# Route checkpoints through entire:// push-through mirrors

`855b8cd`→[main](/content/gh/entireio/cli/commits/main/index.html)  
  
toothbrush·5d ago·3 files·+100 added/-35 removed

When origin (or the push remote) is an entire:// mirror URL and its forge
matches the configured checkpoint_remote provider (gh <-> github),
derive the checkpoint URL on the same cluster
(entire://<cluster>/<forge>/<checkpoint-repo>) instead of falling back
to direct SSH/HTTPS against the provider host. The provider-host
fallback remains for file:// and forge-mismatched mirrors, and
ENTIRE_CHECKPOINT_TOKEN still forces provider HTTPS since the token
cannot ride through the helper.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

## Sessions

01KXCGE6FQGMQB906H5TAVVRZ9View transcript

## Changes

3

- cmd/entire/cli/checkpoint/remote  
  
  - Mutil.go+39/-16
  
  - Mutil_test.go+59/-17

- docs/testing  
  
  - Mgit-remote-test-plan.md+2/-2

```
17 unmodified lines

const originRemote = "origin"

const (
	ProtocolSSH   = gitremote.ProtocolSSH
	ProtocolHTTPS = gitremote.ProtocolHTTPS
	ProtocolSSH    = gitremote.ProtocolSSH
	ProtocolHTTPS  = gitremote.ProtocolHTTPS
	ProtocolEntire = gitremote.ProtocolEntire
)

// Info is an alias for gitremote.Info.

```

pushURL, err := deriveCheckpointURLFromInfo(pushInfo, config)
if err != nil {
	// The push remote's protocol can't be mapped to a git transport
	// (e.g. entire://, file://). Honor the configured checkpoint_remote by
	// targeting the provider's canonical host over HTTPS rather than falling
	// back to origin.
	if providerURL, ok := resolveProviderCheckpointURL(config, ""); ok {
		return providerURL, nil
	}
}
```

// isDerivableProtocol reports whether deriveCheckpointURLFromInfo can map the
// protocol to a checkpoint URL (i.e. it's a real git transport, not a remote
// helper scheme like entire:// or a local file://).
func isDerivableProtocol(protocol string) bool {
}

```c
if withToken && pushInfo.Protocol == ProtocolEntire {
	// The checkpoint token is an HTTPS credential for the provider host;
	// it can't ride through the entire:// helper (which does its own
	// auth). Route to the provider over HTTPS instead of the mirror.
	if providerURL, ok := resolveProviderCheckpointURL(config, ""); ok {
		return providerURL, true, nil
	}
}

## Test Example

| testName                                                        | result                                 |
|---------------------------------------------------------------|--------------------------------------|
| existing ssh github remote yields ssh checkpoint url          | git@github.com:entireio/cli-checkpoints.git |
| existing https github remote yields https checkpoint url      | https://github.com/entireio/cli-checkpoints.git |
| no signal defaults to ssh                                     | git@github.com:entireio/cli-checkpoints.git  |
| token forces https over existing ssh remote                   | https://github.com/entireio/cli-checkpoints.git |
| entire push remote keeps cluster and forge                    | entire://cluster.example.com/gh/org/checkpoints |
| entire push remote with forge not matching provider           | error in deriving checkpoint URL     |
| invalid push remote                                           | error in push remote URL             |

### Destructive local-v1-ref moves
- The single most re-broken area: #953, `96034892c`, #1252, #1251, #1260
- Cross-clone replay fidelity
- Remote-target precedence