Add checkpoint viewer prototype by gtrrz-victor · Pull Request #463 · entireio/cli

gtrrz-victor · 2026-02-23T04:23:09Z

What this does

This adds a lightweight checkpoint viewer prototype — a single Go binary (stdlib only) that serves a local web dashboard for inspecting checkpoint and session data stored in git.

It's meant as a debugging aid while developing, so you can quickly see what's being tracked without digging through git branches manually.

Features

Three tabs: Tracked Sessions, Checkpoints, and Shadow Branches
Branch-scoped checkpoints: only shows commits on your current branch (not all history)
Worktree-filtered shadow branches: only shows shadow branches relevant to your working directory
Inline file browser: click any file (transcripts, prompts, context) to view its content directly
Auto-refresh: polls every 3 seconds, dark theme, expandable cards with full metadata

Screenshots

Tracked Sessions

Lists session state files from .git/entire-sessions/, sorted by phase (active, idle, ended).

Session Detail

Expanding a session shows all stored fields — token usage, files touched, prompt attributions, and more.

Checkpoints

Only commits from the current branch are shown (uses git log main..HEAD).

Checkpoint Detail

Expanding a checkpoint shows root metadata, per-session metadata, token usage, attribution, and file paths.

Inline Blob Viewer

Clicking a file in the file browser loads its content inline — handy for reading transcripts or prompts.

How to run

cd prototype
go run main.go
# → Listening on http://localhost:8080

Should be run from within a git repository with Entire enabled.

Test plan

cd prototype && go run main.go builds and starts correctly
Tracked Sessions tab shows session state files from .git/entire-sessions/
Checkpoints tab only shows commits on the current branch
Shadow Branches tab only shows branches for the current worktree
Expanding a checkpoint and clicking a file loads its content inline

🤖 Generated with Claude Code

Entire-Checkpoint: 4d7e19fbfd1e

Single Go binary (stdlib only) that serves a web dashboard to inspect all checkpoint and session data stored in git branches. Three tabs: tracked sessions, branch-scoped checkpoints, and worktree-filtered shadow branches. Includes inline file browser for transcripts/prompts. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Entire-Checkpoint: 5d5816d3a76f

cursor · 2026-02-23T04:23:14Z

PR Summary

Medium Risk
Adds a new local HTTP server that shells out to git and serves raw repository metadata/blobs; main risk is exposing unintended file content via the blob endpoints or mishandling path sanitization, though it is a prototype scoped to local use.

Overview
Adds a new prototype/ checkpoint viewer: a single-stdlib Go HTTP server with an embedded HTML UI to browse tracked sessions, checkpoint metadata and shadow branches, including inline file/blob viewing from entire/checkpoints/v1 and auto-refreshing the dashboard every 3 seconds.

Also simplifies CLI shutdown handling in cmd/entire/main.go by replacing the custom signal channel/cancel goroutine with signal.NotifyContext for interrupt-driven context cancellation.

^{Written by Cursor Bugbot for commit 2719db6. Configure here.}

Copilot

Pull request overview

This PR adds a standalone web dashboard for debugging checkpoint and session data, plus a minor refactoring of signal handling in the main CLI.

Changes:

Adds a prototype checkpoint viewer web dashboard as a separate Go binary (stdlib only)
Implements three-tab UI (Tracked Sessions, Checkpoints, Shadow Branches) with auto-refresh
Refactors main CLI signal handling to use signal.NotifyContext (Go 1.16+ idiom)

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
prototype/main.go	New single-file web server implementing REST API for checkpoint/session data inspection with concurrent fetching and git operations
prototype/index.html	New single-page web UI with dark theme, expandable cards, inline file browser, and raw JSON viewer
prototype/go.mod	New Go module definition for standalone prototype tool
prototype/.gitignore	Ignores built binary
cmd/entire/main.go	Refactors signal handling to use signal.NotifyContext instead of manual channel setup

Copilot · 2026-02-23T04:28:12Z

prototype/main.go

+	if strings.Contains(path, "..") {
+		http.Error(w, "invalid path", http.StatusBadRequest)
+		return
+	}


The path traversal check using strings.Contains(path, "..") is insufficient. An attacker could potentially bypass this with URL-encoded sequences like %2e%2e or other variations. Consider using filepath.Clean and checking if the cleaned path starts with an expected prefix, or validate against a whitelist of allowed characters. Additionally, since branch names are user-controlled input passed to git commands, consider validating that branch names match expected patterns (e.g., refs/heads/entire/*) to prevent potential command injection.

Copilot · 2026-02-23T04:28:13Z

prototype/main.go

+	if strings.Contains(branch, "..") || strings.Contains(path, "..") {
+		http.Error(w, "invalid parameter", http.StatusBadRequest)
+		return
+	}


The path traversal check using strings.Contains(path, "..") is insufficient. An attacker could potentially bypass this with URL-encoded sequences like %2e%2e or other variations. Consider using filepath.Clean and checking if the cleaned path starts with an expected prefix, or validate against a whitelist of allowed characters. Additionally, since branch names are user-controlled input passed to git commands, consider validating that branch names match expected patterns (e.g., refs/heads/entire/*) to prevent potential command injection.

Copilot · 2026-02-23T04:28:13Z

prototype/main.go

+	if strings.Contains(branch, "..") || strings.Contains(path, "..") {
+		http.Error(w, "invalid parameter", http.StatusBadRequest)
+		return
+	}


The path traversal check using strings.Contains(path, "..") is insufficient. An attacker could potentially bypass this with URL-encoded sequences like %2e%2e or other variations. Consider using filepath.Clean and checking if the cleaned path starts with an expected prefix, or validate against a whitelist of allowed characters. Additionally, since branch names are user-controlled input passed to git commands, consider validating that branch names match expected patterns (e.g., refs/heads/entire/*) to prevent potential command injection.

Copilot · 2026-02-23T04:28:13Z

prototype/main.go

+	} else {
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	}
+	w.Write(data)


The return value of w.Write should be checked or explicitly ignored. While this is a minor issue in an HTTP handler (write errors are typically logged by the HTTP server), for consistency with Go best practices, either check the error or use a blank identifier if intentionally ignoring.

Suggested change

w.Write(data)

if _, err := w.Write(data); err != nil {

log.Printf("handleBlob: failed to write response: %v", err)

}

Copilot · 2026-02-23T04:28:13Z

prototype/main.go

+	} else {
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	}
+	w.Write(data)


The return value of w.Write should be checked or explicitly ignored. While this is a minor issue in an HTTP handler (write errors are typically logged by the HTTP server), for consistency with Go best practices, either check the error or use a blank identifier if intentionally ignoring.

Copilot · 2026-02-23T04:28:14Z

prototype/main.go

+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	w.Write(buf.Bytes())


The return value of w.Write should be checked or explicitly ignored. While this is a minor issue in an HTTP handler (write errors are typically logged by the HTTP server), for consistency with Go best practices, either check the error or use a blank identifier if intentionally ignoring.

Copilot · 2026-02-23T04:28:14Z

prototype/main.go

+			return
+		}
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		w.Write(data)


The return value of w.Write should be checked or explicitly ignored. While this is a minor issue in an HTTP handler (write errors are typically logged by the HTTP server), for consistency with Go best practices, either check the error or use a blank identifier if intentionally ignoring.

Suggested change

w.Write(data)

if _, err := w.Write(data); err != nil {

log.Printf("error writing index.html response: %v", err)

return

}

Copilot · 2026-02-23T04:28:14Z

prototype/main.go

+
+	addr := fmt.Sprintf(":%d", *port)
+	fmt.Fprintf(os.Stderr, "Checkpoint Viewer listening on http://localhost%s\n", addr)
+	log.Fatal(http.ListenAndServe(addr, nil))


The HTTP server lacks timeout configurations which could make it vulnerable to slowloris-style attacks or resource exhaustion. Consider setting ReadTimeout, WriteTimeout, and IdleTimeout on the http.Server. For a local debugging tool this is low priority, but it's a best practice. Example: srv := &http.Server{Addr: addr, ReadTimeout: 30time.Second, WriteTimeout: 30time.Second, IdleTimeout: 120*time.Second}; log.Fatal(srv.ListenAndServe())

Copilot · 2026-02-23T04:28:14Z

prototype/main.go

@@ -0,0 +1,491 @@
+package main


Consider adding a README.md in the prototype directory to document what this tool is, how to build and run it, and its intended purpose. This would help other developers understand the tool and how to use it for debugging checkpoint data. The PR description provides a good starting point for this documentation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Entire-Checkpoint: 1c8c9ad48797

pfleidi and others added 2 commits February 19, 2026 13:29

Use signal.NotifyContext() instead of signal.Notify() boilerplat

c780808

Entire-Checkpoint: 4d7e19fbfd1e

Copilot AI review requested due to automatic review settings February 23, 2026 04:23

Copilot started reviewing on behalf of gtrrz-victor February 23, 2026 04:23 View session

Copilot AI reviewed Feb 23, 2026

View reviewed changes

Add screenshots for PR description

b7b24ce

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Entire-Checkpoint: 1c8c9ad48797

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

Add checkpoint viewer prototype#463

Add checkpoint viewer prototype#463
gtrrz-victor wants to merge 3 commits intomainfrom
app-to-validate-checkpoints-while-developing

gtrrz-victor commented Feb 23, 2026 •

edited

Loading

Uh oh!

cursor bot commented Feb 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 23, 2026

Uh oh!

Copilot AI Feb 23, 2026

Uh oh!

Copilot AI Feb 23, 2026

Uh oh!

Copilot AI Feb 23, 2026

Uh oh!

Copilot AI Feb 23, 2026

Uh oh!

Copilot AI Feb 23, 2026

Uh oh!

Copilot AI Feb 23, 2026

Uh oh!

Copilot AI Feb 23, 2026

Uh oh!

Copilot AI Feb 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

-	w.Write(data)
+	if _, err := w.Write(data); err != nil {
+		log.Printf("handleBlob: failed to write response: %v", err)
+	}

Comments

Conversation

gtrrz-victor commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this does

Features

Screenshots

Tracked Sessions

Session Detail

Checkpoints

Checkpoint Detail

Inline Blob Viewer

How to run

Test plan

Uh oh!

cursor bot commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

gtrrz-victor commented Feb 23, 2026 •

edited

Loading

cursor bot commented Feb 23, 2026 •

edited

Loading