@in-the-loop-labs/pair-review 4.0.0 → 4.1.0

package/src/main.js

@@ -1,7 +1,7 @@
 // Copyright 2026 Tim Perkins (tjwp) | SPDX-License-Identifier: Apache-2.0
 const fs = require('fs');
 const { v4: uuidv4 } = require('uuid');
-const { loadConfig, getConfigDir, getGitHubToken, resolveHostBinding, showWelcomeMessage, resolveDbName, resolveRepoOptions, resolvePoolConfig, getRepoResetScript, resolveLoadSkills, buildCouncilProviderOverrides } = require('./config');
+const { loadConfig, getConfigDir, showWelcomeMessage, resolveDbName, resolveRepoOptions, resolvePoolConfig, getRepoResetScript, resolveLoadSkills, buildCouncilProviderOverrides } = require('./config');
 const { initializeDatabase, run, queryOne, query, migrateExistingWorktrees, WorktreeRepository, ReviewRepository, RepoSettingsRepository, GitHubReviewRepository, WorktreePoolRepository, CouncilRepository, CommentRepository, AnalysisRunRepository } = require('./database');
 const { PRArgumentParser } = require('./github/parser');
 const { GitHubClient } = require('./github/client');
@@ -20,8 +20,9 @@ const { resolveReviewConfig } = require('./review-config');
 const { redirectConsoleToStderr } = require('./mcp-stdio');
 const { getChangedFiles } = require('./routes/executable-analysis');
 const { safeParseJson } = require('./utils/safe-parse-json');
-const { includesBranch } = require('./local-scope');
-const { storePRData, registerRepositoryLocation, findRepositoryPath } = require('./setup/pr-setup');
+const { includesBranch, parseScopeArg, VALID_SCOPE_RANGES } = require('./local-scope');
+const { storePRData, resolvePrHostBinding, registerRepositoryLocation, findRepositoryPath } = require('./setup/pr-setup');
+const { isDualHostRepo, resolvePreflightBinding, hostSetupParamValue } = require('./utils/host-resolution');
 const { fireReviewStartedHook } = require('./hooks/payloads');
 const { normalizeRepository, resolveRenamedFile, resolveRenamedFileOld } = require('./utils/paths');
 const { rejectUrlLikeLocalReviewPath } = require('./utils/local-path-input');
@@ -190,6 +191,21 @@ OPTIONS:
     -h, --help              Show this help message and exit
     -l, --local [path]      Review local uncommitted changes
                             Optional path defaults to current directory
+    --scope <start>..<end>  (Local mode only) Set the diff scope for the review.
+                            Stops, in order: branch, staged, unstaged, untracked.
+                            The range must include 'unstaged'. Valid ranges:
+                              branch..unstaged     committed+staged+unstaged vs merge-base
+                              branch..untracked    everything vs merge-base (incl. untracked)
+                              staged..unstaged     staged + unstaged vs HEAD
+                              staged..untracked    staged + unstaged + untracked vs HEAD
+                              unstaged..unstaged   only unstaged working-tree changes
+                              unstaged..untracked  unstaged + untracked (the default)
+                            Requires --local; cannot be used with a PR. The chosen
+                            scope is persisted so the web UI opens with it too.
+    --base <branch>         (Local mode only) Override base-branch detection for a
+                            branch-relative scope. Requires --scope starting at
+                            'branch' (e.g. --scope branch..untracked). Defaults to
+                            the persisted, then auto-detected, base branch.
     --mcp                   Start as an MCP stdio server for AI coding agents.
                             The web UI also starts for the human reviewer.
     --model <name>          Override the AI model. Claude Code is the default provider.
@@ -200,6 +216,13 @@ OPTIONS:
                                   sonnet-5-high, sonnet-4.6
                             (opus is Opus 4.8 XHigh, the default)
                             or use provider-specific models with Antigravity/Codex
+    --provider <name>       Override the AI provider for headless modes
+                            (--ai-draft / --ai-review). Defaults to the
+                            repo/app default provider (claude). Pair with
+                            --model when the model belongs to a non-default
+                            provider (e.g. --provider codex --model gpt-5.5).
+                            Available: claude, antigravity, codex, copilot,
+                            opencode, cursor-agent, pi
     --council <handle>      Run analysis with a saved council (multi-voice). Handle is a
                             council name, name-slug, or id (prefix). See --list-councils.
     --list-councils         List saved councils (handles to use with --council) and exit
@@ -216,6 +239,9 @@ EXAMPLES:
     pair-review 123                    # Review PR #123 in current repo
     pair-review https://github.com/owner/repo/pull/456
     pair-review --local                # Review uncommitted local changes
+    pair-review --local --scope branch..untracked   # Review whole branch vs merge-base
+    pair-review --local --scope staged..unstaged    # Review staged + unstaged changes
+    pair-review --local --scope branch..untracked --base develop   # Branch scope vs develop
     pair-review 123 --ai               # Auto-run AI analysis
     pair-review --ai-review            # CI mode: auto-detect PR, submit review
     pair-review 123 --ai-draft --council security-review  # Headless council draft
@@ -232,6 +258,7 @@ ENVIRONMENT VARIABLES:
     PAIR_REVIEW_ANTIGRAVITY_CMD  Custom command to invoke Antigravity CLI (default: agy)
     PAIR_REVIEW_CODEX_CMD   Custom command to invoke Codex CLI (default: codex)
     PAIR_REVIEW_MODEL       Override the AI model (same as --model flag, default: opus)
+    PAIR_REVIEW_PROVIDER    Override the AI provider (same as --provider flag, default: claude)
 
 CONFIGURATION:
     Config file: ~/.pair-review/config.json
@@ -395,6 +422,7 @@ const KNOWN_FLAGS = new Set([
   '-l', '--local',
   '--mcp',
   '--model',
+  '--provider',
   '--council',
   '--list-councils',
   '--register',
@@ -469,6 +497,14 @@ function parseArgs(args) {
       } else {
         throw new Error('--model flag requires a model name (e.g., --model sonnet)');
       }
+    } else if (arg === '--provider') {
+      // Next argument is the provider name
+      if (i + 1 < args.length && !args[i + 1].startsWith('-')) {
+        flags.provider = args[i + 1];
+        i++; // Skip next argument since we consumed it
+      } else {
+        throw new Error('--provider flag requires a provider name (e.g., --provider codex)');
+      }
     } else if (arg === '--council') {
       // Next argument is the council handle (name, name-slug, or id prefix)
       if (i + 1 < args.length && !args[i + 1].startsWith('-')) {
@@ -477,6 +513,25 @@ function parseArgs(args) {
       } else {
         throw new Error('--council flag requires a council handle (e.g., --council my-council)');
       }
+    } else if (arg === '--scope') {
+      // Next argument is a scope range like `unstaged..untracked`. A range
+      // won't legitimately start with '-', so apply the same missing-value
+      // guard as --model. Range validity is checked later in main().
+      if (i + 1 < args.length && !args[i + 1].startsWith('-')) {
+        flags.scope = args[i + 1];
+        i++; // Skip next argument since we consumed it
+      } else {
+        throw new Error('--scope flag requires a range value (e.g., --scope unstaged..untracked)');
+      }
+    } else if (arg === '--base') {
+      // Next argument is a base branch name. A branch name won't legitimately
+      // start with '-', so apply the same guard as --model.
+      if (i + 1 < args.length && !args[i + 1].startsWith('-')) {
+        flags.base = args[i + 1];
+        i++; // Skip next argument since we consumed it
+      } else {
+        throw new Error('--base flag requires a branch name (e.g., --base main)');
+      }
     } else if (arg === '--list-councils') {
       flags.listCouncils = true;
     } else if (arg === '-l' || arg === '--local') {
@@ -515,6 +570,32 @@ function parseArgs(args) {
   return { prArgs, flags };
 }
 
+/**
+ * Fold the PAIR_REVIEW_PROVIDER / PAIR_REVIEW_MODEL env vars into parsed flags.
+ *
+ * `--provider`/`--model` and their env-var twins are two channels for the same
+ * override, but only the flags are threaded through single-port delegation
+ * (`buildDelegationUrl` forwards `flags.provider`/`flags.model`). Without this
+ * fold, an env-only invocation (`PAIR_REVIEW_PROVIDER=codex pair-review 123
+ * --ai`) delegates with an empty `flags.provider` and the override is silently
+ * dropped at the process boundary. Normalizing env→flags once here gives every
+ * downstream reader — delegation, the flags→env mirror, headless resolvers — a
+ * single effective value. Explicit flags always win over env.
+ *
+ * @param {object} flags - Parsed CLI flags (mutated in place)
+ * @param {object} [env] - Environment source (defaults to process.env; injectable for tests)
+ * @returns {object} the same `flags`, for chaining
+ */
+function normalizeProviderModelFlags(flags, env = process.env) {
+  if (!flags.provider && env.PAIR_REVIEW_PROVIDER) {
+    flags.provider = env.PAIR_REVIEW_PROVIDER;
+  }
+  if (!flags.model && env.PAIR_REVIEW_MODEL) {
+    flags.model = env.PAIR_REVIEW_MODEL;
+  }
+  return flags;
+}
+
 /**
  * Main application entry point
  */
@@ -586,6 +667,7 @@ ENVIRONMENT VARIABLES:
     PAIR_REVIEW_ANTIGRAVITY_CMD  Custom Antigravity CLI command (default: agy)
     PAIR_REVIEW_CODEX_CMD   Custom Codex CLI command (default: codex)
     PAIR_REVIEW_MODEL       Default AI model (e.g., opus, sonnet, haiku)
+    PAIR_REVIEW_PROVIDER    Default AI provider (e.g., claude, antigravity, codex)
     PAIR_REVIEW_DB_NAME     Custom database filename (overrides config)
 
 LOCAL CONFIG:
@@ -656,6 +738,10 @@ AI PROVIDERS:
     // single-port delegation can skip DB entirely)
     const { prArgs, flags } = parseArgs(args);
 
+    // Normalize env→flags before delegation so an env-only provider/model
+    // override rides the single-port delegation URL to the running server.
+    normalizeProviderModelFlags(flags);
+
     // Headless-mode flag validation (fail fast, before any DB/server work).
     // --instructions and --instructions-file are mutually exclusive.
     if (flags.instructions && flags.instructionsFile) {
@@ -669,6 +755,39 @@ AI PROVIDERS:
     if (flags.headless && prArgs.length === 0 && !flags.local) {
       throw new Error('--headless flag requires a pull request number/URL or --local to run analysis.');
     }
+    // --scope and --base are local-review diff controls. They require --local
+    // and cannot be combined with a PR positional. They do NOT imply --local
+    // (explicit flags only — no magic mode switching).
+    if (flags.scope || flags.base) {
+      if (prArgs.length > 0) {
+        throw new Error('--scope/--base apply to local reviews only; they cannot be combined with a pull request number/URL.');
+      }
+      if (!flags.local) {
+        throw new Error('--scope/--base require --local (they set the diff scope for a local review).');
+      }
+    }
+    // Validate the --scope range against the six accepted local-review scopes.
+    let parsedScopeFlag = null;
+    if (flags.scope) {
+      parsedScopeFlag = parseScopeArg(flags.scope);
+      if (!parsedScopeFlag) {
+        throw new Error(
+          `Invalid --scope value "${flags.scope}". Valid ranges are: ${VALID_SCOPE_RANGES.join(', ')}. ` +
+          "The range must be two stops joined by '..' and must include 'unstaged'."
+        );
+      }
+    }
+    // --base overrides base-branch detection and only applies to a
+    // branch-relative scope (one that starts at 'branch').
+    if (flags.base) {
+      if (!parsedScopeFlag || parsedScopeFlag.start !== 'branch') {
+        throw new Error("--base requires --scope with a branch-relative range (starting at 'branch', e.g. --scope branch..untracked).");
+      }
+      // Same validation the set-scope route uses to prevent shell injection.
+      if (!/^[\w.\-/]+$/.test(flags.base)) {
+        throw new Error(`Invalid --base branch name "${flags.base}".`);
+      }
+    }
     // --instructions[-file] only takes effect in a mode that actually runs
     // analysis. Plain interactive mode never auto-analyzes, so reject the
     // orphaned case with a clear message rather than silently dropping the text
@@ -767,6 +886,11 @@ AI PROVIDERS:
     // Skipped for: headless modes (no browser), single_port: false (dev mode).
     // --headless never delegates/opens a browser — it runs analysis locally and
     // reports to stdout/stderr.
+    //
+    // --scope/--base ARE delegated: attemptDelegation carries them on the local
+    // URL (buildDelegationUrl), the setup page relays them, and the setup route
+    // re-validates and applies them — so a scoped --local while a server is
+    // running lands at the requested scope instead of crashing on the busy port.
     if (config.single_port !== false && !flags.aiReview && !flags.aiDraft && !flags.headless) {
       // Carry --instructions across delegation. When an analyzing mode
       // (--ai/--council) ALSO supplies per-run instructions and a server is
@@ -954,7 +1078,12 @@ async function handlePullRequest(args, config, db, flags = {}, poolLifecycle = n
     // captured `${owner}/${repo}` for monorepo-style patterns.
     const repositoryForBinding = prInfo.bindingRepository
       || normalizeRepository(prInfo.owner, prInfo.repo);
-    const binding = resolveHostBinding(repositoryForBinding, config);
+    // A pasted URL tells us the host up front (alt-host `url_pattern` match →
+    // api_host string; github/graphite URL → null), so preflight the token
+    // against that host. A bare number leaves host undefined → ambiguity rule,
+    // but a dual repo with only an alt token is still usable (the setup probe
+    // tries the alt host first) — resolvePreflightBinding tolerates that.
+    const binding = resolvePreflightBinding(repositoryForBinding, config, prInfo.host);
     if (!binding.token) {
       throw new Error(buildMissingTokenError({
         owner: prInfo.owner,
@@ -977,6 +1106,13 @@ async function handlePullRequest(args, config, db, flags = {}, poolLifecycle = n
       process.env.PAIR_REVIEW_MODEL = flags.model;
     }
 
+    // Set provider override if provided via CLI flag. Mirrored into the env
+    // var so the web/UI analysis paths (which read PAIR_REVIEW_PROVIDER via
+    // getProvider()) honor it too, matching how --model works.
+    if (flags.provider) {
+      process.env.PAIR_REVIEW_PROVIDER = flags.provider;
+    }
+
     // Resolve the council handle FAIL-FAST before starting the server, so a bad
     // handle surfaces as a clean error (caught below) instead of after the
     // browser has opened.
@@ -1011,6 +1147,15 @@ async function handlePullRequest(args, config, db, flags = {}, poolLifecycle = n
       url += `&council=${councilSelection.id}`;
     }
 
+    // Thread the pasted URL's host to setup so it binds directly instead of
+    // probing (shared mapping — see hostSetupParamValue): an alt-host string
+    // forwards the api_host; a github URL on a DUAL repo forwards the 'github'
+    // sentinel; bare numbers / plain / exclusive repos omit it.
+    const hostParam = hostSetupParamValue(prInfo.host, isDualHostRepo(config, repositoryForBinding));
+    if (hostParam) {
+      url += (url.includes('?') ? '&' : '?') + `host=${encodeURIComponent(hostParam)}`;
+    }
+
     console.log(`Opening browser to: ${url}`);
     await open(url);
 
@@ -1107,29 +1252,34 @@ async function performHeadlessReview(args, config, db, flags, options, externalP
     // serves many monorepo-shaped URLs.
     const repositoryForBinding = prInfo.bindingRepository
       || normalizeRepository(prInfo.owner, prInfo.repo);
-    const headlessBinding = resolveHostBinding(repositoryForBinding, config);
-    if (!headlessBinding.token) {
+    // Preflight the token so a missing credential fails fast before any network
+    // work. Tolerates a dual repo with only an alt token when the host is
+    // unknown (the setup probe tries the alt host first).
+    const preflightBinding = resolvePreflightBinding(repositoryForBinding, config, prInfo.host);
+    if (!preflightBinding.token) {
       throw new Error(buildMissingTokenError({
         owner: prInfo.owner,
         repo: prInfo.repo,
         bindingRepository: repositoryForBinding,
-        apiHost: headlessBinding.apiHost
+        apiHost: preflightBinding.apiHost
       }));
     }
-    const githubToken = headlessBinding.token;
 
     console.log(`Processing pull request #${prInfo.number} from ${prInfo.owner}/${prInfo.repo} in ${options.modeLabel}`);
 
-    // Create GitHub client and verify repository access
-    const githubClient = new GitHubClient(headlessBinding);
-    const repoExists = await githubClient.repositoryExists(prInfo.owner, prInfo.repo);
-    if (!repoExists) {
-      throw new Error(`Repository ${prInfo.owner}/${prInfo.repo} not found or not accessible`);
-    }
-
-    // Fetch PR data from GitHub
+    // Resolve the per-PR host binding and fetch the PR. Applies host precedence
+    // (URL-paste host → stored host → ambiguity/probe for dual repos) and
+    // returns the chosen binding so its host is stamped by storePRData below.
     console.log('Fetching pull request data from GitHub...');
-    const prData = await githubClient.fetchPullRequest(prInfo.owner, prInfo.repo, prInfo.number);
+    const { binding: headlessBinding, prData, githubClient } = await resolvePrHostBinding({
+      db, config, bindingRepository: repositoryForBinding,
+      owner: prInfo.owner, repo: prInfo.repo, prNumber: prInfo.number,
+      // Only forward a github.com token as the github fallback; if the preflight
+      // resolved an ALT binding (dual repo, alt-only token), there is no github
+      // fallback token, so pass '' rather than sending the alt token to github.com.
+      host: prInfo.host, githubToken: preflightBinding.apiHost === null ? preflightBinding.token : ''
+    });
+    const githubToken = headlessBinding.token || preflightBinding.token;
 
     let worktreePath;
     let diff;
@@ -1290,7 +1440,8 @@ async function performHeadlessReview(args, config, db, flags, options, externalP
     // Store PR data in database
     console.log('Storing pull request data...');
     const { isNewReview, reviewId: storedReviewId } = await storePRData(db, prInfo, prData, diff, changedFiles, worktreePath, {
-      skipWorktreeRecord: !!flags.useCheckout
+      skipWorktreeRecord: !!flags.useCheckout,
+      host: headlessBinding.host
     });
 
     // Persist review→worktree mapping in DB for pool usage tracking
@@ -1340,10 +1491,13 @@ async function performHeadlessReview(args, config, db, flags, options, externalP
     // The early councilSelection above already fail-fast validated an explicit
     // --council; resolveReviewConfig re-resolves the same handle (cheap in-memory
     // match) and unifies single/council selection with the headless path.
+    // --provider (flags.provider) rides in as an explicit single-model pick; the
+    // resolver's ladder (explicit › PAIR_REVIEW_PROVIDER › repo › config › 'claude')
+    // delivers the CLI override that commit 662e introduced.
     const reviewConfig = await resolveReviewConfig(
       db,
       repository,
-      { council: flags.council, model: flags.model },
+      { council: flags.council, provider: flags.provider, model: flags.model },
       config
     );
 
@@ -1736,26 +1890,30 @@ async function preparePrHeadless(db, config, flags, prArgs, externalPoolLifecycl
 
   const repositoryForBinding = prInfo.bindingRepository
     || normalizeRepository(prInfo.owner, prInfo.repo);
-  const headlessBinding = resolveHostBinding(repositoryForBinding, config);
-  if (!headlessBinding.token) {
+  // Preflight the token so a missing credential fails fast before any network
+  // work. Tolerates a dual repo with only an alt token when the host is unknown
+  // (the setup probe tries the alt host first).
+  const preflightBinding = resolvePreflightBinding(repositoryForBinding, config, prInfo.host);
+  if (!preflightBinding.token) {
     throw new Error(buildMissingTokenError({
       owner: prInfo.owner,
       repo: prInfo.repo,
       bindingRepository: repositoryForBinding,
-      apiHost: headlessBinding.apiHost
+      apiHost: preflightBinding.apiHost
     }));
   }
 
   console.log(`Processing pull request #${prInfo.number} from ${prInfo.owner}/${prInfo.repo} in headless mode`);
 
-  const githubClient = new GitHubClient(headlessBinding);
-  const repoExists = await githubClient.repositoryExists(prInfo.owner, prInfo.repo);
-  if (!repoExists) {
-    throw new Error(`Repository ${prInfo.owner}/${prInfo.repo} not found or not accessible`);
-  }
-
+  // Resolve the per-PR host binding and fetch (host precedence: URL-paste host
+  // → stored host → ambiguity/probe for dual repos).
   console.log('Fetching pull request data from GitHub...');
-  const prData = await githubClient.fetchPullRequest(prInfo.owner, prInfo.repo, prInfo.number);
+  const { binding: headlessBinding, prData, githubClient } = await resolvePrHostBinding({
+    db, config, bindingRepository: repositoryForBinding,
+    owner: prInfo.owner, repo: prInfo.repo, prNumber: prInfo.number,
+    // Only forward a github.com token as the github fallback (see performHeadlessReview).
+    host: prInfo.host, githubToken: preflightBinding.apiHost === null ? preflightBinding.token : ''
+  });
 
   let worktreePath;
   let diff;
@@ -1903,7 +2061,8 @@ async function preparePrHeadless(db, config, flags, prArgs, externalPoolLifecycl
 
   console.log('Storing pull request data...');
   const { isNewReview, reviewId: storedReviewId } = await storePRData(db, prInfo, prData, diff, changedFiles, worktreePath, {
-    skipWorktreeRecord: !!flags.useCheckout
+    skipWorktreeRecord: !!flags.useCheckout,
+    host: headlessBinding.host
   });
 
   if (poolWorktreeId && poolLifecycle) {
@@ -1934,10 +2093,17 @@ async function preparePrHeadless(db, config, flags, prArgs, externalPoolLifecycl
   const repoSettingsRepo = new RepoSettingsRepository(db);
   const repoSettings = await repoSettingsRepo.getRepoSettings(repository);
 
+  // Thread --provider (flags.provider) through as an explicit single-model pick,
+  // exactly as the PR-submit path at the top of the file and the local headless
+  // path do. handleHeadlessAnalysis dispatches BEFORE the local/PR split (and thus
+  // before handlePullRequest's PAIR_REVIEW_PROVIDER env mirror), so omitting it
+  // here would let `pair-review <pr> --headless --provider <p>` silently fall
+  // through to the default provider (or, with a repo default council, switch to
+  // council mode) — while --model in the same invocation was honored.
   const reviewConfig = await resolveReviewConfig(
     db,
     repository,
-    { council: flags.council, model: flags.model },
+    { council: flags.council, provider: flags.provider, model: flags.model },
     config
   );
 
@@ -2113,7 +2279,7 @@ async function handleHeadlessAnalysis(prArgs, config, db, flags, poolLifecycle)
     const reviewConfig = await resolveReviewConfig(
       db,
       repository,
-      { council: flags.council, model: flags.model },
+      { council: flags.council, provider: flags.provider, model: flags.model },
       config
     );
     const cliProvider = reviewConfig.type === 'single' ? reviewConfig.provider : null;
@@ -2503,4 +2669,4 @@ if (require.main === module) {
   main();
 }
 
-module.exports = { main, parseArgs, detectPRFromGitHubEnvironment, printCouncilList, runHeadlessAnalysis, recordEmptyScopeRun, buildHeadlessJson, buildHeadlessErrorJson, resolveCliInstructions };
+module.exports = { main, parseArgs, normalizeProviderModelFlags, detectPRFromGitHubEnvironment, printCouncilList, handleHeadlessAnalysis, runHeadlessAnalysis, recordEmptyScopeRun, buildHeadlessJson, buildHeadlessErrorJson, resolveCliInstructions };

package/src/routes/config.js

@@ -10,7 +10,7 @@
  */
 
 const express = require('express');
-const { RepoSettingsRepository, ReviewRepository, queryOne } = require('../database');
+const { RepoSettingsRepository, ReviewRepository, PRMetadataRepository, queryOne } = require('../database');
 const {
   getAllProvidersInfo,
   testProviderAvailability,
@@ -21,12 +21,12 @@ const {
   modelMatches
 } = require('../ai');
 const { normalizeRepository } = require('../utils/paths');
+const { resolvePreflightBinding } = require('../utils/host-resolution');
 const {
   isRunningViaNpx,
   getGitHubToken,
   getDefaultProvider,
   getDefaultModel,
-  resolveHostBinding,
   resolveBindingRepositoryFromPR,
   getSummaryEnabled,
   getSummaryAutoGenerate,
@@ -82,10 +82,11 @@ router.get('/runtime-config.js', (req, res) => {
  *   - has_global_github_token: always present. True iff `getGitHubToken(config)`
  *     resolves a token from the top-level config / env (no repo context).
  *   - has_github_token: present ONLY when both ?owner and ?repo query
- *     parameters are supplied. True iff a token can be resolved for that
- *     specific repository via `resolveHostBinding(repo, config)` — this
- *     covers repo-scoped `token`, `token_command`, alt-host bindings, AND
- *     falls through to the global lookup. Callers that know which repo
+ *     parameters are supplied. True iff ANY usable binding for that specific
+ *     repository resolves a token (`resolvePreflightBinding`) — this covers
+ *     repo-scoped `token`, `token_command`, alt-host bindings, a DUAL repo whose
+ *     only credential is the alt-host token, AND falls through to the global
+ *     lookup. Callers that know which repo
  *     they're rendering should pass these params so that repo-scoped
  *     authentication is reflected accurately (e.g. for deciding whether
  *     to enable GitHub-comment dedup). When the params are absent, the
@@ -146,10 +147,14 @@ router.get('/api/config', (req, res) => {
   let hasRepoGithubToken = null;
   if (hasRepoContext) {
     const repository = `${owner}/${repo}`;
-    // resolveHostBinding already falls through to top-level config when
-    // no repo-scoped token is configured, so this is a true union of
-    // "repo-scoped binding works" OR "global token works".
-    hasRepoGithubToken = Boolean(resolveHostBinding(repository, config).token);
+    // "Has any usable binding" semantics. resolveHostBinding already falls
+    // through to top-level config when no repo-scoped token is configured, so
+    // the no-host lookup unions "repo-scoped binding works" OR "global token
+    // works". But for a DUAL repo the no-host lookup uses the github ambiguity
+    // binding, which misses a repo whose only credential is the alt-host token —
+    // resolvePreflightBinding additionally tries the alt candidate, so an
+    // alt-only dual repo reports true (matching what setup/probe will do).
+    hasRepoGithubToken = Boolean(resolvePreflightBinding(repository, config, undefined).token);
   }
 
   // Only return safe configuration values (not secrets like github_token)
@@ -163,6 +168,16 @@ router.get('/api/config', (req, res) => {
     comment_format: config.comment_format || 'legacy',
     default_provider: defaultPair.provider,
     default_model: defaultPair.model,
+    // CLI/env override (PAIR_REVIEW_PROVIDER / PAIR_REVIEW_MODEL, set by
+    // `--provider` / `--model`). Surfaced as a DEDICATED signal — not folded
+    // into default_provider/default_model above — because every frontend seed
+    // site resolves `resolveProviderModelPair([repoSettings, appConfig])` with
+    // repo settings FIRST. Folding the override into appConfig would still lose
+    // to a repo's saved default, violating the documented `CLI/env > repo
+    // settings` contract. The frontend prepends this override ahead of
+    // repoSettings via buildProviderModelScopes(). null when unset.
+    provider_override: process.env.PAIR_REVIEW_PROVIDER || null,
+    model_override: process.env.PAIR_REVIEW_MODEL || null,
     // Include npx detection for frontend command examples
     is_running_via_npx: isRunningViaNpx(),
     enable_chat: config.enable_chat !== false,
@@ -301,8 +316,14 @@ router.get('/api/repos/:owner/:repo/settings', async (req, res) => {
  * `javascript:` URLs stripped). The url_template is NOT substituted here —
  * the frontend has the live PR/branch context, so it performs the
  * whitelisted substitution at render time.
+ *
+ * Optional `?number=<n>` query: the PR number the header is being rendered
+ * for. For a dual-host repo (`api_host` + `exclusive: false`) the link set
+ * depends on which system the PR lives on, so we look up the PR's stored host
+ * and resolve links against it. Omitted (Local mode, plain/exclusive repos)
+ * or an unknown PR → repo-level defaults, byte-identical to before.
  */
-router.get('/api/repos/:owner/:repo/links', (req, res) => {
+router.get('/api/repos/:owner/:repo/links', async (req, res) => {
   try {
     const { owner, repo } = req.params;
     const repository = normalizeRepository(owner, repo);
@@ -311,7 +332,21 @@ router.get('/api/repos/:owner/:repo/links', (req, res) => {
     // `repos[...]` entry serving many captured owner/repo via
     // url_pattern) surface the right link config.
     const bindingRepository = resolveBindingRepositoryFromPR(owner, repo, config);
-    const links = resolveRepoLinks(config, bindingRepository);
+
+    // Per-PR host awareness: when the caller names a PR, look up its stored
+    // host so a dual-host repo shows the correct link set (github links for a
+    // github-hosted PR, the external link for an alt-hosted one). A missing
+    // row leaves `host` undefined, which resolveRepoLinks treats as the
+    // repo-level default — so non-dual repos are unaffected regardless.
+    let host;
+    const prNumber = parseInt(req.query.number, 10);
+    if (Number.isInteger(prNumber) && prNumber > 0) {
+      const prMetadataRepo = new PRMetadataRepository(req.app.get('db'));
+      const storedHost = await prMetadataRepo.getPRHost(repository, prNumber);
+      if (storedHost !== undefined) host = storedHost;
+    }
+
+    const links = resolveRepoLinks(config, bindingRepository, host);
     res.json({ repository, links });
   } catch (error) {
     logger.error('Error resolving repo links:', error);

package/src/routes/external-comments.js

@@ -20,6 +20,7 @@ const express = require('express');
 const {
   ExternalCommentRepository,
   ReviewRepository,
+  PRMetadataRepository,
   withTransaction
 } = require('../database');
 const { getAdapter } = require('../external');
@@ -135,6 +136,17 @@ async function executeSync({ db, config, review, source, _deps }) {
     );
   }
 
+  // Look up the PR's stored host so a DUAL repo's alt-hosted PR binds to the
+  // alt host (and its line-based anchoring path) rather than api.github.com.
+  // Pass the raw stored value through to the adapter, which applies the
+  // legacy-NULL convention against its resolved binding key. `undefined`
+  // (no row / unknown) preserves the two-arg ambiguity behaviour.
+  let storedHost;
+  if (Number.isInteger(review.pr_number)) {
+    const prMetadataRepo = new PRMetadataRepository(db);
+    storedHost = await prMetadataRepo.getPRHost(review.repository, review.pr_number);
+  }
+
   // Delegate credential resolution to the adapter so the route stays
   // source-agnostic and each adapter can name its own env var in errors.
   // Thread `review.repository` through so the adapter resolves the
@@ -145,7 +157,7 @@ async function executeSync({ db, config, review, source, _deps }) {
   // `isAltHost` reflects whether the resolved binding targets an alternate
   // Git host. Alt-hosts don't implement GitHub's deprecated `position`
   // field, so it drives line-based anchoring in `mapComment` below.
-  const { client, isAltHost } = adapter.resolveCredentials(config || {}, review.repository, _deps);
+  const { client, isAltHost } = adapter.resolveCredentials(config || {}, review.repository, _deps, { storedHost });
 
   const apiRows = await adapter.fetchComments({
     client,