@biffo/cli 0.312.4 → 0.312.5

package/_skeletons/plugin-template/.githooks/pre-push

@@ -166,4 +166,22 @@ fi
 # without the file passed its pre-push having checked nothing, which is the
 # same defect one level up from the one #855 recorded. A gate that cannot run
 # is not a gate that passed.
-exec sh scripts/biffo.sh verify
+#
+# Not a bare `exec` (biffo-template#1985): git's own generic
+# "error: failed to push some refs" line is printed by git itself, after this
+# hook exits, and is the literal last thing in a truncated-tail read of a long
+# agent transcript. Nothing distinguished it from a real auth/network
+# rejection -- three same-day dispatches on tabsii-platform#1403 diagnosed and
+# "fixed" a token before noticing the real cause was a local gate. verify.sh's
+# own failure text (above) already names the cause; this adds one more line,
+# deliberately placed as close as this hook can get to git's trailing output,
+# so a reader who only sees the last few lines still sees it.
+sh scripts/biffo.sh verify
+verify_status=$?
+if [ "$verify_status" -ne 0 ]; then
+  printf '\n\033[31m>>> pre-push: BLOCKED BY THE LOCAL GATE ABOVE, not by git or GitHub.\033[0m\n' >&2
+  printf '    See "verify failed:" above for which check(s) and why. Any\n' >&2
+  printf '    "failed to push some refs" line below this is git relaying that\n' >&2
+  printf '    same exit code -- it is not a separate rejection.\n' >&2
+fi
+exit "$verify_status"

package/_skeletons/sibling-template/.githooks/pre-push

@@ -166,4 +166,22 @@ fi
 # without the file passed its pre-push having checked nothing, which is the
 # same defect one level up from the one #855 recorded. A gate that cannot run
 # is not a gate that passed.
-exec sh scripts/biffo.sh verify
+#
+# Not a bare `exec` (biffo-template#1985): git's own generic
+# "error: failed to push some refs" line is printed by git itself, after this
+# hook exits, and is the literal last thing in a truncated-tail read of a long
+# agent transcript. Nothing distinguished it from a real auth/network
+# rejection -- three same-day dispatches on tabsii-platform#1403 diagnosed and
+# "fixed" a token before noticing the real cause was a local gate. verify.sh's
+# own failure text (above) already names the cause; this adds one more line,
+# deliberately placed as close as this hook can get to git's trailing output,
+# so a reader who only sees the last few lines still sees it.
+sh scripts/biffo.sh verify
+verify_status=$?
+if [ "$verify_status" -ne 0 ]; then
+  printf '\n\033[31m>>> pre-push: BLOCKED BY THE LOCAL GATE ABOVE, not by git or GitHub.\033[0m\n' >&2
+  printf '    See "verify failed:" above for which check(s) and why. Any\n' >&2
+  printf '    "failed to push some refs" line below this is git relaying that\n' >&2
+  printf '    same exit code -- it is not a separate rejection.\n' >&2
+fi
+exit "$verify_status"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.312.4",
+  "version": "0.312.5",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",

package/scripts/verify.sh

@@ -1273,6 +1273,10 @@ elif [ -z "$PG_TEST_DSN" ]; then
       printf '  the pg-test lane above did not run. CI treats it as a required check, so a\n'
       printf '  push here would report green without having checked the thing most likely\n'
       printf '  to need it.\n\n'
+      printf '  This is NOT a credentials or network problem. It is a local gate refusing\n'
+      printf '  to push until the Postgres test lane runs. If git prints its own generic\n'
+      printf '  "failed to push some refs" line below this, that is git relaying THIS exit\n'
+      printf '  code -- not a rejection by GitHub or a sign of a bad token.\n\n'
       printf '  Get a DSN and re-run:\n'
       printf '    eval "$(sh scripts/pg-test-db.sh --export)"   # if this repo ships one\n'
       printf '    export BIFFO_TEST_PG_DSN=postgresql+asyncpg://user:pass@host:port/db\n\n'