Handle non-ASCII titles during automatic branch derivation

.github/workflows/e2e-controlplane.yml

@@ -0,0 +1,54 @@
+name: E2E Control Plane
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+
+# One shared test account with a three-org quota: never two runs at once, and
+# never cancel one mid-flight — a cancelled run skips t.Cleanup and leaks the
+# resources it created.
+concurrency:
+  group: e2e-controlplane
+  cancel-in-progress: false
+
+permissions: {}
+
+jobs:
+  controlplane:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup mise
+        uses: jdx/mise-action@f10502fc09dadecfefb962fff68ce77213930204 # v4
+
+      # The mise task installs Chromium itself; this step adds the OS packages
+      # Chromium needs, which require root.
+      - name: Install Playwright driver, Chromium, and system dependencies
+        run: |
+          version="$(go list -m -f '{{.Version}}' github.com/mxschmitt/playwright-go)"
+          go run "github.com/mxschmitt/playwright-go/cmd/playwright@$version" install --with-deps chromium
+
+      - name: Run control-plane E2E tests
+        env:
+          E2E_GH_USERNAME: ${{ secrets.E2E_GH_USERNAME }}
+          E2E_GH_PASSWORD: ${{ secrets.E2E_GH_PASSWORD }}
+          E2E_GH_TOTP_SECRET: ${{ secrets.E2E_GH_TOTP_SECRET }}
+        run: mise run test:e2e:controlplane
+
+      - name: Upload artifacts
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: e2e-controlplane-artifacts
+          path: e2e/artifacts/
+          retention-days: 7

.github/workflows/nightly-e2e.yml

@@ -1,8 +1,8 @@
 name: Nightly Install Smoke
 
 # Every other E2E workflow builds the CLI from source. This one installs the
-# published nightly the way a user does and runs one smoke test per agent
-# against it, on each OS.
+# published releases the way a user does: the nightly, with one smoke test per
+# agent against it on each OS, and the stable cask, which is install-only.
 
 on:
   schedule:
@@ -70,9 +70,7 @@ jobs:
         if: matrix.os == 'macos-latest'
         run: |
           set -euo pipefail
-          brew tap entireio/tap
-          brew trust entireio/tap
-          brew install --cask entire@nightly
+          brew install --cask entireio/tap/entire@nightly
 
       # The README's nightly invocation. The installer updates only the stored
       # user PATH, which later steps do not re-read, hence GITHUB_PATH.
@@ -195,11 +193,14 @@ jobs:
       # would kill a recovering run and report it as a failure.
       #
       # In each body: `set +e` because GitHub already runs `shell: bash` with
-      # -e, which would end the step before its result row is written. The
-      # `Total: 0` check because a filter matching no test exits 0 with "[no
-      # tests to run]", which would report every agent as passing. Per-agent
-      # E2E_ARTIFACT_DIR because the mise task otherwise derives one shared dir
-      # and later agents overwrite earlier reports.
+      # -e, which would end the step before its result row is written; the
+      # closing `exit "$rc"` then reports the agent's own verdict on its own
+      # step, and the `!cancelled()` gates above are what keep the later agents
+      # running after it fails. The `Total: 0` check because a filter matching
+      # no test exits 0 with "[no tests to run]", which would report every
+      # agent as passing. Per-agent E2E_ARTIFACT_DIR because the mise task
+      # otherwise derives one shared dir and later agents overwrite earlier
+      # reports.
       #
       # E2E_ENTIRE_BIN (job env, set above) is what makes this the *installed*
       # nightly: the mise task skips its build when it is set.
@@ -222,6 +223,7 @@ jobs:
           rc=$?
           grep -q '^Total: 0 ' "$ARTIFACT_ROOT/$AGENT/report.txt" 2>/dev/null && rc=1
           echo "$AGENT $rc" >> e2e/artifacts/results.txt
+          exit "$rc"
 
       - name: Smoke test opencode
         if: ${{ !cancelled() && contains(format(' {0} ', env.AGENTS), ' opencode ') }}
@@ -240,6 +242,7 @@ jobs:
           rc=$?
           grep -q '^Total: 0 ' "$ARTIFACT_ROOT/$AGENT/report.txt" 2>/dev/null && rc=1
           echo "$AGENT $rc" >> e2e/artifacts/results.txt
+          exit "$rc"
 
       - name: Smoke test codex
         if: ${{ !cancelled() && contains(format(' {0} ', env.AGENTS), ' codex ') }}
@@ -259,6 +262,7 @@ jobs:
           rc=$?
           grep -q '^Total: 0 ' "$ARTIFACT_ROOT/$AGENT/report.txt" 2>/dev/null && rc=1
           echo "$AGENT $rc" >> e2e/artifacts/results.txt
+          exit "$rc"
 
       - name: Smoke test cursor-cli
         if: ${{ !cancelled() && contains(format(' {0} ', env.AGENTS), ' cursor-cli ') }}
@@ -277,6 +281,7 @@ jobs:
           rc=$?
           grep -q '^Total: 0 ' "$ARTIFACT_ROOT/$AGENT/report.txt" 2>/dev/null && rc=1
           echo "$AGENT $rc" >> e2e/artifacts/results.txt
+          exit "$rc"
 
       - name: Smoke test factoryai-droid
         if: ${{ !cancelled() && contains(format(' {0} ', env.AGENTS), ' factoryai-droid ') }}
@@ -297,6 +302,7 @@ jobs:
           rc=$?
           grep -q '^Total: 0 ' "$ARTIFACT_ROOT/$AGENT/report.txt" 2>/dev/null && rc=1
           echo "$AGENT $rc" >> e2e/artifacts/results.txt
+          exit "$rc"
 
       - name: Smoke test copilot-cli
         if: ${{ !cancelled() && contains(format(' {0} ', env.AGENTS), ' copilot-cli ') }}
@@ -315,6 +321,7 @@ jobs:
           rc=$?
           grep -q '^Total: 0 ' "$ARTIFACT_ROOT/$AGENT/report.txt" 2>/dev/null && rc=1
           echo "$AGENT $rc" >> e2e/artifacts/results.txt
+          exit "$rc"
 
       - name: Summarize
         if: always()
@@ -353,11 +360,40 @@ jobs:
           path: e2e/artifacts/
           retention-days: 7
 
+  # Install-only: stable predates this checkout, so it gets no E2E (#2394).
+  stable-install:
+    runs-on: macos-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - name: Install stable CLI with the documented command
+        run: |
+          set -euo pipefail
+          brew install --cask entireio/tap/entire
+
+      - name: Verify the install
+        run: |
+          set -euo pipefail
+          # No `brew tap` ran, so the tap being present proves the auto-tap.
+          brew tap | grep -qx 'entireio/tap'
+          # The cask ships both binaries; git-remote-entire backs entire:// clones.
+          command -v entire
+          command -v git-remote-entire
+          version_line=$(entire version | head -1)
+          echo "$version_line"
+          case "$version_line" in
+            *nightly*)
+              echo "::error::stable cask returned a nightly build: $version_line"
+              exit 1
+              ;;
+          esac
+
   notify-slack:
     runs-on: ubuntu-latest
     permissions: {}
-    needs: [smoke]
-    if: ${{ always() && needs.smoke.result == 'failure' && github.event_name == 'schedule' }}
+    needs: [smoke, stable-install]
+    if: ${{ always() && (needs.smoke.result == 'failure' || needs['stable-install'].result == 'failure') && github.event_name == 'schedule' }}
     steps:
       - name: Notify Slack of nightly smoke failure
         uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
@@ -374,7 +410,7 @@ jobs:
                       "type": "section",
                       "text": {
                         "type": "mrkdwn",
-                        "text": ":red_circle: *Nightly install smoke failed* — the published nightly CLI did not pass the checkpoint smoke test on at least one OS.\n\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View run details>"
+                        "text": ":red_circle: *Install smoke failed* — a published CLI did not install or run cleanly on at least one channel/OS.\n\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View run details>"
                       }
                     }
                   ]

CLAUDE.md

@@ -50,8 +50,9 @@ the commands are always runnable in every build.
   through `strategy.ResolveCallerSession`, not "which state file moved last" —
   see [Resolving the calling session](#resolving-the-calling-session).
 - `checkpoint` (aliases: `cp`, `checkpoints`): `list`, `explain`, `tokens`, `search`.
-  `explain` also takes `--repo <owner/name>`, the drill-down for a cross-repo
-  `search` hit: it reads the checkpoint from that repo's entire-api cell over
+  `explain` also takes a forge-qualified `--repo` (`gh/<owner>/<name>` or
+  `et/<project>/<name>`), the drill-down for a cross-repo `search` hit: it
+  reads the checkpoint from that repo's entire-api cell over
   HTTP (`/repos/{repo_id}/checkpoints/{id}` plus `.../transcript/raw`) rather
   than fetching git objects, so a foreign checkpoint never enters this repo's
   object store, ref namespace, or `tokens profile`. It needs a full checkpoint
@@ -106,11 +107,25 @@ the commands are always runnable in every build.
   Requiring the prefix is a **namesquatting** guard, not tidiness: without it,
   whichever namespace the CLI defaulted to could shadow the other, and
   `TestCloneRefAlwaysRequiresItsForgePrefix` pins that no forge-less pair
-  resolves in either parser or in the command. It holds only for *intent* —
+  resolves in either parser, in `repo clone`, or in `resolveRepoRef` — the last
+  being the surface every other repo-ref command shares. It holds only for
+  *intent* —
   lookups are already unambiguous because native rows are stored prefixed in the
   same `full_name` index (`et/<project>/<repo>`), which is why the bare-pair
   `--repo` filters on `search`/`experts`/`explain` cannot cross namespaces
   either.
+  The native `/et/<project>/<repo>` path is **not** clone-only: it is the
+  `path` the API returns, and `resolveRepoRef` accepts it for every command
+  that takes a repo ref — `get`, `delete`, the `visibility` and `protection`
+  subtrees, and `grant repo add`/`list`/`remove` (COR-1632). The other two
+  clone shapes are not: a `/gh/` mirror ref is refused there (the by-name
+  lookup resolves a project and then a repo inside it, and a mirror is in no
+  project — so a mirror is addressed by ULID), and an `entire://` URL is not
+  parsed at all. `--project` serves the **bare-name** spelling alone, because
+  the control plane has no by-name repo route that is not project-scoped; the
+  path form is checked against it for agreement, and a ULID warns that it is
+  ignored rather than validating, which would cost a `GetRepo` on every command
+  but `repo get`.
   Native names are validated client-side against the server's own rules
   (`nativeProjectRe`/`nativeRepoRe`, mirroring `normalizeName` in entiredb
   `core/resource/project_name.go`); those bounds are server parity only and buy
@@ -434,6 +449,8 @@ out, err := cmd.CombinedOutput()
 
 `interactive.UnderTest()` returns true when `testing.Testing()` or `ENTIRE_TEST_TTY` is set — use it where code needs to skip a real-terminal operation even if `CanPromptInteractively()` returns true (e.g., opening `interactive.OpenPromptTTY()` directly inside a prompt reader).
 
+A prompt that runs Bubble Tea on a separately opened terminal (plugin confirmations, the login key prompt) must open it with `interactive.OpenPromptTTY()` and release it with `PromptTTY.Close()`, never `tea.OpenTTY()` plus a bare `Close`. Bubble Tea only gets a cancellable console reader for `os.Stdin`; on any other handle its reader loop leaves a read pending after the answer, and Go's `os.File.Close` on Windows waits for that read, which a console completes only on a keypress — the user had to press Enter twice. `PromptTTY.Close` cancels the pending read first (`CancelIoEx`, `tty_release_windows.go`); the reader then sees `io.EOF`, so the close must come after the form has returned.
+
 ### Linting and Formatting
 
 ```bash
@@ -1316,6 +1333,13 @@ comments at each site say which case applies:
   Those operations (`setupEntireDirectory`, `removeEntireDirectory`, the one
   `MkdirAll` of an agent's session dir in `resume.go`) legitimately use plain
   `os` calls.
+- **`Root.Link` takes two root-relative names, and `Root.Symlink` with an
+  absolute target is unusable on Windows.** `Root.Link(absPath, name)` is a
+  path escape everywhere. `Root.Symlink(absPath, name)` on Windows (Go 1.27)
+  writes the reparse target without the `\??\` prefix, so the link is created
+  but every follow fails with `ERROR_INVALID_NAME` — the 0-byte
+  `bin\entire-graph.exe` bug. See `plugin_store_windows.go` and
+  `materializeManagedEntry`.
 
 **Deliberately not rooted**, with the reason:
 

README.md

@@ -54,12 +54,12 @@ With Entire, you can:
 Install with Homebrew:
 
 ```bash
-brew tap entireio/tap
-brew trust entireio/tap
-brew install --cask entire            # stable
-# brew install --cask entire@nightly  # or nightly
+brew install --cask entireio/tap/entire            # stable
+# brew install --cask entireio/tap/entire@nightly  # or nightly
 ```
 
+Use the fully-qualified cask name (`entireio/tap/entire`, not `entire`). Homebrew 6 requires third-party taps to be trusted before it will evaluate them, and a fully-qualified name taps and trusts just that one cask, so no separate `brew tap` / `brew trust` step is needed. Requires Homebrew 6.0.10 or newer.
+
 Or with the install script:
 
 ```bash
@@ -137,9 +137,8 @@ Entire currently ships two release channels:
 
 How to use each channel:
 
-- Homebrew (one-time setup): `brew tap entireio/tap && brew trust entireio/tap`
-- Homebrew stable: `brew install --cask entire`
-- Homebrew nightly: `brew install --cask entire@nightly`
+- Homebrew stable: `brew install --cask entireio/tap/entire`
+- Homebrew nightly: `brew install --cask entireio/tap/entire@nightly`
 - `install.sh` stable: `curl -fsSL https://entire.io/install.sh | bash`
 - `install.sh` nightly: `curl -fsSL https://entire.io/install.sh | bash -s -- --channel nightly`
 - `install.ps1` stable (uses Scoop when available): `irm https://entire.io/install.ps1 | iex`
@@ -384,6 +383,7 @@ These are visible in developer and nightly builds and hidden in stable releases,
 | `--yes`, `-y`                               | Accept all defaults without prompting                                                                             |
 | `--force`, `-f`                             | Force reinstall hooks (removes existing Entire hooks first)                                                       |
 | `--checkpoint-remote <provider:owner/repo>` | Push checkpoint data to a separate repo (e.g., `github:org/checkpoints-repo`)                                     |
+| `--checkpoint-push-remote <name>`           | Select an existing Git remote for checkpoints; always saves to this clone's `.entire/settings.local.json`, even with `--project` |
 | `--skip-push-sessions`                      | Disable automatic pushing of checkpoint data on git push                                                           |
 | `--local`                                   | Write settings to `.entire/settings.local.json` instead of `.entire/settings.json`                                |
 | `--project`                                 | Write settings to `.entire/settings.json` even if it already exists                                               |
@@ -551,6 +551,16 @@ By default, checkpoint data rides along with your own pushes — but only to **o
 
 A push to any *other* remote carries no checkpoint data. `entire status` shows the current destination, where it came from, and how many checkpoints are unpushed. This matters if you push code to several remotes: checkpoints go to exactly one of them.
 
+When a repository has several remotes that could receive checkpoints, interactive first-time `entire enable` asks which one to use, after agent selection and before any hooks or settings are written. Re-running `entire enable` in an enabled repository does not ask again. Choosing a remote saves `strategy_options.checkpoint_push_remote` in `.entire/settings.local.json`, so teammates do not inherit a remote name specific to your clone; keeping the current destination writes nothing.
+
+To select a remote without the picker:
+
+```bash
+entire enable --yes --checkpoint-push-remote fork
+```
+
+The remote must already exist, and this is also how to change the destination later or repair a saved selection that names a missing remote. An explicit flag pins the named remote, even if it is currently selected automatically. `--yes` alone does not change the checkpoint destination. The command confirms the destination when you chose one or when the saved one is unusable; otherwise it ends at `Ready.` Selecting a destination does not re-enable disabled checkpoint pushing, upload existing checkpoints immediately, or move or delete checkpoint history from other remotes.
+
 If instead you want checkpoint data in a separate repo (e.g., a private repo for a public project), configure `checkpoint_remote` with a structured provider and repo. A dedicated `checkpoint_remote` is addressed directly and is exempt from the single-remote election above:
 
 ```json

cmd/entire/cli/api_client.go

@@ -76,7 +76,7 @@ func NewAuthenticatedEntireAPICellClient(ctx context.Context, insecureHTTP bool,
 // repository and returns its repo_id for repo-addressed trail reads. It is a
 // package seam so tests can substitute a client pointed at a stub server.
 var newTrailAPIClient = func(ctx context.Context, insecureHTTP bool, forge, owner, repo string) (*api.Client, string, error) {
-	placement, err := resolveTrailRepoCellPlacement(ctx, forge, owner, repo)
+	placement, err := resolveForgeRepoCellPlacement(ctx, forge, owner, repo)
 	if err != nil {
 		return nil, "", err
 	}