Validate checkpoint ID in RefName (reject malformed refs)

d71e071→main

RefName previously returned refs/entire/checkpoints// for an empty/invalid checkpoint ID, and callers built on the convention that the ID was already validated. Make RefName return (plumbing.ReferenceName, error), erroring when the ID is empty or an unrecognized format, so a bad ID can't silently become a malformed ref that gets pushed/fetched/looked up. Store call sites (refBase/setRef/resolveRefMaybeFetch/GetCheckpointAuthor) and the explain-on-clone fetch propagate the error; tests use a mustRefName helper for known-valid IDs and add a RefName_RejectsInvalidID case.

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

Sessions

Changes

8

• cmd/entire/cli

• checkpoint

• Mpushqueue_test.go+6/-6

• Mrefs_naming.go+11/-2

• Mrefs_naming_test.go+21/-2

• Mrefs_store.go+18/-4

• Mrefs_store_seam_test.go+1/-1

• Mrefs_store_test.go+7/-7

• Mexplain_export.go+5/-1

• strategy

• Mrefs_push_test.go+11/-3

t.Parallel()
q := NewPushQueue(t.TempDir())

a := RefName("a1b2c3d4e5f6")
b := RefName("b2c3d4e5f6a1")
a := mustRefName(t, "a1b2c3d4e5f6")
b := mustRefName(t, "b2c3d4e5f6a1")

// Empty queue drains to nothing.
refs, err := q.Drain()

func TestPushQueue_DrainDedupes(t *testing.T) {

t.Parallel() q := NewPushQueue(t.TempDir()) a := RefName("a1b2c3d4e5f6") a := mustRefName(t, "a1b2c3d4e5f6")

require.NoError(t, q.Enqueue(a)) require.NoError(t, q.Enqueue(a)) }

func TestPushQueue_RemovePreservesLaterEntries(t *testing.T) {

t.Parallel() q := NewPushQueue(t.TempDir()) a := RefName("a1b2c3d4e5f6") b := RefName("b2c3d4e5f6a1") a := mustRefName(t, "a1b2c3d4e5f6") b := mustRefName(t, "b2c3d4e5f6a1")

// Simulate: drain sees [a], then b is enqueued during the push, then we // Remove(a). b must survive for the next pre-push. }

// Define additional tests and functions as needed.