@in-the-loop-labs/pair-review 4.0.0 → 4.1.1

package/src/database.js

@@ -21,7 +21,7 @@ function getDbPath() {
 /**
  * Current schema version - increment this when adding new migrations
  */
-const CURRENT_SCHEMA_VERSION = 48;
+const CURRENT_SCHEMA_VERSION = 51;
 
 /**
  * Database schema SQL statements
@@ -123,6 +123,7 @@ const SCHEMA_SQL = {
       pr_data TEXT,
       last_ai_run_id TEXT,
       last_accessed_at TEXT,
+      host TEXT,
       UNIQUE(pr_number, repository)
     )
   `,
@@ -312,6 +313,7 @@ const SCHEMA_SQL = {
       html_url TEXT,
       state TEXT DEFAULT 'open',
       collection TEXT NOT NULL,
+      host TEXT,
       fetched_at DATETIME DEFAULT CURRENT_TIMESTAMP
     )
   `,
@@ -349,6 +351,7 @@ const SCHEMA_SQL = {
       diff_position INTEGER,
       commit_sha TEXT,
       is_outdated INTEGER NOT NULL DEFAULT 0,
+      is_file_level INTEGER NOT NULL DEFAULT 0,
       original_line_start INTEGER,
       original_line_end INTEGER,
       original_commit_sha TEXT,
@@ -397,8 +400,14 @@ const INDEX_SQL = [
   'CREATE INDEX IF NOT EXISTS idx_context_files_review ON context_files(review_id)',
   // Hunk summaries indexes
   'CREATE INDEX IF NOT EXISTS idx_hunk_summaries_review ON hunk_summaries(review_id)',
-  // GitHub PR cache indexes
-  'CREATE UNIQUE INDEX IF NOT EXISTS idx_github_pr_cache_unique ON github_pr_cache(collection, owner, repo, number)',
+  // GitHub PR cache indexes. `host` is part of the unique key so a dual-host
+  // repo can cache the same (collection, owner, repo, number) from github.com
+  // (host NULL) AND its alt host (host = api_host URL) without colliding —
+  // independently-numbered PRs across systems overlap on small numbers. SQLite
+  // treats NULLs as distinct in unique indexes, so two NULL-host rows would not
+  // collide, but the collections refresh DELETEs the collection before
+  // re-inserting, so duplicate NULL-host rows can't accumulate. See migration 51.
+  'CREATE UNIQUE INDEX IF NOT EXISTS idx_github_pr_cache_unique ON github_pr_cache(collection, owner, repo, number, host)',
   // Worktree pool indexes
   'CREATE INDEX IF NOT EXISTS idx_worktree_pool_repo ON worktree_pool(repository)',
   'CREATE INDEX IF NOT EXISTS idx_worktree_pool_status ON worktree_pool(repository, status)',
@@ -1305,6 +1314,9 @@ const MIGRATIONS = {
           fetched_at DATETIME DEFAULT CURRENT_TIMESTAMP
         )
       `);
+      // Historical shape: no `host` column exists at v26 (added in migration
+      // 50). Migration 51 widens this index to include `host`. Do NOT add
+      // `host` here — it would reference a column that doesn't exist yet.
       db.exec('CREATE UNIQUE INDEX IF NOT EXISTS idx_github_pr_cache_unique ON github_pr_cache(collection, owner, repo, number)');
       console.log('  Created github_pr_cache table');
     } else {
@@ -2159,6 +2171,72 @@ const MIGRATIONS = {
       console.log('  Table tours already exists');
     }
     console.log('Migration to schema version 48 complete');
+  },
+
+  // Migration to version 49: Add is_file_level flag to external_comments so
+  // file-level review comments (GitHub subject_type='file') can be rendered in
+  // the per-file comments zone instead of as a bogus line-1 annotation.
+  // Idempotent single-column ALTER guarded by columnExists — safe to re-run.
+  // A single DDL statement needs no transaction wrapper.
+  49: (db) => {
+    console.log('Running migration to schema version 49: Add is_file_level to external_comments...');
+    if (!tableExists(db, 'external_comments')) {
+      // Table not created yet (older instance below version 45). Migration 45
+      // creates it with the current base schema; nothing to alter here.
+      console.log('  external_comments table not present; nothing to alter');
+    } else if (!columnExists(db, 'external_comments', 'is_file_level')) {
+      db.exec('ALTER TABLE external_comments ADD COLUMN is_file_level INTEGER NOT NULL DEFAULT 0');
+      console.log('  Added is_file_level column to external_comments');
+    } else {
+      console.log('  Column is_file_level already exists');
+    }
+    console.log('Migration to schema version 49 complete');
+  },
+
+  // Migration to version 50: Add host column to pr_metadata and github_pr_cache
+  // for per-PR host resolution (dual GitHub + alt-host repos). NULL means
+  // github.com; otherwise the configured api_host URL string. No backfill — the
+  // NULL-means-github fallback makes existing rows resolve identically, and rows
+  // are re-stamped on next fetch. Each ALTER is guarded by columnExists so the
+  // migration is idempotent; single DDL statements need no transaction wrapper.
+  50: (db) => {
+    console.log('Running migration to schema version 50: Add host to pr_metadata and github_pr_cache...');
+    if (tableExists(db, 'pr_metadata') && !columnExists(db, 'pr_metadata', 'host')) {
+      db.exec('ALTER TABLE pr_metadata ADD COLUMN host TEXT');
+      console.log('  Added host column to pr_metadata');
+    } else {
+      console.log('  Column host already exists on pr_metadata (or table absent)');
+    }
+    if (tableExists(db, 'github_pr_cache') && !columnExists(db, 'github_pr_cache', 'host')) {
+      db.exec('ALTER TABLE github_pr_cache ADD COLUMN host TEXT');
+      console.log('  Added host column to github_pr_cache');
+    } else {
+      console.log('  Column host already exists on github_pr_cache (or table absent)');
+    }
+    console.log('Migration to schema version 50 complete');
+  },
+
+  // Migration to version 51: widen idx_github_pr_cache_unique to include host.
+  // The collections refresh inserts github rows (host NULL) and alt-host rows
+  // (host = api_host URL) under the same collection in one transaction. For a
+  // dual-host repo whose PRs are numbered independently per system, a shared
+  // (collection, owner, repo, number) would violate the old 4-column unique
+  // index — and the single throw rolls back the DELETE plus BOTH insert loops,
+  // so the user sees zero PRs for that collection. Adding host to the key lets
+  // the two systems' same-numbered PRs coexist. The new index is strictly wider
+  // than the old one, so existing data can never violate it. Idempotent:
+  // DROP IF EXISTS then CREATE IF NOT EXISTS yields the same shape on re-run and
+  // is safe on both a v50 DB (old 4-column index) and a fresh DB.
+  51: (db) => {
+    console.log('Running migration to schema version 51: widen idx_github_pr_cache_unique to include host...');
+    if (tableExists(db, 'github_pr_cache')) {
+      db.exec('DROP INDEX IF EXISTS idx_github_pr_cache_unique');
+      db.exec('CREATE UNIQUE INDEX IF NOT EXISTS idx_github_pr_cache_unique ON github_pr_cache(collection, owner, repo, number, host)');
+      console.log('  Rebuilt idx_github_pr_cache_unique with host in the key');
+    } else {
+      console.log('  Table github_pr_cache absent; nothing to reindex');
+    }
+    console.log('Migration to schema version 51 complete');
   }
 };
 
@@ -4974,6 +5052,52 @@ class PRMetadataRepository {
     };
   }
 
+  /**
+   * Get the stored host binding for a PR.
+   *
+   * Distinguishes "no row" from "row says github". Used by per-PR host
+   * resolution (dual GitHub + alt-host repos) to decide which system a PR
+   * lives on before building a binding.
+   *
+   * @param {string} repository - Repository in owner/repo format
+   * @param {number} prNumber - Pull request number
+   * @returns {Promise<string|null|undefined>} The stored api_host URL string,
+   *   `null` when the row exists but host is unset (github.com), or `undefined`
+   *   when no pr_metadata row exists for the PR.
+   */
+  async getPRHost(repository, prNumber) {
+    const row = await queryOne(this.db, `
+      SELECT host FROM pr_metadata
+      WHERE pr_number = ? AND repository = ? COLLATE NOCASE
+    `, [prNumber, repository]);
+
+    if (!row) return undefined;
+    return row.host;
+  }
+
+  /**
+   * Update ONLY the host binding for a PR's metadata row.
+   *
+   * Used to persist an explicit host correction (e.g. a `?host` query param on
+   * the /pr fast path) without re-running full setup. Leaves every other column
+   * untouched.
+   *
+   * @param {string} repository - Repository in owner/repo format
+   * @param {number} prNumber - Pull request number
+   * @param {string|null} host - api_host URL string, or null for github.com
+   * @returns {Promise<boolean>} True if a matching row was updated, false when
+   *   no pr_metadata row exists for the PR.
+   */
+  async updatePRHost(repository, prNumber, host) {
+    const result = await run(this.db, `
+      UPDATE pr_metadata
+      SET host = ?, updated_at = CURRENT_TIMESTAMP
+      WHERE pr_number = ? AND repository = ? COLLATE NOCASE
+    `, [host, prNumber, repository]);
+
+    return result.changes > 0;
+  }
+
   /**
    * Update the last_ai_run_id for a PR metadata record
    * @param {number} id - PR metadata record ID

package/src/external/github-adapter.js

@@ -24,6 +24,7 @@ const {
   resolveHostBinding,
   resolveBindingRepositoryFromPR
 } = require('../config');
+const { storedHostToOption } = require('../utils/host-resolution');
 
 const name = 'github';
 
@@ -63,14 +64,26 @@ const credentialEnvVar = 'GITHUB_TOKEN';
  * diff-relative `position` field, so `mapComment` must anchor by `line`
  * instead — see its docstring.
  *
+ * Per-PR host: for a DUAL repo (github + alt-host) the binding depends on which
+ * system the PR actually lives on. The caller passes the PR's stored
+ * `pr_metadata.host` via `options.storedHost` (undefined | null | api_host URL);
+ * this method applies the legacy-NULL convention (`storedHostToOption`) and
+ * threads the resulting `{ host }` into `resolveHostBinding`, so a dual repo's
+ * alt-hosted PR resolves to the alt binding (and the line-based anchoring path)
+ * instead of always hitting api.github.com two-arg. When `options.storedHost`
+ * is omitted the two-arg ambiguity rule applies, unchanged.
+ *
  * @param {Object} config - Server config (see `loadConfig()`)
  * @param {string} [repository] - "owner/repo" identifier for binding-aware resolution
  * @param {Object} [_deps] - Test overrides for
  *   { GitHubClient, getGitHubToken, resolveHostBinding, resolveBindingRepositoryFromPR }
+ * @param {Object} [options] - Runtime resolution inputs
+ * @param {string|null|undefined} [options.storedHost] - The PR's stored
+ *   pr_metadata.host (undefined = no row / unknown, null = github.com, URL = alt host)
  * @returns {{ client: Object, isAltHost: boolean }}
  * @throws {GitHubApiError} with status 401 when no token is configured
  */
-function resolveCredentials(config, repository, _deps) {
+function resolveCredentials(config, repository, _deps, options = {}) {
   const deps = {
     GitHubClient,
     getGitHubToken,
@@ -82,10 +95,12 @@ function resolveCredentials(config, repository, _deps) {
 
   if (repository) {
     // Binding-aware path. Mirrors resolveBindingForRequest in routes/pr.js:
-    // resolve the PR identity to a binding key, then to a host binding.
+    // resolve the PR identity to a binding key, then to a host binding —
+    // pinned to the PR's stored host for dual repos.
     const [owner, repo] = String(repository).split('/');
     const bindingRepository = deps.resolveBindingRepositoryFromPR(owner, repo, safeConfig);
-    const binding = deps.resolveHostBinding(bindingRepository, safeConfig);
+    const hostOption = storedHostToOption(safeConfig, bindingRepository, options.storedHost);
+    const binding = deps.resolveHostBinding(bindingRepository, safeConfig, hostOption || {});
     if (!binding || !binding.token) {
       throw new GitHubApiError(
         `GitHub token not configured for ${repository}. Set ${credentialEnvVar}, add github_token to ~/.pair-review/config.json, or configure repos["${bindingRepository}"].token / token_command (required for alt-host repos)`,

package/src/github/client.js

@@ -1137,6 +1137,43 @@ class GitHubClient {
     });
   }
 
+  /**
+   * List open pull requests for a single repository via the REST API.
+   *
+   * Used by the dashboard collections sweep against alt-hosts, which speak a
+   * REST subset and generally have no Search API. The returned rows carry the
+   * classification fields (`author`, `requested_reviewers`, `requested_teams`)
+   * so the caller can bucket each PR into a collection locally, plus the same
+   * display fields `searchPullRequests` returns so both paths cache uniformly.
+   *
+   * @param {string} owner - Repository owner
+   * @param {string} repo - Repository name
+   * @returns {Promise<Array<{owner: string, repo: string, number: number, title: string, author: string|null, updated_at: string, html_url: string, state: string, requested_reviewers: string[], requested_teams: string[]}>>}
+   */
+  async listOpenPullRequests(owner, repo) {
+    const pulls = await this.octokit.paginate(
+      this.octokit.rest.pulls.list,
+      { owner, repo, state: 'open', per_page: 100 }
+    );
+
+    return pulls.map(pr => ({
+      owner,
+      repo,
+      number: pr.number,
+      title: pr.title,
+      author: pr.user?.login || null,
+      updated_at: pr.updated_at,
+      html_url: pr.html_url,
+      state: pr.state,
+      requested_reviewers: Array.isArray(pr.requested_reviewers)
+        ? pr.requested_reviewers.map(r => r && r.login).filter(Boolean)
+        : [],
+      requested_teams: Array.isArray(pr.requested_teams)
+        ? pr.requested_teams.map(t => t && t.slug).filter(Boolean)
+        : []
+    }));
+  }
+
   /**
    * Get the authenticated user's information.
    * @returns {Promise<{login: string, name: string, avatar_url: string}>}

package/src/github/parser.js

@@ -90,11 +90,20 @@ class PRArgumentParser {
     if (!owner || !repo || typeof number !== 'number' || isNaN(number) || number <= 0) {
       return null;
     }
+    // Carry the matched repo's `api_host` so downstream setup binds the PR to
+    // the alternate host without probing. A `url_pattern` match on a repo with
+    // no `api_host` (a plain github.com entry) resolves to `host: null`.
+    const matchedApiHost = (match.repoConfig
+      && typeof match.repoConfig.api_host === 'string'
+      && match.repoConfig.api_host)
+      ? match.repoConfig.api_host
+      : null;
     return {
       owner,
       repo,
       number,
-      bindingRepository: match.bindingRepository
+      bindingRepository: match.bindingRepository,
+      host: matchedApiHost
     };
   }
 
@@ -114,16 +123,30 @@ class PRArgumentParser {
       return null;
     }
 
+    // Clean up the URL - trim whitespace
+    const trimmedUrl = url.trim();
+
     // Try config-driven URL pattern matching first. This handles
     // alternate-host URLs and lets host-specific repos override the
     // built-in github.com path if they choose.
-    const configMatch = this._matchUrlPatternFromConfig(url.trim());
+    const configMatch = this._matchUrlPatternFromConfig(trimmedUrl);
     if (configMatch) {
-      return configMatch;
+      // INVARIANT: an `api_host`-bearing `url_pattern` must NEVER bind a
+      // canonical github.com / Graphite URL. An over-broad or unanchored pattern
+      // can match one and pre-pin it to the alt host (an explicit host bypasses
+      // the setup probe → a silent, durable wrong binding). When the config
+      // match carries an alt host but the URL is a canonical github/graphite URL,
+      // discard the match and fall through to the built-in parsers (host: null).
+      const sansProtocol = trimmedUrl.replace(/^https?:\/\//i, '');
+      const isCanonicalHostUrl = sansProtocol.startsWith('github.com/')
+        || sansProtocol.startsWith('app.graphite.dev/')
+        || sansProtocol.startsWith('app.graphite.com/');
+      if (!(configMatch.host && isCanonicalHostUrl)) {
+        return configMatch;
+      }
     }
 
-    // Clean up the URL - trim whitespace
-    let normalizedUrl = url.trim();
+    let normalizedUrl = trimmedUrl;
 
     // Add https:// if no protocol is present
     if (normalizedUrl.startsWith('github.com')) {
@@ -222,7 +245,9 @@ class PRArgumentParser {
    * @param {string} repo - Repository name
    * @param {string} numberStr - PR number as string
    * @param {string} source - Source name for error messages ('GitHub' or 'Graphite')
-   * @returns {Object} Validated PR info { owner, repo, number }
+   * @returns {Object} Validated PR info `{ owner, repo, number, host? }`. `host`
+   *   is `null` for github.com/Graphite URLs (definitively github); it is OMITTED
+   *   (undefined) for the pair-review:// scheme, which carries no host in its path.
    * @private
    */
   _createPRInfo(owner, repo, numberStr, source) {
@@ -237,7 +262,16 @@ class PRArgumentParser {
       throw new Error(`Invalid ${source} URL format. Expected: ${exampleUrl}`);
     }
 
-    return { owner, repo, number };
+    // A github.com or Graphite URL unambiguously identifies a github.com PR, so
+    // the host is explicitly null (not "unknown"). The pair-review:// scheme
+    // carries NO host in its path and is not github-only, so leave `host`
+    // undefined — it flows into the probe/derive path like a bare number,
+    // instead of self-healing (dual repo) or throwing (exclusive alt) on github.
+    const result = { owner, repo, number };
+    if (source !== 'pair-review://') {
+      result.host = null;
+    }
+    return result;
   }
 
   /**

package/src/interactive-analysis-config.js

@@ -93,7 +93,7 @@ async function resolveCliInstructions(flags) {
  * @param {Object} params
  * @param {Object} params.db - Database instance
  * @param {Object} params.config - Loaded global config
- * @param {Object} params.flags - Parsed CLI flags (council/model/instructions)
+ * @param {Object} params.flags - Parsed CLI flags (council/provider/model/instructions)
  * @param {string} params.repository - owner/repo (for repo-default resolution)
  * @returns {Promise<Object|null>} The analysisConfig object, or null when no instructions.
  */
@@ -104,7 +104,7 @@ async function buildInteractiveAnalysisConfig({ db, config, flags, repository })
   const reviewConfig = await resolveReviewConfig(
     db,
     repository,
-    { council: flags.council, model: flags.model },
+    { council: flags.council, provider: flags.provider, model: flags.model },
     config
   );
 

package/src/links/repo-links.js

@@ -31,6 +31,7 @@
  */
 
 const { getRepoConfig } = require('../config');
+const { isDualHostRepoConfig } = require('../utils/host-resolution');
 const logger = require('../utils/logger');
 
 // Whitelist of allowed `{placeholder}` names. Anything else in the template
@@ -158,13 +159,28 @@ function sanitizeSvgIcon(svg) {
  * malformed), a warning is logged and `icon` becomes `null` — the link
  * is still rendered, just without a custom icon.
  *
+ * **Per-PR host awareness (dual-host repos only).** `host` is the PR's
+ * resolved host: `null` = github.com, an `api_host` URL string = the alt
+ * host, `undefined` = unknown / not applicable. It only affects a
+ * *dual-host* repo (`api_host` + `exclusive: false`):
+ *   - `host === null` (github-hosted PR) → keep the GitHub/Graphite links
+ *     (subject to any explicit `links.github/graphite: false`) and hide the
+ *     alt-host external link.
+ *   - `host === '<url>'` (alt-hosted PR) → keep the external link and hide
+ *     the GitHub/Graphite links.
+ * Exclusive alt-host repos and plain github repos ignore `host` entirely, so
+ * existing two-arg callers (and `host === undefined`) render byte-identically
+ * to before this parameter existed.
+ *
  * @param {Object} config
  * @param {string} repository  Canonical `owner/repo` identifier
+ * @param {string|null} [host]  PR's resolved host: null=github, url=alt,
+ *                              undefined=unknown/not applicable
  * @returns {{ external: { label: string, url_template: string, icon: string|null }|null,
  *             github: boolean,
  *             graphite: boolean }}
  */
-function resolveRepoLinks(config, repository) {
+function resolveRepoLinks(config, repository, host = undefined) {
   const result = { external: null, github: true, graphite: true };
   if (!config || !repository) return result;
 
@@ -172,33 +188,47 @@ function resolveRepoLinks(config, repository) {
   if (!repoConfig || typeof repoConfig !== 'object') return result;
 
   const links = repoConfig.links;
-  if (!links || typeof links !== 'object') return result;
-
-  if (links.github === false) result.github = false;
-  if (links.graphite === false) result.graphite = false;
-
-  const ext = links.external;
-  if (ext && typeof ext === 'object'
-      && typeof ext.label === 'string' && ext.label
-      && typeof ext.url_template === 'string'
-      && ext.url_template.startsWith('https://')) {
-    let icon = null;
-    if (ext.icon !== undefined && ext.icon !== null && ext.icon !== '') {
-      icon = sanitizeSvgIcon(ext.icon);
-      if (icon === null) {
-        logger.warn(
-          `Dropping links.external.icon for "${repository}" — failed sanitisation.`
-        );
+  if (links && typeof links === 'object') {
+    if (links.github === false) result.github = false;
+    if (links.graphite === false) result.graphite = false;
+
+    const ext = links.external;
+    if (ext && typeof ext === 'object'
+        && typeof ext.label === 'string' && ext.label
+        && typeof ext.url_template === 'string'
+        && ext.url_template.startsWith('https://')) {
+      let icon = null;
+      if (ext.icon !== undefined && ext.icon !== null && ext.icon !== '') {
+        icon = sanitizeSvgIcon(ext.icon);
+        if (icon === null) {
+          logger.warn(
+            `Dropping links.external.icon for "${repository}" — failed sanitisation.`
+          );
+        }
       }
+      result.external = {
+        // Optional host display name (e.g. "Meteorite"). When absent, the
+        // field is null and consumers fall back to "GitHub" via resolveHostName.
+        name: (typeof ext.name === 'string' && ext.name) ? ext.name : null,
+        label: ext.label,
+        url_template: ext.url_template,
+        icon
+      };
+    }
+  }
+
+  // Per-PR host awareness for dual-host repos. A `host` of `undefined`
+  // (omitted arg, unknown host) leaves the repo-level result untouched, so
+  // non-dual repos and legacy two-arg callers are unaffected.
+  if (host !== undefined && isDualHostRepoConfig(repoConfig)) {
+    if (host === null) {
+      // github-hosted PR: the alt-host external link does not apply.
+      result.external = null;
+    } else {
+      // alt-hosted PR: hide the GitHub/Graphite links, keep the external one.
+      result.github = false;
+      result.graphite = false;
     }
-    result.external = {
-      // Optional host display name (e.g. "Meteorite"). When absent, the
-      // field is null and consumers fall back to "GitHub" via resolveHostName.
-      name: (typeof ext.name === 'string' && ext.name) ? ext.name : null,
-      label: ext.label,
-      url_template: ext.url_template,
-      icon
-    };
   }
 
   return result;
@@ -212,12 +242,20 @@ function resolveRepoLinks(config, repository) {
  * `"GitHub"`. This is the server-side counterpart to the frontend
  * `window.RepoLinks.hostName()` accessor.
  *
+ * Host-aware for dual-host repos: a github-hosted PR (`host === null`)
+ * reports "GitHub" even when an external name is configured, because
+ * `resolveRepoLinks` clears the external link for that host. See
+ * `resolveRepoLinks` for the `host` semantics. Non-dual repos and two-arg
+ * callers behave exactly as before.
+ *
  * @param {Object} config
  * @param {string} repository  Canonical `owner/repo` identifier
+ * @param {string|null} [host]  PR's resolved host: null=github, url=alt,
+ *                              undefined=unknown/not applicable
  * @returns {string} The configured host name, or "GitHub" by default
  */
-function resolveHostName(config, repository) {
-  const links = resolveRepoLinks(config, repository);
+function resolveHostName(config, repository, host = undefined) {
+  const links = resolveRepoLinks(config, repository, host);
   return (links.external && links.external.name) ? links.external.name : 'GitHub';
 }