URLSearchParams(window.location.search).get('analyze');
+    const searchParams = new URLSearchParams(window.location.search);
+    const autoAnalyze = searchParams.get('analyze');
     if (autoAnalyze === 'true' && !window.prManager.isAnalyzing) {
       const manager = window.prManager;
+      // Provider/model override carried on the URL by single-port delegation
+      // (the delegated-to server is a different process whose env never saw the
+      // CLI flag). Prepended ahead of repo settings in _buildDefaultAnalysisConfig.
+      const urlOverride = {
+        provider: searchParams.get('provider'),
+        model: searchParams.get('model')
+      };
       try {
         // Prefer a stashed bulk-analysis config (threaded via analysisConfigId).
         // The CLI uses it to carry --instructions plus the resolved
@@ -97,15 +105,15 @@ class LocalManager {
             manager.fetchLastReviewSettings().catch(() => ({ custom_instructions: '', last_council_id: null })),
             manager._getAppConfig()
           ]);
-          config = await manager._buildDefaultAnalysisConfig(repoSettings, reviewSettings, appConfig);
+          config = await manager._buildDefaultAnalysisConfig(repoSettings, reviewSettings, appConfig, null, urlOverride);
         }
 
         await this.startLocalAnalysis(null, config);
       } finally {
         const cleanUrl = new URL(window.location);
-        cleanUrl.searchParams.delete('analyze');
-        cleanUrl.searchParams.delete('analysisConfigId');
-        cleanUrl.searchParams.delete('council');
+        // Strip the whole auto-analyze intent bundle (analyze/analysisConfigId/
+        // council/provider/model) so a manual refresh does not replay the intent.
+        window.stripAnalyzeParams(cleanUrl);
         history.replaceState(null, '', cleanUrl);
       }
     }
@@ -346,13 +354,15 @@ class LocalManager {
         const lastCouncilId = reviewSettings.last_council_id;
 
         // Resolve provider and model as a MATCHED pair so the council/advanced tabs
-        // are never seeded with a cross-provider model (e.g. gemini + opus), which
+        // are never seeded with a cross-provider model (e.g. antigravity + opus), which
         // would blank the model <select> and be rejected by the backend.
+        // buildProviderModelScopes prepends any CLI/env override ahead of repo
+        // settings so `--provider` seeds the modal as the default selection.
         const providersInfo = await manager._getProvidersInfo();
-        const { provider: currentProvider, model: currentModel } = window.resolveProviderModelPair([
-          { provider: repoSettings?.default_provider, model: repoSettings?.default_model },
-          { provider: appConfig.default_provider, model: appConfig.default_model }
-        ], providersInfo);
+        const { provider: currentProvider, model: currentModel } = window.resolveProviderModelPair(
+          window.buildProviderModelScopes(repoSettings, appConfig),
+          providersInfo
+        );
 
         // Determine default tab (priority: localStorage > repo settings > 'single')
         const tabStorageKey = `pair-review-tab:local-${reviewId}`;

package/public/js/pr.js

@@ -634,7 +634,7 @@ class PRManager {
    * @param {Object} reviewSettings - Review settings from fetchLastReviewSettings()
    * @returns {Promise<Object>} Config object suitable for startAnalysis / startLocalAnalysis
    */
-  async _buildDefaultAnalysisConfig(repoSettings, reviewSettings, appConfig = {}, providersInfo = null) {
+  async _buildDefaultAnalysisConfig(repoSettings, reviewSettings, appConfig = {}, providersInfo = null, urlOverride = null) {
     const defaultTab = repoSettings?.default_tab || 'single';
     const councilId = repoSettings?.default_council_id || reviewSettings?.last_council_id || null;
 
@@ -642,6 +642,8 @@ class PRManager {
     // highest priority for council selection. When present we force the council
     // branch regardless of default_tab/settings, and derive configType from the
     // council's own type ('council' or 'advanced') rather than the repo default.
+    // An explicit council outranks a provider/model override here, matching the
+    // backend precedence in resolveReviewConfig where --council beats --provider.
     const urlSearch = (typeof window !== 'undefined' && window.location && window.location.search) || '';
     const urlCouncilId = new URLSearchParams(urlSearch).get('council');
     if (urlCouncilId) {
@@ -676,7 +678,14 @@ class PRManager {
       }
     }
 
-    if ((defaultTab === 'council' || defaultTab === 'advanced') && councilId) {
+    // A CLI/env or delegation-URL provider/model override names a single
+    // provider, which is incompatible with a multi-voice council. When an
+    // override is active we bypass the repo's *default* council and force the
+    // single-provider path so `--provider` is always honored. (An explicit
+    // `?council=` above still wins, matching the backend precedence.)
+    const overrideActive = window.hasProviderModelOverride(appConfig, urlOverride);
+
+    if (!overrideActive && (defaultTab === 'council' || defaultTab === 'advanced') && councilId) {
       // Fetch the full council config so the progress modal can render correctly
       let councilConfig = null;
       let councilName = null;
@@ -704,12 +713,14 @@ class PRManager {
     // Resolve provider and model as a MATCHED pair. Resolving each half
     // independently (repo || app || hardcoded) can mix a provider from one
     // scope with a model from another, yielding an invalid pair (e.g.
-    // gemini/opus) that startAnalysis would forward to the backend as-is.
+    // antigravity/opus) that startAnalysis would forward to the backend as-is.
+    // buildProviderModelScopes prepends any CLI/env or delegation-URL override
+    // ahead of repo settings so `--provider` outranks a repo's saved default.
     const providers = providersInfo || await this._getProvidersInfo();
-    const { provider, model } = window.resolveProviderModelPair([
-      { provider: repoSettings?.default_provider, model: repoSettings?.default_model },
-      { provider: appConfig.default_provider, model: appConfig.default_model }
-    ], providers);
+    const { provider, model } = window.resolveProviderModelPair(
+      window.buildProviderModelScopes(repoSettings, appConfig, urlOverride),
+      providers
+    );
 
     return {
       provider,
@@ -750,10 +761,18 @@ class PRManager {
    * @param {number} prNumber - PR number
    */
   async _maybeAutoAnalyze(owner, repo, prNumber) {
-    const autoAnalyze = new URLSearchParams(window.location.search).get('analyze');
+    const searchParams = new URLSearchParams(window.location.search);
+    const autoAnalyze = searchParams.get('analyze');
     if (autoAnalyze === 'true' && !this.isAnalyzing) {
       this._autoAnalyzeRequested = true;
       let shouldCleanUrl = true;
+      // Provider/model override carried on the URL by single-port delegation
+      // (the delegated-to server is a different process whose env never saw the
+      // CLI flag). Prepended ahead of repo settings in _buildDefaultAnalysisConfig.
+      const urlOverride = {
+        provider: searchParams.get('provider'),
+        model: searchParams.get('model')
+      };
       try {
         // Skip refresh if we just loaded fresh data (loadPR sets _justLoaded = true).
         // Otherwise, refresh to ensure we have the latest PR data in case the worktree
@@ -791,7 +810,7 @@ class PRManager {
             this.fetchLastReviewSettings().catch(() => ({ custom_instructions: '', last_council_id: null })),
             this._getAppConfig()
           ]);
-          config = await this._buildDefaultAnalysisConfig(repoSettings, reviewSettings, appConfig);
+          config = await this._buildDefaultAnalysisConfig(repoSettings, reviewSettings, appConfig, null, urlOverride);
         }
 
         await this.startAnalysis(owner, repo, prNumber, null, config);
@@ -799,9 +818,9 @@ class PRManager {
         this._autoAnalyzeRequested = false;
         if (shouldCleanUrl) {
           const cleanUrl = new URL(window.location);
-          cleanUrl.searchParams.delete('analyze');
-          cleanUrl.searchParams.delete('analysisConfigId');
-          cleanUrl.searchParams.delete('council');
+          // Strip the whole auto-analyze intent bundle (analyze/analysisConfigId/
+          // council/provider/model) so a manual refresh does not replay the intent.
+          window.stripAnalyzeParams(cleanUrl);
           history.replaceState(null, '', cleanUrl);
         }
       }
@@ -3053,13 +3072,15 @@ class PRManager {
       ]);
 
       // Resolve provider and model as a MATCHED pair so the council/advanced tabs
-      // are never seeded with a cross-provider model (e.g. gemini + opus), which
+      // are never seeded with a cross-provider model (e.g. antigravity + opus), which
       // would blank the model <select> and be rejected by the backend.
+      // buildProviderModelScopes prepends any CLI/env override ahead of repo
+      // settings so `--provider` seeds the modal as the default selection.
       const providersInfo = await this._getProvidersInfo();
-      const { provider: currentProvider, model: currentModel } = window.resolveProviderModelPair([
-        { provider: repoSettings?.default_provider, model: repoSettings?.default_model },
-        { provider: appConfig.default_provider, model: appConfig.default_model }
-      ], providersInfo);
+      const { provider: currentProvider, model: currentModel } = window.resolveProviderModelPair(
+        window.buildProviderModelScopes(repoSettings, appConfig),
+        providersInfo
+      );
       const tabStorageKey = PRManager.getRepoStorageKey('pair-review-tab', owner, repo);
       const rememberedTab = localStorage.getItem(tabStorageKey);
       const defaultTab = rememberedTab || repoSettings?.default_tab || 'single';
@@ -6846,13 +6867,15 @@ class PRManager {
       const lastCouncilId = reviewSettings.last_council_id;
 
       // Resolve provider and model as a MATCHED pair so the council/advanced tabs
-      // are never seeded with a cross-provider model (e.g. gemini + opus), which
+      // are never seeded with a cross-provider model (e.g. antigravity + opus), which
       // would blank the model <select> and be rejected by the backend.
+      // buildProviderModelScopes prepends any CLI/env override ahead of repo
+      // settings so `--provider` seeds the modal as the default selection.
       const providersInfo = await this._getProvidersInfo();
-      const { provider: currentProvider, model: currentModel } = window.resolveProviderModelPair([
-        { provider: repoSettings?.default_provider, model: repoSettings?.default_model },
-        { provider: appConfig.default_provider, model: appConfig.default_model }
-      ], providersInfo);
+      const { provider: currentProvider, model: currentModel } = window.resolveProviderModelPair(
+        window.buildProviderModelScopes(repoSettings, appConfig),
+        providersInfo
+      );
 
       // Determine default tab (priority: localStorage > repo settings > 'single')
       const tabStorageKey = PRManager.getRepoStorageKey('pair-review-tab', owner, repo);
@@ -7021,29 +7044,34 @@ class PRManager {
 
   /**
    * Build the worktree-not-found recovery URL. When the user arrived via
-   * auto-analyze (?analyze=true), the reload link preserves the auto-analyze
-   * state so analysis re-triggers after worktree setup. Both the
-   * `analysisConfigId` and `council` params are carried through, since
-   * `_buildDefaultAnalysisConfig()` treats `?council=<id>` as the
-   * highest-priority analysis source — dropping it would silently fall back to
-   * the repo/default analysis configuration on retry.
+   * auto-analyze (?analyze=true), the reload link preserves the whole
+   * auto-analyze intent bundle (analyze/analysisConfigId/council/provider/model)
+   * so analysis re-triggers with the same selection after worktree setup.
+   * Carrying is delegated to the shared `carryAnalyzeParams` relay so this
+   * hop stays in lockstep with the other three (see analyze-params.js);
+   * dropping `council` would silently fall back to the repo/default analysis
+   * config, and dropping `provider`/`model` would lose a `--provider` override.
    * @param {string} owner - Repository owner
    * @param {string} repo - Repository name
    * @param {number} number - PR number
    * @returns {string} The recovery URL (unescaped)
    */
   _buildWorktreeRecoveryUrl(owner, repo, number) {
-    let setupUrl = `/pr/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/${encodeURIComponent(number)}`;
+    // A fixed base is fine — only pathname + search are used for the link, so
+    // the origin is irrelevant (and this avoids depending on window.location).
+    const setupUrl = new URL(
+      `/pr/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/${encodeURIComponent(number)}`,
+      'http://localhost'
+    );
     if (this._autoAnalyzeRequested) {
-      const currentParams = new URLSearchParams(window.location.search);
-      const params = new URLSearchParams({ analyze: 'true' });
-      const analysisConfigId = currentParams.get('analysisConfigId');
-      const councilId = currentParams.get('council');
-      if (analysisConfigId) params.set('analysisConfigId', analysisConfigId);
-      if (councilId) params.set('council', councilId);
-      setupUrl += `?${params.toString()}`;
+      // The current search still carries the bundle here — it isn't stripped
+      // until _maybeAutoAnalyze's finally block, which runs after this handler.
+      // Force analyze=true so the retry still auto-triggers even if the source
+      // somehow lost it, then carry the rest of the bundle via the shared relay.
+      setupUrl.searchParams.set('analyze', 'true');
+      window.carryAnalyzeParams(window.location.search, setupUrl);
     }
-    return setupUrl;
+    return setupUrl.pathname + setupUrl.search;
   }
 
   /**
@@ -7055,14 +7083,14 @@ class PRManager {
    * @param {number} number - PR number
    */
   showWorktreeNotFoundError(owner, repo, number) {
-    const setupUrl = this._buildWorktreeRecoveryUrl(owner, repo, number);
+    const href = this._buildWorktreeRecoveryUrl(owner, repo, number);
     const container = document.getElementById('pr-container');
     if (container) {
       container.innerHTML = `
         <div class="error-container">
           <div class="error-icon">Warning</div>
           <div class="error-message">Worktree not found. Please reload the PR to set up the worktree before running analysis.</div>
-          <a class="btn btn-primary" href="${this.escapeHtml(setupUrl)}">Reload PR</a>
+          <a class="btn btn-primary" href="${this.escapeHtml(href)}">Reload PR</a>
         </div>
       `;
       container.style.display = 'block';

package/public/js/repo-links.js

@@ -246,9 +246,17 @@
     _currentLinks = null;
     _currentContext = context || null;
     try {
-      const response = await fetch(
-        '/api/repos/' + encodeURIComponent(owner) + '/' + encodeURIComponent(repo) + '/links'
-      );
+      // Pass the PR number (when known) so the server can resolve the link set
+      // against this PR's host for a dual-host repo (github links for a
+      // github-hosted PR, the external link for an alt-hosted one). Local mode
+      // has no PR number, so the query is omitted and the server returns the
+      // repo-level default.
+      let url = '/api/repos/' + encodeURIComponent(owner) + '/' + encodeURIComponent(repo) + '/links';
+      const number = context && context.number;
+      if (number !== undefined && number !== null && number !== '') {
+        url += '?number=' + encodeURIComponent(String(number));
+      }
+      const response = await fetch(url);
       if (!response.ok) {
         console.warn('[repo-links] Failed to fetch repo links:', response.status);
         return;

package/public/js/utils/analyze-params.js

@@ -0,0 +1,69 @@
+// Copyright 2026 Tim Perkins (tjwp) | SPDX-License-Identifier: Apache-2.0
+/**
+ * Shared "auto-analyze intent" URL-param relay.
+ *
+ * The params `analyze`, `analysisConfigId`, `council`, `provider`, and `model`
+ * form a single bundle that must travel TOGETHER through every browser hop
+ * between the single-port delegation URL and the review page that consumes them:
+ *
+ *   delegation URL → setup.html redirect(s) → review page auto-analyze
+ *   review page → "Reload PR" retry → setup.html → review page auto-analyze
+ *
+ * Each hop used to cherry-pick fields by name, so any hop that forgot one
+ * silently dropped it — which is exactly how a delegated `--provider` override
+ * got lost on its way to the running server (and how a `--council` selection
+ * would drop on the "Reload PR" retry). Centralizing the bundle here means
+ * adding a new intent param later is a one-line edit in ONE place instead of a
+ * fresh bug at every call site.
+ *
+ * Note: setup-internal params (e.g. `path`, consumed by the local-mode setup
+ * POST) are deliberately NOT in the bundle, so they never leak onto the review
+ * page URL.
+ */
+const ANALYZE_PARAM_KEYS = ['analyze', 'analysisConfigId', 'council', 'provider', 'model'];
+
+/**
+ * Copy the auto-analyze intent bundle from a source query onto a target URL.
+ * Only non-empty values present in the source are copied; other params already
+ * on `toUrl` are left untouched.
+ *
+ * @param {URLSearchParams|string} fromSearch - source query (e.g. window.location.search)
+ * @param {URL} toUrl - destination URL object, mutated in place
+ * @returns {URL} the same `toUrl`, for chaining
+ */
+function carryAnalyzeParams(fromSearch, toUrl) {
+  if (!toUrl) return toUrl;
+  const src = typeof fromSearch === 'string' ? new URLSearchParams(fromSearch) : fromSearch;
+  if (!src || typeof src.get !== 'function') return toUrl;
+  for (const key of ANALYZE_PARAM_KEYS) {
+    const value = src.get(key);
+    if (value !== null && value !== '') {
+      toUrl.searchParams.set(key, value);
+    }
+  }
+  return toUrl;
+}
+
+/**
+ * Delete the auto-analyze intent bundle from a URL. Used by the consumer after
+ * it acts on the intent, so a manual page refresh does not replay it.
+ *
+ * @param {URL} url - URL object, mutated in place
+ * @returns {URL} the same `url`, for chaining
+ */
+function stripAnalyzeParams(url) {
+  if (!url) return url;
+  for (const key of ANALYZE_PARAM_KEYS) {
+    url.searchParams.delete(key);
+  }
+  return url;
+}
+
+if (typeof window !== 'undefined') {
+  window.carryAnalyzeParams = carryAnalyzeParams;
+  window.stripAnalyzeParams = stripAnalyzeParams;
+}
+
+if (typeof module !== 'undefined' && module.exports) {
+  module.exports = { carryAnalyzeParams, stripAnalyzeParams, ANALYZE_PARAM_KEYS };
+}

package/public/js/utils/provider-model.js

@@ -6,7 +6,7 @@
  * settings, then app config) and historically each half was resolved
  * independently with `repo || app || hardcoded`. When a scope overrides only
  * ONE half, the halves can come from different scopes and produce an invalid
- * pair such as `gemini` + `opus` (an Anthropic model). The modal then shows no
+ * pair such as `antigravity` + `opus` (an Anthropic model). The modal then shows no
  * selected model, and the non-modal auto-analyze path posts the broken pair
  * straight to the backend.
  *
@@ -86,10 +86,75 @@ function resolveProviderModelPair(scopes, providersInfo) {
   return { provider: 'claude', model: providerDefaultModel(claude) };
 }
 
+/**
+ * Build the ordered scope list for resolveProviderModelPair, injecting the
+ * CLI/env override AHEAD of saved repo settings.
+ *
+ * The override must outrank repo settings to honor the documented
+ * `CLI/env > repo settings` contract. Folding the override into appConfig's
+ * default_provider/default_model alone is NOT enough: every seed site passes
+ * repoSettings first, so an env-aware appConfig would still lose to a repo's
+ * saved default. Prepending the override scope is the only correct fix.
+ *
+ * Two override channels, highest precedence first:
+ *   1. `extraOverride` — a per-invocation override carried on the auto-analyze
+ *      URL (single-port delegation: the flag can only reach the already-running
+ *      server through the URL).
+ *   2. `appConfig.provider_override` / `appConfig.model_override` — the
+ *      PAIR_REVIEW_PROVIDER / PAIR_REVIEW_MODEL env override surfaced by
+ *      /api/config, for the process that actually received the CLI flag.
+ *
+ * A provider-only override (`{ provider: 'codex', model: null }`) resolves via
+ * resolveProviderModelPair to codex + codex's own default model, matching CLI
+ * semantics where `--provider codex` alone pins the provider.
+ *
+ * @param {Object} repoSettings - saved repo settings row (may be null)
+ * @param {Object} [appConfig] - /api/config response (or __pairReview-shaped equivalent)
+ * @param {{provider?: string, model?: string}} [extraOverride] - per-invocation override (URL params)
+ * @returns {Array<{provider?: string, model?: string}>} ordered scopes for resolveProviderModelPair
+ */
+function buildProviderModelScopes(repoSettings, appConfig = {}, extraOverride = null) {
+  const cfg = appConfig || {};
+  const scopes = [];
+  // 1. Per-invocation override (delegation URL params) — highest precedence.
+  if (extraOverride && (extraOverride.provider || extraOverride.model)) {
+    scopes.push({ provider: extraOverride.provider || null, model: extraOverride.model || null });
+  }
+  // 2. CLI/env override surfaced by /api/config (non-delegated invocations).
+  if (cfg.provider_override || cfg.model_override) {
+    scopes.push({ provider: cfg.provider_override || null, model: cfg.model_override || null });
+  }
+  // 3. Saved repo settings.
+  scopes.push({ provider: repoSettings?.default_provider, model: repoSettings?.default_model });
+  // 4. App/config defaults.
+  scopes.push({ provider: cfg.default_provider, model: cfg.default_model });
+  return scopes;
+}
+
+/**
+ * Whether a CLI/env provider-or-model override is active (from either channel).
+ * Used to decide whether auto-analyze should bypass a council default and force
+ * the single-provider path (a single-provider override is incompatible with a
+ * multi-voice council).
+ *
+ * @param {Object} [appConfig] - /api/config response (or __pairReview-shaped equivalent)
+ * @param {{provider?: string, model?: string}} [extraOverride] - per-invocation override (URL params)
+ * @returns {boolean}
+ */
+function hasProviderModelOverride(appConfig = {}, extraOverride = null) {
+  const cfg = appConfig || {};
+  return !!(
+    (extraOverride && (extraOverride.provider || extraOverride.model)) ||
+    cfg.provider_override || cfg.model_override
+  );
+}
+
 if (typeof window !== 'undefined') {
   window.resolveProviderModelPair = resolveProviderModelPair;
+  window.buildProviderModelScopes = buildProviderModelScopes;
+  window.hasProviderModelOverride = hasProviderModelOverride;
 }
 
 if (typeof module !== 'undefined' && module.exports) {
-  module.exports = { resolveProviderModelPair };
+  module.exports = { resolveProviderModelPair, buildProviderModelScopes, hasProviderModelOverride };
 }