git-workspace-bare 0.1.1 → 0.3.1

package/package.json

@@ -1,11 +1,14 @@
 {
   "name": "git-workspace-bare",
-  "version": "0.1.1",
+  "version": "0.3.1",
   "description": "Manage Git worktrees as development workspaces",
   "type": "module",
   "bin": {
     "git-workspace": "./bin/git-workspace.js"
   },
+  "man": [
+    "./man/man1/git-workspace.1"
+  ],
   "scripts": {
     "test": "bare test/lifecycle.js",
     "format": "prettier . --write",
@@ -13,6 +16,8 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
+    "bare-crypto": "^1.15.3",
+    "bare-env": "^3.0.1",
     "bare-fs": "^4.8.1",
     "bare-os": "^3.9.3",
     "bare-path": "^3.1.2",

package/test/add-offline.js

@@ -0,0 +1,240 @@
+import test from 'brittle'
+import fs from 'bare-fs'
+import path from 'bare-path'
+import setup from './helpers.js'
+
+const quote = (value) => "'" + value.replaceAll("'", "'\\''") + "'"
+
+function gitShim(context, body) {
+  const executable = path.join(context.bin, 'git')
+  const realGit = fs.realpathSync(executable)
+  fs.unlinkSync(executable)
+  fs.writeFileSync(executable, `#!/bin/sh\n${body}\nexec ${quote(realGit)} "$@"\n`, { mode: 0o755 })
+}
+
+test('add initializes an unavailable root, commits its registration and runs hooks', (t) => {
+  const context = setup(t)
+  const { cli, ok, git, registry, home, upstream, bin, run } = context
+  const root = path.join(home, 'workspace/owner/new')
+  const directory = path.dirname(registry)
+  const log = path.join(home, 'hook.json')
+  fs.writeFileSync(
+    path.join(bin, 'git-workspace-hook-add-post-capture'),
+    `#!/bin/sh\ncat > ${quote(log)}\n`,
+    { mode: 0o755 }
+  )
+  const result = cli('add', 'owner/new')
+  t.is(result.status, 0, result.stderr)
+  t.ok(result.stderr.includes('initialized an empty local repository with origin configured'))
+  t.absent(
+    result.stderr.includes('local workspace tracking unchanged'),
+    'unborn roots can be checkpointed'
+  )
+  t.is(git('-C', root, 'remote', 'get-url', 'origin'), `file://${upstream}/owner/new.git`)
+  t.is(git('-C', root, 'config', '--get', 'remote.origin.url'), 'git@github.com:owner/new.git')
+  t.is(git('-C', root, 'symbolic-ref', '--short', 'HEAD'), 'main', 'respects init.defaultBranch')
+  t.unlike(
+    run('git', ['-C', root, 'rev-parse', '--verify', 'HEAD']).status,
+    0,
+    'no synthetic first commit'
+  )
+  t.is(git('-C', root, 'status', '--porcelain'), '')
+  t.is(ok('status'), 'owner/new  clean\n')
+  t.absent(fs.existsSync(path.join(upstream, 'owner/new.git')), 'no remote repository created')
+  t.is(git('-C', directory, 'log', '-1', '--format=%s'), 'Add owner/new')
+  const head = git('-C', directory, 'rev-parse', 'HEAD')
+  t.is(git('-C', directory, 'rev-parse', 'refs/git-workspace/applied'), head)
+  const payload = JSON.parse(fs.readFileSync(log, 'utf8'))
+  const entry = JSON.parse(fs.readFileSync(registry, 'utf8')).repositories[0]
+  t.is(payload.result.status, 'ok')
+  t.is(payload.result.data.checkouts[0].before.exists, false)
+  t.is(payload.result.data.checkouts[0].after.id, entry.id)
+  t.is(payload.result.data.checkouts[0].after.registered, true)
+  t.is(payload.result.data.checkouts[0].after.branch, 'main')
+  t.is(ok('list'), 'owner/new\n')
+  gitShim(context, 'if [ "$1" = clone ]; then echo unexpected-clone >&2; exit 99; fi')
+  const repeated = cli('add', 'owner/new')
+  t.is(repeated.status, 0)
+  t.absent(repeated.stderr.includes('could not clone'), 'repeat add never retries cloning')
+  t.ok(
+    repeated.stderr.includes('could not push workspace manifest'),
+    'manifest push is retried independently'
+  )
+  t.is(git('-C', directory, 'rev-parse', 'HEAD'), head, 'repeat add creates no manifest commit')
+  t.is(JSON.parse(fs.readFileSync(log, 'utf8')).result.data.changed, false)
+  ok('rename', 'owner/new', 'owner/renamed')
+  ok('remove', 'owner/renamed')
+  t.is(ok('list'), '', 'empty local roots also support rename and remove')
+})
+
+for (const diagnostic of [
+  'Network is unreachable',
+  'Permission denied (publickey).',
+  'Could not resolve hostname github.com'
+]) {
+  test(`add works after SSH reports ${diagnostic}`, (t) => {
+    const context = setup(t)
+    const { cli, git, env, upstream, bin, root, home } = context
+    // Exercise Git's real SSH transport with a private fake executable, without networking.
+    git('config', '--file', env.GIT_CONFIG_GLOBAL, '--unset', `url.file://${upstream}/.insteadOf`)
+    env.GIT_ALLOW_PROTOCOL = 'ssh'
+    const log = path.join(home, 'ssh-args')
+    fs.writeFileSync(
+      path.join(bin, 'ssh'),
+      `#!/bin/sh\nprintf '%s\\n' "$@" > ${quote(log)}\necho ${quote(diagnostic)} >&2\nexit 255\n`,
+      { mode: 0o755 }
+    )
+    const result = cli('add', 'owner/repo')
+    t.is(result.status, 0, result.stderr)
+    t.ok(result.stderr.includes(diagnostic), 'original failure is visible')
+    t.ok(result.stderr.includes('initialized an empty local repository'))
+    const args = fs.readFileSync(log, 'utf8')
+    t.ok(args.includes('ConnectTimeout=5'))
+    t.ok(args.includes('ConnectionAttempts=1'))
+    t.ok(args.includes('BatchMode=yes'))
+    t.is(git('-C', root, 'status', '--porcelain'), '')
+    t.absent(fs.existsSync(path.join(root, 'tracked.txt')), 'no history was downloaded')
+  })
+}
+
+for (const setting of ['GIT_SSH', 'GIT_SSH_COMMAND', 'core.sshCommand']) {
+  test(`add honors custom SSH transport from ${setting}`, (t) => {
+    const { cli, git, env, upstream, home } = setup(t)
+    git('config', '--file', env.GIT_CONFIG_GLOBAL, '--unset', `url.file://${upstream}/.insteadOf`)
+    env.GIT_ALLOW_PROTOCOL = 'ssh'
+    const executable = path.join(home, 'custom ssh')
+    const log = path.join(home, 'custom-args')
+    fs.writeFileSync(
+      executable,
+      `#!/bin/sh\nprintf '%s\\n' "$@" >> ${quote(log)}\necho offline >&2\nexit 255\n`,
+      { mode: 0o755 }
+    )
+    if (setting === 'core.sshCommand') {
+      git('config', '--file', env.GIT_CONFIG_GLOBAL, setting, quote(executable) + ' --custom')
+    } else env[setting] = setting === 'GIT_SSH' ? executable : quote(executable) + ' --custom'
+    const result = cli('add', 'owner/repo')
+    t.is(result.status, 0, result.stderr)
+    t.ok(result.stderr.includes('offline'))
+    const args = fs.readFileSync(log, 'utf8')
+    t.absent(args.includes('ConnectTimeout='), 'custom transports retain their options')
+    if (setting !== 'GIT_SSH') t.ok(args.includes('--custom'))
+  })
+}
+
+test('existing checkouts and local branch worktrees do not fetch or clone project history', (t) => {
+  const context = setup(t)
+  const { ok, cli, git, root } = context
+  ok('add', 'owner/repo')
+  const head = git('-C', root, 'rev-parse', 'HEAD')
+  fs.writeFileSync(path.join(root, 'tracked.txt'), 'local edits\n')
+  gitShim(
+    context,
+    'case "$1" in clone|fetch|ls-remote) echo unexpected-network >&2; exit 99;; esac'
+  )
+  const repeated = cli('add', 'owner/repo')
+  t.is(repeated.status, 0)
+  t.absent(repeated.stderr.includes('could not clone'))
+  const added = cli('add', 'owner/repo@offline')
+  t.is(added.status, 0, added.stderr)
+  t.absent(added.stderr.includes('unexpected-network'))
+  t.is(git('-C', root + '@offline', 'rev-parse', 'HEAD'), head)
+  t.is(fs.readFileSync(path.join(root, 'tracked.txt'), 'utf8'), 'local edits\n')
+})
+
+for (const before of [false, true]) {
+  test(`add can initialize an empty destination ${before ? 'present before cloning' : 'left by a failed clone'}`, (t) => {
+    const context = setup(t)
+    const { cli, root, git } = context
+    if (before) fs.mkdirSync(root, { recursive: true })
+    gitShim(context, 'if [ "$1" = clone ]; then mkdir -p "$3"; echo offline >&2; exit 128; fi')
+    const result = cli('add', 'owner/repo')
+    t.is(result.status, 0, result.stderr)
+    t.ok(result.stderr.includes('initialized an empty local repository'))
+    t.is(git('-C', root, 'config', '--get', 'remote.origin.url'), 'git@github.com:owner/repo.git')
+  })
+}
+
+for (const target of ['partial', 'symlink', 'file']) {
+  test(`add preserves a ${target} destination left by a failed clone`, (t) => {
+    const context = setup(t)
+    const { cli, root, registry, home, git } = context
+    const external = path.join(home, 'external')
+    fs.mkdirSync(external)
+    const setupDestination =
+      target === 'partial'
+        ? 'mkdir "$3"; echo keep > "$3/partial"'
+        : target === 'symlink'
+          ? `ln -s ${quote(external)} "$3"`
+          : 'echo keep > "$3"'
+    gitShim(
+      context,
+      `if [ "$1" = clone ]; then ${setupDestination}; echo clone-failed >&2; exit 128; fi`
+    )
+    const contents = fs.readFileSync(registry, 'utf8')
+    const head = git('-C', path.dirname(registry), 'rev-parse', 'HEAD')
+    const result = cli('add', 'owner/repo')
+    t.is(result.status, 1)
+    t.ok(result.stderr.includes('destination was preserved'))
+    t.is(fs.readFileSync(registry, 'utf8'), contents)
+    t.is(git('-C', path.dirname(registry), 'rev-parse', 'HEAD'), head)
+    if (target === 'partial') t.is(fs.readFileSync(path.join(root, 'partial'), 'utf8'), 'keep\n')
+    if (target === 'symlink') t.ok(fs.lstatSync(root).isSymbolicLink())
+    if (target === 'file') t.is(fs.readFileSync(root, 'utf8'), 'keep\n')
+    t.alike(fs.readdirSync(external), [], 'nothing initialized through the symlink')
+  })
+}
+
+test('Git invocation, interruption, and local initialization failures remain errors', (t) => {
+  for (const failure of ['spawn', 'signal', 'init']) {
+    const context = setup(t)
+    const { cli, root, registry, bin } = context
+    const contents = fs.readFileSync(registry, 'utf8')
+    if (failure === 'spawn') fs.unlinkSync(path.join(bin, 'git'))
+    else if (failure === 'signal') gitShim(context, 'if [ "$1" = clone ]; then kill -TERM "$$"; fi')
+    else {
+      gitShim(
+        context,
+        'if [ "$1" = clone ]; then exit 128; fi\nif [ "$1" = init ]; then echo "cannot write repository: permission denied" >&2; exit 128; fi'
+      )
+    }
+    const result = cli('add', 'owner/repo')
+    t.is(result.status, 1, failure)
+    t.absent(fs.existsSync(path.join(root, '.git')))
+    t.is(fs.readFileSync(registry, 'utf8'), contents)
+    t.absent(result.stderr.includes('initialized an empty local repository'))
+  }
+})
+
+test('branch creation on a new empty root explains the first-commit requirement and can be retried', (t) => {
+  const { cli, ok, git, home, registry } = setup(t)
+  const root = path.join(home, 'workspace/owner/new')
+  const result = cli('add', 'owner/new@jobs')
+  t.is(result.status, 1)
+  t.ok(result.stderr.includes('has no commits; create its first commit'))
+  t.ok(fs.existsSync(path.join(root, '.git')))
+  const entries = JSON.parse(fs.readFileSync(registry, 'utf8')).repositories
+  t.is(entries[0].name, 'owner/new')
+  t.alike(entries[0].worktrees, [])
+  git('-C', root, 'commit', '--allow-empty', '-m', 'First commit')
+  ok('add', 'owner/new@jobs')
+  t.is(git('-C', root + '@jobs', 'symbolic-ref', '--short', 'HEAD'), 'jobs')
+  t.is(git('-C', path.dirname(registry), 'status', '--porcelain'), '')
+})
+
+test('offline registration can retry a failed manifest commit without replacing local work', (t) => {
+  const { cli, ok, git, home, registry } = setup(t)
+  const directory = path.dirname(registry)
+  const lock = path.join(directory, '.git/index.lock')
+  fs.writeFileSync(lock, '')
+  const result = cli('add', 'owner/new')
+  t.is(result.status, 1)
+  t.ok(result.stderr.includes('could not commit the manifest'))
+  const root = path.join(home, 'workspace/owner/new')
+  fs.writeFileSync(path.join(root, 'work.txt'), 'offline work\n')
+  const entry = JSON.parse(fs.readFileSync(registry, 'utf8')).repositories[0]
+  fs.unlinkSync(lock)
+  ok('add', 'owner/new')
+  t.is(fs.readFileSync(path.join(root, 'work.txt'), 'utf8'), 'offline work\n')
+  t.is(JSON.parse(fs.readFileSync(registry, 'utf8')).repositories[0].id, entry.id)
+  t.is(git('-C', directory, 'log', '-1', '--format=%s'), 'Add owner/new')
+})

package/test/checkpoint.js

@@ -0,0 +1,243 @@
+import test from 'brittle'
+import fs from 'bare-fs'
+import path from 'bare-path'
+import setup from './helpers.js'
+
+const ref = 'refs/git-workspace/applied'
+
+function manifest(registry) {
+  return JSON.parse(fs.readFileSync(registry, 'utf8'))
+}
+
+function save(git, registry, value) {
+  fs.writeFileSync(registry, JSON.stringify(value, null, 2) + '\n')
+  git('-C', path.dirname(registry), 'add', 'workspace.json')
+  git(
+    '-C',
+    path.dirname(registry),
+    'commit',
+    '--only',
+    '-m',
+    'Manifest update',
+    '--',
+    'workspace.json'
+  )
+}
+
+test('init and successful mutations advance the local checkpoint without extra commits', (t) => {
+  const { ok, git, registry, checked } = setup(t)
+  const directory = path.dirname(registry)
+  const head = () => git('-C', directory, 'rev-parse', 'HEAD')
+  t.is(checked('--show').trim(), head(), 'empty init applied')
+  for (const args of [
+    ['add', 'owner/repo@jobs'],
+    ['rename', 'owner/repo@jobs', 'owner/repo@fixes'],
+    ['rename', 'owner/repo', 'other/new'],
+    ['remove', 'other/new@fixes'],
+    ['remove', 'other/new']
+  ]) {
+    ok(...args)
+    t.is(checked('--show').trim(), head(), args[0] + ' checkpointed')
+  }
+  t.is(git('-C', directory, 'rev-list', '--count', 'HEAD'), '6')
+  const before = head()
+  t.is(checked().trim(), before)
+  t.is(head(), before, 'verification does not commit')
+  t.is(git('-C', directory, 'status', '--porcelain'), '', 'no machine data in working tree')
+})
+
+test('existing checkouts are verified on bootstrap, and dirty work is allowed', (t) => {
+  const { ok, git, registry, root, checked } = setup(t)
+  const directory = path.dirname(registry)
+  ok('add', 'owner/repo@jobs')
+  git('-C', directory, 'update-ref', '-d', ref)
+  t.is(checked('--show'), 'No applied checkpoint\n')
+  fs.writeFileSync(path.join(root, 'tracked.txt'), 'root edits\n')
+  fs.writeFileSync(path.join(root + '@jobs', 'tracked.txt'), 'worktree edits\n')
+  const index = fs.readFileSync(path.join(root, '.git/index'))
+  const head = git('-C', directory, 'rev-parse', 'HEAD')
+  ok('init', 'owner/workspace')
+  t.is(checked('--show').trim(), head)
+  t.is(fs.readFileSync(path.join(root, 'tracked.txt'), 'utf8'), 'root edits\n')
+  t.is(fs.readFileSync(path.join(root + '@jobs', 'tracked.txt'), 'utf8'), 'worktree edits\n')
+  t.alike(
+    fs.readFileSync(path.join(root, '.git/index')),
+    index,
+    'verification does not refresh index'
+  )
+})
+
+test('cloning a manifest on another machine does not copy or prematurely create a checkpoint', (t) => {
+  const { ok, cliAt, git, registry, home, upstream, checked, checkAt } = setup(t)
+  ok('add', 'owner/repo@jobs')
+  git('clone', '--bare', path.dirname(registry), path.join(upstream, 'owner/workspace.git'))
+  const second = path.join(home, 'second')
+  fs.mkdirSync(second)
+  const initialized = cliAt(second, 'init', 'owner/workspace')
+  t.is(initialized.status, 0)
+  t.ok(initialized.stderr.includes('Missing checkout'))
+  t.is(checkAt(second, '--show').stdout, 'No applied checkpoint\n')
+  t.is(cliAt(second, 'add', 'owner/repo').status, 0)
+  t.is(
+    checkAt(second, '--show').stdout,
+    'No applied checkpoint\n',
+    'missing worktree prevents partial checkpoint'
+  )
+  t.is(cliAt(second, 'add', 'owner/repo@jobs').status, 0)
+  t.is(checkAt(second, '--show').stdout, checked('--show'))
+})
+
+test('a failed branch operation does not advance and retry checkpoints the whole manifest', (t) => {
+  const { cli, ok, registry, root, check, checked } = setup(t)
+  const before = checked('--show')
+  fs.mkdirSync(root + '@jobs', { recursive: true })
+  t.is(cli('add', 'owner/repo@jobs').status, 1)
+  t.is(checked('--show'), before)
+  t.is(check().status, 1, 'uncommitted partial registration not checkpointed')
+  fs.rmdirSync(root + '@jobs')
+  ok('add', 'owner/repo@jobs')
+  t.not(checked('--show'), before)
+  t.is(manifest(registry).repositories[0].worktrees.length, 1)
+})
+
+for (const args of [
+  ['add', 'owner/repo@next'],
+  ['remove', 'owner/repo@jobs'],
+  ['rename', 'owner/repo', 'owner/new']
+]) {
+  test(`failed ${args[0]} commit preserves checkpoint until recovery`, (t) => {
+    const { cli, ok, git, registry, check, checked } = setup(t)
+    const directory = path.dirname(registry)
+    ok('add', 'owner/repo@jobs')
+    const before = checked('--show')
+    const hooks = path.join(directory, '.git/hooks')
+    git('-C', directory, 'config', 'core.hooksPath', hooks)
+    const hook = path.join(hooks, 'pre-commit')
+    fs.writeFileSync(hook, '#!/bin/sh\nexit 1\n')
+    fs.chmodSync(hook, 0o755)
+    t.is(cli(...args).status, 1)
+    t.is(checked('--show'), before)
+    t.is(check().status, 1)
+    fs.unlinkSync(hook)
+    git('-C', directory, 'commit', '--only', '-m', 'Recover operation', '--', 'workspace.json')
+    t.is(checked('--show'), before, 'manual commit alone does not advance')
+    t.is(checked().trim(), git('-C', directory, 'rev-parse', 'HEAD'))
+  })
+}
+
+test('unresolved checkouts hold back successful unrelated commands and read-only commands', (t) => {
+  const { cli, ok, git, registry, root, check, checked } = setup(t)
+  const directory = path.dirname(registry)
+  ok('add', 'owner/repo@jobs')
+  const before = checked('--show')
+  fs.renameSync(root + '@jobs', root + '@temporarily-moved')
+  const result = cli('add', 'owner/repo')
+  t.is(result.status, 0)
+  t.ok(result.stderr.includes('local workspace tracking unchanged'))
+  t.is(check().status, 1)
+  ok('list')
+  ok('status')
+  t.is(checked('--show'), before)
+  fs.renameSync(root + '@temporarily-moved', root + '@jobs')
+  git('-C', directory, 'commit', '--allow-empty', '-m', 'Other manifest repo work')
+  ok('list')
+  ok('status')
+  t.is(checked('--show'), before, 'read-only commands do not advance to new HEAD')
+  t.is(checked().trim(), git('-C', directory, 'rev-parse', 'HEAD'))
+})
+
+test('bootstrap rejects wrong origins, wrong branches, detached HEAD, and foreign checkouts', (t) => {
+  const { ok, git, registry, root, upstream, check, checked } = setup(t)
+  const directory = path.dirname(registry)
+  ok('add', 'owner/repo@jobs')
+  git('-C', directory, 'update-ref', '-d', ref)
+  git('-C', root, 'remote', 'set-url', 'origin', 'git@github.com:other/repo.git')
+  t.is(check().status, 1)
+  git('-C', root, 'remote', 'set-url', 'origin', 'git@github.com:owner/repo.git')
+  git('-C', root + '@jobs', 'switch', '-c', 'different')
+  t.is(check().status, 1)
+  git('-C', root + '@jobs', 'checkout', '--detach')
+  t.is(check().status, 1)
+  git('-C', root + '@jobs', 'switch', 'jobs')
+  fs.renameSync(root + '@jobs', root + '@saved')
+  git('clone', path.join(upstream, 'owner/repo.git'), root + '@jobs')
+  git('-C', root + '@jobs', 'switch', '-c', 'jobs')
+  t.is(check().status, 1, 'same branch in a separate clone is not a linked worktree')
+  fs.renameSync(root + '@jobs', root + '@foreign')
+  fs.symlinkSync(root + '@saved', root + '@jobs')
+  t.is(check().status, 1, 'symlink refused')
+  fs.unlinkSync(root + '@jobs')
+  fs.renameSync(root + '@saved', root + '@jobs')
+  t.is(checked('--show'), 'No applied checkpoint\n')
+  t.is(checked().trim(), git('-C', directory, 'rev-parse', 'HEAD'))
+})
+
+test('checkpoint requires a committed manifest but preserves unrelated staged edits', (t) => {
+  const { git, registry, check, checked } = setup(t)
+  const directory = path.dirname(registry)
+  const before = checked('--show')
+  const contents = fs.readFileSync(registry, 'utf8')
+  fs.writeFileSync(registry, contents + '\n')
+  t.is(check().status, 1)
+  git('-C', directory, 'add', 'workspace.json')
+  fs.writeFileSync(registry, contents)
+  t.is(check().status, 1, 'staged changes block even when working copy matches HEAD')
+  t.is(checked('--show'), before)
+  git('-C', directory, 'restore', '--staged', 'workspace.json')
+  fs.writeFileSync(path.join(directory, 'other.txt'), 'keep staged\n')
+  git('-C', directory, 'add', 'other.txt')
+  const staged = git('-C', directory, 'diff', '--cached')
+  t.is(checked(), before)
+  t.is(git('-C', directory, 'diff', '--cached'), staged)
+})
+
+test('manual removals and reused IDs cannot hide old checkouts from the checkpoint', (t) => {
+  const { ok, git, registry, root, check, checked } = setup(t)
+  ok('add', 'owner/repo')
+  const before = checked('--show')
+  const changed = manifest(registry)
+  changed.repositories[0].id = 'replacement-id'
+  save(git, registry, changed)
+  t.is(check().status, 1, 'same path with a different ID is ambiguous')
+  t.is(checked('--show'), before)
+  save(git, registry, { version: 1, repositories: [] })
+  t.is(check().status, 1, 'removed entry still on disk')
+  t.ok(fs.existsSync(root), 'verification never deletes a checkout')
+  ok('remove', 'owner/repo')
+  t.not(checked('--show'), before, 'actual removal resolves mismatch')
+})
+
+test('stale linked worktree records block checkpointing a removal', (t) => {
+  const { ok, git, registry, root, check, checked } = setup(t)
+  ok('add', 'owner/repo@jobs')
+  const before = checked('--show')
+  fs.renameSync(root + '@jobs', root + '@elsewhere')
+  const changed = manifest(registry)
+  changed.repositories[0].worktrees = []
+  save(git, registry, changed)
+  const result = check()
+  t.is(result.status, 1)
+  t.ok(result.stderr.includes('still has a Git record'))
+  t.is(checked('--show'), before)
+})
+
+test('checkpoint does not follow rewritten history or symbolic checkpoint refs', (t) => {
+  const { ok, git, registry, check, checked } = setup(t)
+  const directory = path.dirname(registry)
+  ok('add', 'owner/repo')
+  const before = checked('--show')
+  git('-C', directory, 'checkout', '-b', 'rewritten', 'HEAD~1')
+  git('-C', directory, 'commit', '--allow-empty', '-m', 'Different history')
+  t.is(check().status, 1)
+  t.is(checked('--show'), before)
+  const head = git('-C', directory, 'rev-parse', 'HEAD')
+  git('-C', directory, 'symbolic-ref', ref, 'refs/heads/rewritten')
+  t.is(check().status, 1)
+  t.is(git('-C', directory, 'rev-parse', 'HEAD'), head, 'symbolic ref cannot move a branch')
+})
+
+test('checkpoint is internal and absent from CLI help', (t) => {
+  const { cli, ok } = setup(t)
+  t.absent(ok('-h').includes('checkpoint'))
+  t.not(cli('checkpoint').status, 0)
+})