Route checkpoints through entire:// push-through mirrors · Entire

Route checkpoints through entire:// push-through mirrors

855b8cd→main

toothbrush·5d ago·3 files·+100 added/-35 removed

When origin (or the push remote) is an entire:// mirror URL and its forge matches the configured checkpoint_remote provider (gh <-> github), derive the checkpoint URL on the same cluster (entire:////) instead of falling back to direct SSH/HTTPS against the provider host. The provider-host fallback remains for file:// and forge-mismatched mirrors, and ENTIRE_CHECKPOINT_TOKEN still forces provider HTTPS since the token cannot ride through the helper.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com

Sessions

01KXCGE6FQGMQB906H5TAVVRZ9View transcript

Changes

3

17 unmodified lines

const originRemote = "origin"

const (
    ProtocolSSH   = gitremote.ProtocolSSH
    ProtocolHTTPS = gitremote.ProtocolHTTPS
    ProtocolSSH    = gitremote.ProtocolSSH
    ProtocolHTTPS  = gitremote.ProtocolHTTPS
    ProtocolEntire = gitremote.ProtocolEntire
)

// Info is an alias for gitremote.Info.

pushURL, err := deriveCheckpointURLFromInfo(pushInfo, config) if err != nil { // The push remote's protocol can't be mapped to a git transport // (e.g. entire://, file://). Honor the configured checkpoint_remote by // targeting the provider's canonical host over HTTPS rather than falling // back to origin. if providerURL, ok := resolveProviderCheckpointURL(config, ""); ok { return providerURL, nil } }


// isDerivableProtocol reports whether deriveCheckpointURLFromInfo can map the
// protocol to a checkpoint URL (i.e. it's a real git transport, not a remote
// helper scheme like entire:// or a local file://).
func isDerivableProtocol(protocol string) bool {
}

```c
if withToken && pushInfo.Protocol == ProtocolEntire {
    // The checkpoint token is an HTTPS credential for the provider host;
    // it can't ride through the entire:// helper (which does its own
    // auth). Route to the provider over HTTPS instead of the mirror.
    if providerURL, ok := resolveProviderCheckpointURL(config, ""); ok {
        return providerURL, true, nil
    }
}

## Test Example

| testName                                                        | result                                 |
|---------------------------------------------------------------|--------------------------------------|
| existing ssh github remote yields ssh checkpoint url          | git@github.com:entireio/cli-checkpoints.git |
| existing https github remote yields https checkpoint url      | https://github.com/entireio/cli-checkpoints.git |
| no signal defaults to ssh                                     | git@github.com:entireio/cli-checkpoints.git  |
| token forces https over existing ssh remote                   | https://github.com/entireio/cli-checkpoints.git |
| entire push remote keeps cluster and forge                    | entire://cluster.example.com/gh/org/checkpoints |
| entire push remote with forge not matching provider           | error in deriving checkpoint URL     |
| invalid push remote                                           | error in push remote URL             |

### Destructive local-v1-ref moves
- The single most re-broken area: #953, `96034892c`, #1252, #1251, #1260
- Cross-clone replay fidelity
- Remote-target precedence