address checkpoint policy feedback

b01442a· pfleidi·3w ago·6 files·+145 added/-11 removed

Preserve local policy history when updating and reject true divergence before rewriting the policy ref.

Accept SHA-256 object IDs from remote policy refs and keep policy upgrade warnings enabled for hidden user aliases while still excluding hidden infrastructure commands.

Sessions

2bfd7535ed16View transcript

[?
Implement Checkpoint Policy Management SystemCodex·GPT-5.5·2 steps](/content/gh/entireio/cli/session/019ef111-70d5-7203-b653-e4834b8b92c0#timeline-2bfd7535ed16/index.html)

Changes

6

• cmd/entire/cli

• Mcheckpoint_policy_warning.go+10/-1

• Mcheckpoint_policy_warning_test.go+8

• checkpointpolicy

• Mremote.go+24/-3

• Aremote_internal_test.go+28

• Mupdate.go+15/-2

• Mupdate_test.go+60/-5

15 unmodified lines

...

func isCheckpointPolicyWarningExcludedCommand(name string) bool {
    switch name {
    case "hooks", "__send_analytics", "curl-bash-post-install":
        return true
    default:
        return false
    }
}

func WarnCheckpointPolicyIfNeeded(ctx context.Context, w io.Writer, currentVersion string) {
    repo, err := gitrepo.OpenCurrent(ctx)
    if err != nil {

func Sync(ctx context.Context, repo *git.Repository, target Target) (State, error) {

func parseRemotePolicyHash(raw string) (plumbing.Hash, error) {
    if !isSupportedRemotePolicyHashLength(raw) {
        return plumbing.ZeroHash, fmt.Errorf("invalid remote checkpoint policy hash %q", raw)
    }
    hash, ok := plumbing.FromHex(raw)
    if !ok {
        return plumbing.ZeroHash, fmt.Errorf("invalid remote checkpoint policy hash %q", raw)
    }
    return hash, nil
}

func TestUpdateRejectsDowngradeFromRemoteWithoutForce(t *testing.T) {
    t.Parallel()
    remoteDir, remoteRepo, bareDir := initPolicyRemoteFixture(t)
    remoteHash, err := checkpointpolicy.WriteLocal(t.Context(), remoteRepo, plumbing.ZeroHash, checkpointpolicy.Policy{
    ...
}
}

...