Route checkpoints to provider host when origin protocol is non-derivable

[pjbgf]

https://entire.io/gh/entireio/cli/trails/435

When a checkpoint_remote is configured but the origin/push remote uses a
protocol that can't be mapped to a git transport (e.g. entire://, file://),
PushURL/FetchURL fell back to pushing checkpoints to the origin remote. For
an entire:// origin this meant the entire/checkpoints/v1 branch was pushed
to the entire:// remote helper, which doesn't host it — the push failed
non-fast-forward, the recovery sync hit its 2-minute timeout, and the
git-remote-entire helper wedged on shutdown.

The token path already handled this correctly via providerHost; the no-token
path did not. Add providerCheckpointURL as a shared fallback so a configured
checkpoint_remote with a known provider (github/gitlab) routes to that
provider's canonical host over HTTPS regardless of the origin scheme.

Plain local-path origins (no parseable URL) still fall back to origin: they
fail at ParseURL, an earlier branch this change does not touch. Fork
detection (owner mismatch) still runs before the fallback.

Whenever available, use entiredb-original-url to determine the correct authentication method to be used.

---

Note

Medium Risk
Changes where checkpoint git pushes/fetches target and how auth scheme is chosen; mistakes could misroute or break checkpoint sync for mirrored entire:// setups.

Overview
When checkpoint_remote is set but origin/push uses a non-git transport (entire://, file://, etc.), FetchURL and PushURL no longer fall back to pushing checkpoints at that remote. They call resolveProviderCheckpointURL, which builds the configured provider repo URL using transport precedence: saved remote.<name>.entiredb-original-url, then ENTIRE_CHECKPOINT_TOKEN → HTTPS on the provider host, then an existing remote on that host, else SSH. Unknown providers still fall back to origin.

ENTIRE_CHECKPOINT_TOKEN coercion to HTTPS now runs only for ssh/https remotes so entire:// hosts are not misused; non-derivable push remotes use the same provider fallback (push stays enabled when it applies).

gitremote.ParseURL understands entire:// by stripping the leading forge segment from the path so owner/repo parse correctly. Tests cover entire:///file:// routing, token behavior, and pre-mirror URL vs other remotes.

^{Reviewed by Cursor Bugbot for commit 904f279. Configure here.}

[Copilot]

Pull request overview

Fixes checkpoint remote resolution when the origin/push remote uses a non-derivable scheme (e.g. entire://, file://) by routing checkpoint push/fetch to the configured provider’s canonical host instead of falling back to the origin helper URL. This aligns the non-token path with the existing token-based provider-host behavior and reduces sync failures for mirrored entire:// origins.

Changes:

• Teach gitremote.ParseURL to parse entire:// remotes by stripping the forge prefix segment (e.g. /gh/...).
• Add a provider-host fallback (resolveProviderCheckpointURL) for PushURL/FetchURL when checkpoint URL derivation fails due to non-derivable origin/push protocols.
• Add tests covering entire:///file:// origins and scheme selection precedence (saved pre-mirror URL, token, existing remote, default SSH).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
cmd/entire/cli/gitremote/gitremote.go	Adds entire:// parsing support via forge-prefix stripping.
cmd/entire/cli/gitremote/gitremote_test.go	Adds coverage for entire:// parsing behavior.
cmd/entire/cli/checkpoint/remote/util.go	Adds provider-host fallback resolution and transport selection logic for non-derivable remotes.
cmd/entire/cli/checkpoint/remote/util_test.go	Adds regression tests for entire:///file:// origins and transport precedence.

Comments suppressed due to low confidence (1)

cmd/entire/cli/checkpoint/remote/util.go:460

• deriveTokenOriginURL() will now successfully parse entire:// remotes (because ParseURL strips the forge prefix), and then synthesize an https:////.git URL. When ENTIRE_CHECKPOINT_TOKEN is set but checkpoint_remote is missing/unknown (or settings load fails), this can cause PushURL/FetchURL fallback behavior to misroute from the original entire:// remote helper to a likely-nonexistent HTTPS endpoint on the Entire host.

func deriveTokenOriginURL(originURL string) (string, bool) {
	info, err := gitremote.ParseURL(originURL)
	if err != nil {
		return "", false
	}
	if info.Host == "" || info.Owner == "" || info.Repo == "" {
		return "", false
	}
	// Keep the port only when the source was already HTTPS. SSH ports
	// (e.g., :2222) don't map to HTTPS ports on the same host.
	hostPort := info.Host
	if info.Protocol == ProtocolHTTPS {
		hostPort = info.HostPort()
	}
	return fmt.Sprintf("https://%s/%s/%s.git", hostPort, info.Owner, info.Repo), true
}