@in-the-loop-labs/pair-review 4.0.0 → 4.1.0

package/public/js/local.js

@@ -70,9 +70,17 @@ class LocalManager {
     await this.loadLocalReview();
 
     // Auto-trigger analysis if ?analyze=true is present
-    const autoAnalyze = new URLSearchParams(window.location.search).get('analyze');
+    const searchParams = new URLSearchParams(window.location.search);
+    const autoAnalyze = searchParams.get('analyze');
     if (autoAnalyze === 'true' && !window.prManager.isAnalyzing) {
       const manager = window.prManager;
+      // Provider/model override carried on the URL by single-port delegation
+      // (the delegated-to server is a different process whose env never saw the
+      // CLI flag). Prepended ahead of repo settings in _buildDefaultAnalysisConfig.
+      const urlOverride = {
+        provider: searchParams.get('provider'),
+        model: searchParams.get('model')
+      };
       try {
         // Prefer a stashed bulk-analysis config (threaded via analysisConfigId).
         // The CLI uses it to carry --instructions plus the resolved
@@ -97,15 +105,15 @@ class LocalManager {
             manager.fetchLastReviewSettings().catch(() => ({ custom_instructions: '', last_council_id: null })),
             manager._getAppConfig()
           ]);
-          config = await manager._buildDefaultAnalysisConfig(repoSettings, reviewSettings, appConfig);
+          config = await manager._buildDefaultAnalysisConfig(repoSettings, reviewSettings, appConfig, null, urlOverride);
         }
 
         await this.startLocalAnalysis(null, config);
       } finally {
         const cleanUrl = new URL(window.location);
-        cleanUrl.searchParams.delete('analyze');
-        cleanUrl.searchParams.delete('analysisConfigId');
-        cleanUrl.searchParams.delete('council');
+        // Strip the whole auto-analyze intent bundle (analyze/analysisConfigId/
+        // council/provider/model) so a manual refresh does not replay the intent.
+        window.stripAnalyzeParams(cleanUrl);
         history.replaceState(null, '', cleanUrl);
       }
     }
@@ -348,11 +356,13 @@ class LocalManager {
         // Resolve provider and model as a MATCHED pair so the council/advanced tabs
         // are never seeded with a cross-provider model (e.g. antigravity + opus), which
         // would blank the model <select> and be rejected by the backend.
+        // buildProviderModelScopes prepends any CLI/env override ahead of repo
+        // settings so `--provider` seeds the modal as the default selection.
         const providersInfo = await manager._getProvidersInfo();
-        const { provider: currentProvider, model: currentModel } = window.resolveProviderModelPair([
-          { provider: repoSettings?.default_provider, model: repoSettings?.default_model },
-          { provider: appConfig.default_provider, model: appConfig.default_model }
-        ], providersInfo);
+        const { provider: currentProvider, model: currentModel } = window.resolveProviderModelPair(
+          window.buildProviderModelScopes(repoSettings, appConfig),
+          providersInfo
+        );
 
         // Determine default tab (priority: localStorage > repo settings > 'single')
         const tabStorageKey = `pair-review-tab:local-${reviewId}`;

package/public/js/pr.js

@@ -634,7 +634,7 @@ class PRManager {
    * @param {Object} reviewSettings - Review settings from fetchLastReviewSettings()
    * @returns {Promise<Object>} Config object suitable for startAnalysis / startLocalAnalysis
    */
-  async _buildDefaultAnalysisConfig(repoSettings, reviewSettings, appConfig = {}, providersInfo = null) {
+  async _buildDefaultAnalysisConfig(repoSettings, reviewSettings, appConfig = {}, providersInfo = null, urlOverride = null) {
     const defaultTab = repoSettings?.default_tab || 'single';
     const councilId = repoSettings?.default_council_id || reviewSettings?.last_council_id || null;
 
@@ -642,6 +642,8 @@ class PRManager {
     // highest priority for council selection. When present we force the council
     // branch regardless of default_tab/settings, and derive configType from the
     // council's own type ('council' or 'advanced') rather than the repo default.
+    // An explicit council outranks a provider/model override here, matching the
+    // backend precedence in resolveReviewConfig where --council beats --provider.
     const urlSearch = (typeof window !== 'undefined' && window.location && window.location.search) || '';
     const urlCouncilId = new URLSearchParams(urlSearch).get('council');
     if (urlCouncilId) {
@@ -676,7 +678,14 @@ class PRManager {
       }
     }
 
-    if ((defaultTab === 'council' || defaultTab === 'advanced') && councilId) {
+    // A CLI/env or delegation-URL provider/model override names a single
+    // provider, which is incompatible with a multi-voice council. When an
+    // override is active we bypass the repo's *default* council and force the
+    // single-provider path so `--provider` is always honored. (An explicit
+    // `?council=` above still wins, matching the backend precedence.)
+    const overrideActive = window.hasProviderModelOverride(appConfig, urlOverride);
+
+    if (!overrideActive && (defaultTab === 'council' || defaultTab === 'advanced') && councilId) {
       // Fetch the full council config so the progress modal can render correctly
       let councilConfig = null;
       let councilName = null;
@@ -705,11 +714,13 @@ class PRManager {
     // independently (repo || app || hardcoded) can mix a provider from one
     // scope with a model from another, yielding an invalid pair (e.g.
     // antigravity/opus) that startAnalysis would forward to the backend as-is.
+    // buildProviderModelScopes prepends any CLI/env or delegation-URL override
+    // ahead of repo settings so `--provider` outranks a repo's saved default.
     const providers = providersInfo || await this._getProvidersInfo();
-    const { provider, model } = window.resolveProviderModelPair([
-      { provider: repoSettings?.default_provider, model: repoSettings?.default_model },
-      { provider: appConfig.default_provider, model: appConfig.default_model }
-    ], providers);
+    const { provider, model } = window.resolveProviderModelPair(
+      window.buildProviderModelScopes(repoSettings, appConfig, urlOverride),
+      providers
+    );
 
     return {
       provider,
@@ -750,10 +761,18 @@ class PRManager {
    * @param {number} prNumber - PR number
    */
   async _maybeAutoAnalyze(owner, repo, prNumber) {
-    const autoAnalyze = new URLSearchParams(window.location.search).get('analyze');
+    const searchParams = new URLSearchParams(window.location.search);
+    const autoAnalyze = searchParams.get('analyze');
     if (autoAnalyze === 'true' && !this.isAnalyzing) {
       this._autoAnalyzeRequested = true;
       let shouldCleanUrl = true;
+      // Provider/model override carried on the URL by single-port delegation
+      // (the delegated-to server is a different process whose env never saw the
+      // CLI flag). Prepended ahead of repo settings in _buildDefaultAnalysisConfig.
+      const urlOverride = {
+        provider: searchParams.get('provider'),
+        model: searchParams.get('model')
+      };
       try {
         // Skip refresh if we just loaded fresh data (loadPR sets _justLoaded = true).
         // Otherwise, refresh to ensure we have the latest PR data in case the worktree
@@ -791,7 +810,7 @@ class PRManager {
             this.fetchLastReviewSettings().catch(() => ({ custom_instructions: '', last_council_id: null })),
             this._getAppConfig()
           ]);
-          config = await this._buildDefaultAnalysisConfig(repoSettings, reviewSettings, appConfig);
+          config = await this._buildDefaultAnalysisConfig(repoSettings, reviewSettings, appConfig, null, urlOverride);
         }
 
         await this.startAnalysis(owner, repo, prNumber, null, config);
@@ -799,9 +818,9 @@ class PRManager {
         this._autoAnalyzeRequested = false;
         if (shouldCleanUrl) {
           const cleanUrl = new URL(window.location);
-          cleanUrl.searchParams.delete('analyze');
-          cleanUrl.searchParams.delete('analysisConfigId');
-          cleanUrl.searchParams.delete('council');
+          // Strip the whole auto-analyze intent bundle (analyze/analysisConfigId/
+          // council/provider/model) so a manual refresh does not replay the intent.
+          window.stripAnalyzeParams(cleanUrl);
           history.replaceState(null, '', cleanUrl);
         }
       }
@@ -3055,11 +3074,13 @@ class PRManager {
       // Resolve provider and model as a MATCHED pair so the council/advanced tabs
       // are never seeded with a cross-provider model (e.g. antigravity + opus), which
       // would blank the model <select> and be rejected by the backend.
+      // buildProviderModelScopes prepends any CLI/env override ahead of repo
+      // settings so `--provider` seeds the modal as the default selection.
       const providersInfo = await this._getProvidersInfo();
-      const { provider: currentProvider, model: currentModel } = window.resolveProviderModelPair([
-        { provider: repoSettings?.default_provider, model: repoSettings?.default_model },
-        { provider: appConfig.default_provider, model: appConfig.default_model }
-      ], providersInfo);
+      const { provider: currentProvider, model: currentModel } = window.resolveProviderModelPair(
+        window.buildProviderModelScopes(repoSettings, appConfig),
+        providersInfo
+      );
       const tabStorageKey = PRManager.getRepoStorageKey('pair-review-tab', owner, repo);
       const rememberedTab = localStorage.getItem(tabStorageKey);
       const defaultTab = rememberedTab || repoSettings?.default_tab || 'single';
@@ -6848,11 +6869,13 @@ class PRManager {
       // Resolve provider and model as a MATCHED pair so the council/advanced tabs
       // are never seeded with a cross-provider model (e.g. antigravity + opus), which
       // would blank the model <select> and be rejected by the backend.
+      // buildProviderModelScopes prepends any CLI/env override ahead of repo
+      // settings so `--provider` seeds the modal as the default selection.
       const providersInfo = await this._getProvidersInfo();
-      const { provider: currentProvider, model: currentModel } = window.resolveProviderModelPair([
-        { provider: repoSettings?.default_provider, model: repoSettings?.default_model },
-        { provider: appConfig.default_provider, model: appConfig.default_model }
-      ], providersInfo);
+      const { provider: currentProvider, model: currentModel } = window.resolveProviderModelPair(
+        window.buildProviderModelScopes(repoSettings, appConfig),
+        providersInfo
+      );
 
       // Determine default tab (priority: localStorage > repo settings > 'single')
       const tabStorageKey = PRManager.getRepoStorageKey('pair-review-tab', owner, repo);
@@ -7021,29 +7044,34 @@ class PRManager {
 
   /**
    * Build the worktree-not-found recovery URL. When the user arrived via
-   * auto-analyze (?analyze=true), the reload link preserves the auto-analyze
-   * state so analysis re-triggers after worktree setup. Both the
-   * `analysisConfigId` and `council` params are carried through, since
-   * `_buildDefaultAnalysisConfig()` treats `?council=<id>` as the
-   * highest-priority analysis source — dropping it would silently fall back to
-   * the repo/default analysis configuration on retry.
+   * auto-analyze (?analyze=true), the reload link preserves the whole
+   * auto-analyze intent bundle (analyze/analysisConfigId/council/provider/model)
+   * so analysis re-triggers with the same selection after worktree setup.
+   * Carrying is delegated to the shared `carryAnalyzeParams` relay so this
+   * hop stays in lockstep with the other three (see analyze-params.js);
+   * dropping `council` would silently fall back to the repo/default analysis
+   * config, and dropping `provider`/`model` would lose a `--provider` override.
    * @param {string} owner - Repository owner
    * @param {string} repo - Repository name
    * @param {number} number - PR number
    * @returns {string} The recovery URL (unescaped)
    */
   _buildWorktreeRecoveryUrl(owner, repo, number) {
-    let setupUrl = `/pr/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/${encodeURIComponent(number)}`;
+    // A fixed base is fine — only pathname + search are used for the link, so
+    // the origin is irrelevant (and this avoids depending on window.location).
+    const setupUrl = new URL(
+      `/pr/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/${encodeURIComponent(number)}`,
+      'http://localhost'
+    );
     if (this._autoAnalyzeRequested) {
-      const currentParams = new URLSearchParams(window.location.search);
-      const params = new URLSearchParams({ analyze: 'true' });
-      const analysisConfigId = currentParams.get('analysisConfigId');
-      const councilId = currentParams.get('council');
-      if (analysisConfigId) params.set('analysisConfigId', analysisConfigId);
-      if (councilId) params.set('council', councilId);
-      setupUrl += `?${params.toString()}`;
+      // The current search still carries the bundle here — it isn't stripped
+      // until _maybeAutoAnalyze's finally block, which runs after this handler.
+      // Force analyze=true so the retry still auto-triggers even if the source
+      // somehow lost it, then carry the rest of the bundle via the shared relay.
+      setupUrl.searchParams.set('analyze', 'true');
+      window.carryAnalyzeParams(window.location.search, setupUrl);
     }
-    return setupUrl;
+    return setupUrl.pathname + setupUrl.search;
   }
 
   /**
@@ -7055,14 +7083,14 @@ class PRManager {
    * @param {number} number - PR number
    */
   showWorktreeNotFoundError(owner, repo, number) {
-    const setupUrl = this._buildWorktreeRecoveryUrl(owner, repo, number);
+    const href = this._buildWorktreeRecoveryUrl(owner, repo, number);
     const container = document.getElementById('pr-container');
     if (container) {
       container.innerHTML = `
         <div class="error-container">
           <div class="error-icon">Warning</div>
           <div class="error-message">Worktree not found. Please reload the PR to set up the worktree before running analysis.</div>
-          <a class="btn btn-primary" href="${this.escapeHtml(setupUrl)}">Reload PR</a>
+          <a class="btn btn-primary" href="${this.escapeHtml(href)}">Reload PR</a>
         </div>
       `;
       container.style.display = 'block';

package/public/js/repo-links.js

@@ -246,9 +246,17 @@
     _currentLinks = null;
     _currentContext = context || null;
     try {
-      const response = await fetch(
-        '/api/repos/' + encodeURIComponent(owner) + '/' + encodeURIComponent(repo) + '/links'
-      );
+      // Pass the PR number (when known) so the server can resolve the link set
+      // against this PR's host for a dual-host repo (github links for a
+      // github-hosted PR, the external link for an alt-hosted one). Local mode
+      // has no PR number, so the query is omitted and the server returns the
+      // repo-level default.
+      let url = '/api/repos/' + encodeURIComponent(owner) + '/' + encodeURIComponent(repo) + '/links';
+      const number = context && context.number;
+      if (number !== undefined && number !== null && number !== '') {
+        url += '?number=' + encodeURIComponent(String(number));
+      }
+      const response = await fetch(url);
       if (!response.ok) {
         console.warn('[repo-links] Failed to fetch repo links:', response.status);
         return;

package/public/js/utils/analyze-params.js

@@ -0,0 +1,69 @@
+// Copyright 2026 Tim Perkins (tjwp) | SPDX-License-Identifier: Apache-2.0
+/**
+ * Shared "auto-analyze intent" URL-param relay.
+ *
+ * The params `analyze`, `analysisConfigId`, `council`, `provider`, and `model`
+ * form a single bundle that must travel TOGETHER through every browser hop
+ * between the single-port delegation URL and the review page that consumes them:
+ *
+ *   delegation URL → setup.html redirect(s) → review page auto-analyze
+ *   review page → "Reload PR" retry → setup.html → review page auto-analyze
+ *
+ * Each hop used to cherry-pick fields by name, so any hop that forgot one
+ * silently dropped it — which is exactly how a delegated `--provider` override
+ * got lost on its way to the running server (and how a `--council` selection
+ * would drop on the "Reload PR" retry). Centralizing the bundle here means
+ * adding a new intent param later is a one-line edit in ONE place instead of a
+ * fresh bug at every call site.
+ *
+ * Note: setup-internal params (e.g. `path`, consumed by the local-mode setup
+ * POST) are deliberately NOT in the bundle, so they never leak onto the review
+ * page URL.
+ */
+const ANALYZE_PARAM_KEYS = ['analyze', 'analysisConfigId', 'council', 'provider', 'model'];
+
+/**
+ * Copy the auto-analyze intent bundle from a source query onto a target URL.
+ * Only non-empty values present in the source are copied; other params already
+ * on `toUrl` are left untouched.
+ *
+ * @param {URLSearchParams|string} fromSearch - source query (e.g. window.location.search)
+ * @param {URL} toUrl - destination URL object, mutated in place
+ * @returns {URL} the same `toUrl`, for chaining
+ */
+function carryAnalyzeParams(fromSearch, toUrl) {
+  if (!toUrl) return toUrl;
+  const src = typeof fromSearch === 'string' ? new URLSearchParams(fromSearch) : fromSearch;
+  if (!src || typeof src.get !== 'function') return toUrl;
+  for (const key of ANALYZE_PARAM_KEYS) {
+    const value = src.get(key);
+    if (value !== null && value !== '') {
+      toUrl.searchParams.set(key, value);
+    }
+  }
+  return toUrl;
+}
+
+/**
+ * Delete the auto-analyze intent bundle from a URL. Used by the consumer after
+ * it acts on the intent, so a manual page refresh does not replay it.
+ *
+ * @param {URL} url - URL object, mutated in place
+ * @returns {URL} the same `url`, for chaining
+ */
+function stripAnalyzeParams(url) {
+  if (!url) return url;
+  for (const key of ANALYZE_PARAM_KEYS) {
+    url.searchParams.delete(key);
+  }
+  return url;
+}
+
+if (typeof window !== 'undefined') {
+  window.carryAnalyzeParams = carryAnalyzeParams;
+  window.stripAnalyzeParams = stripAnalyzeParams;
+}
+
+if (typeof module !== 'undefined' && module.exports) {
+  module.exports = { carryAnalyzeParams, stripAnalyzeParams, ANALYZE_PARAM_KEYS };
+}

package/public/js/utils/provider-model.js

@@ -86,10 +86,75 @@ function resolveProviderModelPair(scopes, providersInfo) {
   return { provider: 'claude', model: providerDefaultModel(claude) };
 }
 
+/**
+ * Build the ordered scope list for resolveProviderModelPair, injecting the
+ * CLI/env override AHEAD of saved repo settings.
+ *
+ * The override must outrank repo settings to honor the documented
+ * `CLI/env > repo settings` contract. Folding the override into appConfig's
+ * default_provider/default_model alone is NOT enough: every seed site passes
+ * repoSettings first, so an env-aware appConfig would still lose to a repo's
+ * saved default. Prepending the override scope is the only correct fix.
+ *
+ * Two override channels, highest precedence first:
+ *   1. `extraOverride` — a per-invocation override carried on the auto-analyze
+ *      URL (single-port delegation: the flag can only reach the already-running
+ *      server through the URL).
+ *   2. `appConfig.provider_override` / `appConfig.model_override` — the
+ *      PAIR_REVIEW_PROVIDER / PAIR_REVIEW_MODEL env override surfaced by
+ *      /api/config, for the process that actually received the CLI flag.
+ *
+ * A provider-only override (`{ provider: 'codex', model: null }`) resolves via
+ * resolveProviderModelPair to codex + codex's own default model, matching CLI
+ * semantics where `--provider codex` alone pins the provider.
+ *
+ * @param {Object} repoSettings - saved repo settings row (may be null)
+ * @param {Object} [appConfig] - /api/config response (or __pairReview-shaped equivalent)
+ * @param {{provider?: string, model?: string}} [extraOverride] - per-invocation override (URL params)
+ * @returns {Array<{provider?: string, model?: string}>} ordered scopes for resolveProviderModelPair
+ */
+function buildProviderModelScopes(repoSettings, appConfig = {}, extraOverride = null) {
+  const cfg = appConfig || {};
+  const scopes = [];
+  // 1. Per-invocation override (delegation URL params) — highest precedence.
+  if (extraOverride && (extraOverride.provider || extraOverride.model)) {
+    scopes.push({ provider: extraOverride.provider || null, model: extraOverride.model || null });
+  }
+  // 2. CLI/env override surfaced by /api/config (non-delegated invocations).
+  if (cfg.provider_override || cfg.model_override) {
+    scopes.push({ provider: cfg.provider_override || null, model: cfg.model_override || null });
+  }
+  // 3. Saved repo settings.
+  scopes.push({ provider: repoSettings?.default_provider, model: repoSettings?.default_model });
+  // 4. App/config defaults.
+  scopes.push({ provider: cfg.default_provider, model: cfg.default_model });
+  return scopes;
+}
+
+/**
+ * Whether a CLI/env provider-or-model override is active (from either channel).
+ * Used to decide whether auto-analyze should bypass a council default and force
+ * the single-provider path (a single-provider override is incompatible with a
+ * multi-voice council).
+ *
+ * @param {Object} [appConfig] - /api/config response (or __pairReview-shaped equivalent)
+ * @param {{provider?: string, model?: string}} [extraOverride] - per-invocation override (URL params)
+ * @returns {boolean}
+ */
+function hasProviderModelOverride(appConfig = {}, extraOverride = null) {
+  const cfg = appConfig || {};
+  return !!(
+    (extraOverride && (extraOverride.provider || extraOverride.model)) ||
+    cfg.provider_override || cfg.model_override
+  );
+}
+
 if (typeof window !== 'undefined') {
   window.resolveProviderModelPair = resolveProviderModelPair;
+  window.buildProviderModelScopes = buildProviderModelScopes;
+  window.hasProviderModelOverride = hasProviderModelOverride;
 }
 
 if (typeof module !== 'undefined' && module.exports) {
-  module.exports = { resolveProviderModelPair };
+  module.exports = { resolveProviderModelPair, buildProviderModelScopes, hasProviderModelOverride };
 }