Copy the push guard next to the hook it serves

The installed hook ran the guard out of the worktree, which fails the moment a
worktree sits on a branch older than the guard: the hook execs a path that
does not exist, and every push from that checkout dies on `No such file` --
including pushes to the forge, which is the one destination it means to allow.
This machine reproduced it immediately, since the main checkout is parked on a
branch that predates the guard.

The installer now copies the guard into the hooks directory and the hook runs
that copy, so the guard is independent of whatever any worktree has checked
out. Re-run the installer to pick up a newer guard.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016o8HwTaqLKEWCHTjsjFtrB

Co-Authored-By

Claude Opus 5 (1M context) <noreply@anthropic.com>

Claude-Session

https://claude.ai/code/session_016o8HwTaqLKEWCHTjsjFtrB

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Changed files

• modified ops/dev/install-push-guard.sh
• modified test/openagents/push_remote_contract_test.exs

Diff

2 files changed, +17 -2

# this clone. Run it once per clone, on every machine.

#

#   sh ops/dev/install-push-guard.sh [--force]

#

# The guard is copied next to the hook rather than run from the worktree. A

# worktree can sit on a branch older than the guard, or on one that never had

# it, and a hook that execs a missing file refuses every push -- including the

# ones to the forge -- with a confusing error. Re-run the installer to pick up

# a newer guard.

force=${1:-}

mkdir -p "$common_dir/hooks"

guard_path="$common_dir/hooks/openagents-push-remote-check.sh"

cp "$repo_root/ops/ci/push-remote-check.sh" "$guard_path"

chmod +x "$guard_path"

cat >"$hook_path" <<'HOOK'

#!/bin/sh

# openagents-push-guard — installed by ops/dev/install-push-guard.sh

set -eu

repo_root=$(git rev-parse --show-toplevel)

exec "$repo_root/ops/ci/push-remote-check.sh" "$@"

common_dir=$(cd "$(git rev-parse --git-common-dir)" && pwd)

exec "$common_dir/hooks/openagents-push-remote-check.sh" "$@"

HOOK

chmod +x "$hook_path"

    hook = Path.join(root, ".git/hooks/pre-push")

    assert File.exists?(hook)

    # The guard travels with the hook, so a worktree on a branch that predates

    # it still refuses the wrong remote instead of failing to find a file.

    assert File.exists?(Path.join(root, ".git/hooks/openagents-push-remote-check.sh"))

    File.rm!(Path.join(root, @script))

    assert {output, 1} =

             System.cmd("sh", [hook, "origin", "git@github.com:OpenAgentsInc/x.git"],

               cd: root,