Guard entire attach against overwriting checkpoints from other machines

[Soph]

https://entire.io/gh/entireio/cli/trails/cf1eb592e195

Summary

A production report surfaced a scenario where entire attach could silently clobber a colleague's session data. If Alice creates checkpoint abc123 on her machine and pushes the code commit (with Entire-Checkpoint: abc123 trailer) without also pushing entire/checkpoints/v1, then Bob pulls the commit and runs entire attach, Bob's attach reuses ID abc123, writes a fresh session 0 locally, and on push overwrites Alice's session data.

This branch adds two layers of defence and one diagnostic tripwire.

Changes

entire attach refuses to overwrite

When HEAD already carries an Entire-Checkpoint: trailer, attach now verifies the checkpoint is present on the local entire/checkpoints/v1 branch before writing:

1. Fast path: read locally first — no network if we already have it.
2. Fallback: if missing, run the same metadata fetch chain entire resume uses (checkpoint_remote → treeless origin fetch → full origin fetch → remote-tracking).
3. Refuse: if it's still missing after the refresh, error out with an actionable hint. The suggested git fetch command targets the configured checkpoint_remote when present, otherwise origin.

Tripwire in writeStandardCheckpointEntries

If a session-0 write is about to replace metadata from a different session ID (a tree-corruption / stale-summary shape, not a routine overwrite path), emit a loud logging.Warn with both session IDs so future regressions leave a trace.

Tests

• TestAttach_AppendsAsAdditionalSessionWhenIDDiffers — positive path: two attaches on the same commit land as session 0 and session 1 under the same checkpoint.
• TestAttach_RefusesWhenCheckpointMissingFromLocalBranch — negative path: commit bears a trailer for a nonexistent checkpoint; attach errors with the actionable hint and creates nothing.
• TestWriteStandardCheckpointEntries_WarnsOnUnexpectedSessionZeroOverwrite — verifies the tripwire fires and captures both session IDs.

Behaviour notes

• Offline repeat-attach on an already-local checkpoint: zero network calls.
• Offline attach against a missing checkpoint: best-effort fetch logs a warning, then the refuse error prints.
• Commits without an Entire-Checkpoint: trailer are unaffected — new attaches create fresh IDs as before.
• The refuse guard protects both the v1 write and the v2 dual-write, since it runs before either.

Test plan

• mise run check
• Manual: create a checkpoint locally, delete entire/checkpoints/v1 locally, run entire attach against the commit → verify refuse + hint
• Manual: run entire attach twice on the same session-free commit → verify second attach appends as session 1 without a network fetch

---

Note

Medium Risk
Medium risk because it changes entire attach behavior around checkpoint reuse and git metadata fetching, which can affect users’ ability to attach sessions and may surface new failure modes in repos with unusual ref/remote setups.

Overview
Prevents entire attach from accidentally overwriting an existing checkpoint ID created on another machine by verifying the referenced checkpoint exists locally before writing; if missing, it attempts the same metadata refresh chain as resume and then refuses with an actionable git fetch hint.

Adds a diagnostic tripwire in checkpoint writes that warns when a session-0 write would replace metadata for a different session ID (stale/corrupt tree shape), plus new tests covering append-as-new-session behavior, refusal on missing checkpoint metadata, and the warning emission.

^{Reviewed by Cursor Bugbot for commit a5be08c. Configure here.}

[Copilot]

Pull request overview

Guards entire attach against accidentally overwriting checkpoint metadata when a commit references an Entire-Checkpoint: ID that isn’t present locally, and adds a logging “tripwire” to help detect unexpected session-0 overwrites.

Changes:

• Add an entire attach pre-write guard that verifies the referenced checkpoint exists locally (with a refresh attempt) and refuses with an actionable git fetch hint if not.
• Add a warning tripwire in writeStandardCheckpointEntries when session 0 would overwrite metadata from a different session ID.
• Add tests covering: session appends on repeated attach, refusal on missing checkpoint, and tripwire warning emission.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
cmd/entire/cli/attach.go	Adds checkpoint-availability guard + fetch-command hint; ensures logs are closed per run.
cmd/entire/cli/attach_test.go	Adds regression tests for “append vs overwrite” and “refuse when missing” behavior.
cmd/entire/cli/checkpoint/committed.go	Adds tripwire warning when session-0 overwrite looks suspicious.
cmd/entire/cli/checkpoint/committed_tripwire_test.go	Adds a unit test asserting the tripwire warning is logged with both session IDs.

[computermode]

Added some questions for my understanding but looks good 🙌🏻

[computermode]

Thank you!