ctrlrelay 0.16.3__tar.gz → 0.16.4__tar.gz

{ctrlrelay-0.16.3 → ctrlrelay-0.16.4}/CHANGELOG.md

@@ -7,6 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.16.4] - 2026-11-01
+
+Fixes for runs whose work could not be published. **No config edit is
+required.** `poller_state.json` gains a `publish_failures` count, added
+automatically.
+
+### Fixed
+
+- A failed publish no longer strands the issue. `poll()` marks an issue seen
+  before handing it to the handler, so a run whose agent finished but whose
+  branch the relay could not publish stayed in `seen_issues` forever: the
+  claim was retracted, the automation label was still on it, and the relay
+  never came back. The issue is now un-marked for the next poll, up to 3
+  runs, counted in `publish_failures` in `poller_state.json` (saved together
+  with the un-mark) so a restart does not reset the limit. After the third
+  the relay says on the issue that it has stopped, with the error scrubbed,
+  and says so in chat if that comment cannot be posted. A *refused* push is
+  not retried at all: the relay reaches the same refusal every time (#278,
+  closes #268)
+- The retraction comment no longer advises a retry that cannot work. It said
+  to re-assign the issue or re-apply its automation label, but the skip
+  decision reads the issue number alone, so neither did anything. It now
+  says that while the poller is running the relay tries again a limited
+  number of times and says so if it stops, and otherwise names the one route
+  that works (#278, closes #268)
+- A failed push says why. The rejected ref and git's reason (a stale lease,
+  a non-fast-forward, a protection rule) lead the error, the remote's own
+  `remote:` lines follow, and the reason reaches `dev.publish.failed` as its
+  own `push_rejection` field. Before, only git's summary line naming the URL
+  survived. Every failing git command now reports both of its output
+  streams, scrubbed of credential shapes (#277, closes #269)
+
 ## [0.16.3] - 2026-11-01
 
 A security fix: **upgrade every machine.** No config edit is required.
@@ -2016,7 +2048,8 @@ pipeline).
   per-phase implementation plans (Phase 0 through Phase 4).
 - `docs/Claude_Code_Project_Guide.md` — project development guide.
 
-[Unreleased]: https://github.com/AInvirion/ctrlrelay/compare/v0.16.3...HEAD
+[Unreleased]: https://github.com/AInvirion/ctrlrelay/compare/v0.16.4...HEAD
+[0.16.4]: https://github.com/AInvirion/ctrlrelay/compare/v0.16.3...v0.16.4
 [0.16.3]: https://github.com/AInvirion/ctrlrelay/compare/v0.16.2...v0.16.3
 [0.16.2]: https://github.com/AInvirion/ctrlrelay/compare/v0.16.1...v0.16.2
 [0.16.1]: https://github.com/AInvirion/ctrlrelay/compare/v0.16.0...v0.16.1

{ctrlrelay-0.16.3 → ctrlrelay-0.16.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ctrlrelay
-Version: 0.16.3
+Version: 0.16.4
 Summary: Local-first orchestrator for headless coding agents across multiple GitHub repos
 Project-URL: Homepage, https://github.com/AInvirion/ctrlrelay
 Project-URL: Documentation, https://ainvirion.github.io/ctrlrelay/

{ctrlrelay-0.16.3 → ctrlrelay-0.16.4}/docs/configuration.md

@@ -133,7 +133,21 @@ private git dir with hooks off and only ctrlrelay's own git config, pushes the
 commit it checked rather than the ref name, and uses `--force-with-lease`
 against the head this session last pushed (recorded in the state DB). An
 open PR found for the branch is reused only if its head repo is this repo and
-its base is the default branch. Text the agent wrote is posted with `@`-mentions and
+its base is the default branch.
+
+A push git rejects for a ref is a different thing, logged as
+`publish.push.rejected` with the per-ref reason git gave. Some are decided by
+git itself before the remote is asked (a stale lease, a non-fast-forward:
+`[rejected]`), others by the remote (a branch-protection or repository-rule
+refusal: `[remote rejected]`). That reason
+comes from the `!` line of `git push --porcelain`, which git writes to
+**stdout**; stderr carries only `error: failed to push some refs to '<url>'`.
+Both streams of any failing git command now reach the error it raises (stderr
+whole, stdout capped, both scrubbed of credential shapes), and the reason
+reaches `dev.publish.failed` as its own `push_rejection` field, so a
+rejection is not reported as a URL and nothing else.
+
+Text the agent wrote is posted with `@`-mentions and
 issue-closing keywords disabled and its length capped (20,000 characters);
 the PR's own `Closes #N` is added by ctrlrelay.
 

{ctrlrelay-0.16.3 → ctrlrelay-0.16.4}/docs/operations.md

@@ -727,6 +727,30 @@ file, so a restart does not reset it. Each retry posts a fresh claim
 comment and, when it fails, a fresh "nothing is working on this" comment
 on the issue.
 
+A run whose **agent finished but whose branch the relay could not
+publish** is retried the same way, for the same reason: the issue is
+already in `seen_issues`, so without this nothing would ever bring it
+back. Up to 3 runs in all, counted in `publish_failures` in the same
+file, and the retraction comment on the issue says the relay will
+return rather than asking you to re-assign it. After the third run the
+issue stays in `seen_issues` and the relay says so **on the issue** —
+the commits are still on the run branch in the local checkout (on
+GitHub too, if only opening the pull request failed), and the fix is to
+clear the cause and delete the number as above. If that comment cannot
+be posted, the chat line says so.
+
+A push the relay **refuses** (a protected or default branch, a base it
+did not expect, somebody else's commits on the branch) is not retried
+at all: the relay reaches the same refusal every time, so another run
+would spend a whole agent to arrive at it. The issue stays in
+`seen_issues` and the comment names what to do.
+
+Re-assigning an issue, or re-applying its automation label, does **not**
+make the poller look at it again. The skip decision reads the issue
+number only — no assignee and no labels — so the number has to leave
+`seen_issues` (and the relay has to be restarted, since the running
+poller holds the set in memory and rewrites the file from it).
+
 ### A repo whose history was replaced
 
 If the local copy's default branch can no longer fast-forward to GitHub's

{ctrlrelay-0.16.3 → ctrlrelay-0.16.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "ctrlrelay"
-version = "0.16.3"
+version = "0.16.4"
 description = "Local-first orchestrator for headless coding agents across multiple GitHub repos"
 readme = "README.md"
 requires-python = ">=3.12"

{ctrlrelay-0.16.3 → ctrlrelay-0.16.4}/src/ctrlrelay/cli.py

@@ -1183,6 +1183,123 @@ def settle_pre_dispatch_failure(poller, repo: str, issue_number: int, result):
     )
 
 
+# Runs of one issue whose branch the relay may fail to publish before
+# the poller stops retrying it (#268). Same shape and same reason as
+# PRE_DISPATCH_ATTEMPTS: a blip deserves another poll, a permanent cause
+# must not spend one full agent run per poll forever.
+PUBLISH_ATTEMPTS = 3
+
+
+def publish_failure_message(
+    repo: str, issue_number: int, error: str, *, attempts: int, retrying: bool,
+) -> str:
+    """The chat line for a run whose branch the relay could not publish."""
+    why = (error.strip().splitlines() or ["no error recorded"])[0][:200]
+    if retrying:
+        return (
+            f"\u23f3 #{issue_number} in {repo}: the agent finished but the "
+            f"relay could not publish the branch (try {attempts} of "
+            f"{PUBLISH_ATTEMPTS}): {why}. Will retry on the next poll."
+        )
+    return (
+        f"\u274c #{issue_number} in {repo}: could not publish the branch "
+        f"{attempts} times; not retrying. Last error: {why}. The commits "
+        "are on the run branch locally; fix the cause, then remove the "
+        "issue number from seen_issues in poller_state.json to try again."
+    )
+
+
+async def settle_publish_failure(
+    github, poller, repo: str, issue_number: int, result,
+):
+    """Decide what a failed publish means for retrying its issue (#268).
+
+    `poll()` marks an issue seen BEFORE handing it to the handler, so a
+    publish failure nobody un-marks drops the issue forever: the claim
+    is retracted, the automation label is still on it, and the relay
+    never comes back. Nothing in the logs says why, because from the
+    relay's own point of view nothing is wrong.
+
+    So: the agent finished and only the publish failed, and the push was
+    not refused -> count it, and below ``PUBLISH_ATTEMPTS`` un-mark the
+    issue so the next poll runs it again. At the limit the issue stays
+    seen, the count is dropped, and the relay says on the ISSUE that it
+    has stopped — the retraction already there promised a retry, and a
+    promise silently abandoned is the original defect one step on.
+
+    A refused push is not retried at all: the relay re-reaches that
+    refusal every time, so another attempt costs a whole agent run to
+    arrive at the same answer. Returns the chat line, or ``None`` for
+    any result this is not about.
+
+    Writing the issue comment is best-effort: this runs after a run that
+    has already failed, and a `gh` error here must not replace the run's
+    real failure with a different one.
+    """
+    from ctrlrelay.pipelines.dev import (
+        publish_failure_is_retryable,
+        publish_retries_exhausted_comment,
+    )
+
+    outputs = result.outputs or {}
+    if result.success or result.blocked or not outputs.get("publish_failed"):
+        poller.clear_publish_failures(repo, issue_number)
+        return None
+    if not publish_failure_is_retryable(result):
+        # Refused, not failed. Left seen deliberately; the pipeline's
+        # retraction on the issue already names the operator action.
+        poller.clear_publish_failures(repo, issue_number)
+        log_event(
+            _logger, "publish.refused_not_retried", repo=repo,
+            issue_number=issue_number, error=(result.error or "")[:200],
+        )
+        return (
+            f"\u26d4 #{issue_number} in {repo}: the relay refused to push "
+            f"the branch, so it is not retrying. {result.error or ''}".strip()
+        )
+
+    # The count and the un-mark are saved together, in one write.
+    attempts = poller.publish_failure_count(repo, issue_number) + 1
+    retrying = attempts < PUBLISH_ATTEMPTS
+    poller.count_publish_failure(repo, issue_number, unmark=retrying)
+    notice_failed = False
+    if not retrying:
+        poller.clear_publish_failures(repo, issue_number)
+        try:
+            await github.comment_on_issue(
+                repo=repo,
+                issue_number=issue_number,
+                body=publish_retries_exhausted_comment(
+                    result.session_id,
+                    repo=repo,
+                    issue_number=issue_number,
+                    attempts=attempts,
+                    error=result.error or "",
+                ),
+            )
+        except asyncio.CancelledError:
+            raise
+        except Exception as e:
+            log_event(
+                _logger, "publish.exhausted_notice_failed", repo=repo,
+                issue_number=issue_number,
+                error=f"{type(e).__name__}: {str(e)[:200]}",
+            )
+            notice_failed = True
+    message = publish_failure_message(
+        repo, issue_number, result.error or "",
+        attempts=attempts, retrying=retrying,
+    )
+    if notice_failed:
+        # The issue's last word is still the retraction promising a
+        # retry; chat is now the only place that says it stopped.
+        message += (
+            " The note saying so could not be posted on the issue, which "
+            "still promises a retry."
+        )
+    return message
+
+
 def reclone_message(repo: str, set_aside: Path) -> str:
     """The chat line for a clone that was set aside and cloned again
     (#234). Names where the old copy went, because nothing deletes it."""
@@ -3168,6 +3285,23 @@ def poller_start(
                             pass
                     return
 
+                # The agent finished and the relay could not publish the
+                # branch (#268). Un-marked so the next poll runs it
+                # again, bounded, because the issue is already marked
+                # seen and nothing else would ever bring it back. No
+                # early return: a fix round that failed to push still
+                # has a pull request below that needs its merge watcher.
+                publish_note = await settle_publish_failure(
+                    github, poller, repo, issue_number, result,
+                )
+                if publish_note is not None:
+                    console.print(f"[yellow]{publish_note}[/yellow]")
+                    if connected_transport is not None:
+                        try:
+                            await connected_transport.send(publish_note)
+                        except Exception:
+                            pass
+
                 # Lock-contended DURING PR verification (issue #29): the
                 # PR already exists AND verification decided it wasn't
                 # ready (_verify_and_fix_pr only returns this error from

{ctrlrelay-0.16.3 → ctrlrelay-0.16.4}/src/ctrlrelay/core/poller.py

@@ -54,12 +54,16 @@ def _is_issues_disabled_error(exc: Exception) -> bool:
     return "has disabled issues" in str(exc).lower()
 
 
-def _read_pre_dispatch_failures(raw: object) -> dict[str, dict[int, int]]:
-    """``pre_dispatch_failures`` from the state file, keeping only
-    entries that are an issue number and a positive whole count (#234).
-    Anything else is dropped rather than trusted: a negative count would
-    lift the retry limit, and a value that cannot convert would stop the
-    poller from loading at all."""
+def _read_failure_counts(raw: object) -> dict[str, dict[int, int]]:
+    """A per-repo, per-issue retry counter from the state file, keeping
+    only entries that are an issue number and a positive whole count
+    (#234). Anything else is dropped rather than trusted: a negative
+    count would lift the retry limit, and a value that cannot convert
+    would stop the poller from loading at all.
+
+    Shared by ``pre_dispatch_failures`` and ``publish_failures`` (#268):
+    one shape, one validator, so a second counter cannot be added with
+    a weaker guard than the first."""
     out: dict[str, dict[int, int]] = {}
     if not isinstance(raw, dict):
         return out
@@ -137,6 +141,11 @@ class IssuePoller:
     # (#234). Persisted with seen_issues so a restart does not reset
     # the limit on a permanent problem.
     pre_dispatch_failures: dict[str, dict[int, int]] = field(default_factory=dict)
+    # Runs whose agent finished but whose branch the relay could not
+    # publish, per repo and issue (#268). Bounds the retry the same way
+    # and for the same reason: the cause may be a blip, and it may be
+    # permanent, and only a counter tells them apart.
+    publish_failures: dict[str, dict[int, int]] = field(default_factory=dict)
     # Issues another machine holds (#245), per repo: when to look again,
     # as an epoch time. In memory only; after a restart the issue is
     # simply checked once more.
@@ -187,9 +196,12 @@ class IssuePoller:
             data = json.loads(self.state_file.read_text())
             raw = data.get("seen_issues", {})
             self.seen_issues = {repo: set(numbers) for repo, numbers in raw.items()}
-            self.pre_dispatch_failures = _read_pre_dispatch_failures(
+            self.pre_dispatch_failures = _read_failure_counts(
                 data.get("pre_dispatch_failures"),
             )
+            self.publish_failures = _read_failure_counts(
+                data.get("publish_failures"),
+            )
         except (ValueError, OSError, AttributeError, TypeError):
             # Corrupt or unreadable state — start fresh. ValueError
             # covers JSONDecodeError and an integer too long to convert;
@@ -197,6 +209,7 @@ class IssuePoller:
             # shape, e.g. a list at the top level or for seen_issues.
             self.seen_issues = {}
             self.pre_dispatch_failures = {}
+            self.publish_failures = {}
 
     def _save_state(self) -> None:
         """Persist seen issues and a ``last_poll`` timestamp to the state file."""
@@ -209,6 +222,11 @@ class IssuePoller:
                 for repo, counts in self.pre_dispatch_failures.items()
                 if counts
             },
+            "publish_failures": {
+                repo: {str(n): c for n, c in sorted(counts.items())}
+                for repo, counts in self.publish_failures.items()
+                if counts
+            },
             "last_poll": datetime.now(timezone.utc).isoformat(),
         }
         self.state_file.parent.mkdir(parents=True, exist_ok=True)
@@ -816,6 +834,41 @@ class IssuePoller:
             del counts[issue_number]
             self._save_state_best_effort()
 
+    def publish_failure_count(self, repo: str, issue_number: int) -> int:
+        """How many publish failures are counted for ``issue_number``."""
+        return self.publish_failures.get(repo, {}).get(issue_number, 0)
+
+    def count_publish_failure(
+        self, repo: str, issue_number: int, *, unmark: bool,
+    ) -> int:
+        """Count one publish failure and, when ``unmark``, take the issue
+        out of the seen-set, in ONE state write, so a stop between the two
+        cannot leave them disagreeing (#268). Returns the new count."""
+        counts = self.publish_failures.setdefault(repo, {})
+        counts[issue_number] = counts.get(issue_number, 0) + 1
+        if unmark:
+            seen = self.seen_issues.get(repo)
+            if seen:
+                seen.discard(issue_number)
+        self._save_state_best_effort()
+        return counts[issue_number]
+
+    def record_publish_failure(self, repo: str, issue_number: int) -> int:
+        """Count one run of ``issue_number`` whose agent finished but
+        whose branch the relay could not publish, and return how many
+        there have been (#268). Saved best-effort, like ``unmark_seen``."""
+        counts = self.publish_failures.setdefault(repo, {})
+        counts[issue_number] = counts.get(issue_number, 0) + 1
+        self._save_state_best_effort()
+        return counts[issue_number]
+
+    def clear_publish_failures(self, repo: str, issue_number: int) -> None:
+        """Forget the count once a run publishes or is given up."""
+        counts = self.publish_failures.get(repo)
+        if counts and issue_number in counts:
+            del counts[issue_number]
+            self._save_state_best_effort()
+
     async def seed_current(self) -> None:
         """Seed seen_issues with all currently-triggered issues.
 

{ctrlrelay-0.16.3 → ctrlrelay-0.16.4}/src/ctrlrelay/core/worktree.py

@@ -89,10 +89,138 @@ def _rejections_are_only_non_fast_forward(stderr: str) -> list[str]:
     return refs
 
 
+# How much of each stream a failing git command contributes to the
+# error it raises. #269: `git push --porcelain` writes its per-ref
+# status to STDOUT, so for a rejected push the remote's reason is on
+# stdout and stderr holds only `error: failed to push some refs to
+# '<url>'`. Dropping stdout left every failed push reported by its
+# least informative line — and that line names the URL, which sends
+# the reader after the transport or the credential when neither was
+# at fault.
+_GIT_ERROR_TAIL_CHARS = 1000
+# The reason is one porcelain line for the one ref we push. The cap is
+# for a remote that answers with an essay.
+_PUSH_REASON_MAX_CHARS = 500
+
+
+def _git_failure_detail(
+    stdout: str, stderr: str, returncode: int | None
+) -> str:
+    """Both streams of a failed git command, scrubbed and capped.
+
+    stderr first and whole: it carries git's own ``fatal:``/``error:``
+    lines and is what every existing caller's matcher reads. stdout
+    follows, labelled and capped, whenever it said anything — which for a
+    ``--porcelain`` command is where the answer is.
+
+    Redaction runs before the cap (see :mod:`ctrlrelay.core.redact`):
+    clipping first can store half a token, and half a token no longer
+    matches the pattern that would have caught it.
+
+    When both streams are empty the exit code is all there is, so it is
+    named rather than rendered as a message with nothing after the
+    colon.
+    """
+    from ctrlrelay.core.redact import redact_secrets, tail
+
+    parts: list[str] = []
+    # stderr whole, as the message carried it before stdout was added, so
+    # a matcher looking for git's words anywhere in it still finds them;
+    # stdout capped.
+    err = stderr.strip()
+    if err:
+        parts.append(redact_secrets(err))
+    out = stdout.strip()
+    if out:
+        parts.append("stdout: " + tail(redact_secrets(out), _GIT_ERROR_TAIL_CHARS))
+    if not parts:
+        return f"exited {returncode} with no output"
+    return "; ".join(parts)
+
+
+def parse_push_rejection(porcelain_stdout: str) -> str | None:
+    """The reason ``git push --porcelain`` gave for refusing a ref.
+
+    Porcelain status is one TAB-separated line per ref on **stdout**:
+    ``<flag>\\t<from>:<to>\\t<summary>``. A refused ref carries flag
+    ``!`` and the remote's reason in the summary — ``[rejected] (stale
+    info)``, ``[remote rejected] (pre-receive hook declined)``,
+    ``[remote rejected] (push declined due to repository rule
+    violations)``. Lines for refs that updated carry a different flag
+    and are not failures.
+
+    Returns ``None`` when no ref was rejected: the push died before it
+    got a per-ref answer (unreachable remote, bad credential, no such
+    repository), and then stderr is the whole story and must not be
+    dressed up as a rejection.
+
+    Also reads the non-porcelain form (``! [rejected] <src> -> <dst>
+    (reason)``), because the flag and the reason are in it too and a
+    caller should not have to know which form it has.
+    """
+    from ctrlrelay.core.redact import redact_secrets
+
+    reasons: list[str] = []
+    for raw in porcelain_stdout.splitlines():
+        line = raw.strip()
+        if not line.startswith("!"):
+            continue
+        if "\t" in raw:
+            # At most two splits: the summary keeps any tab inside it.
+            fields = [f.strip() for f in raw.split("\t", 2)]
+            ref = fields[1] if len(fields) > 1 else ""
+            summary = fields[2] if len(fields) > 2 else ""
+            # Scrubbed before anything is cut (what the remote says can
+            # carry a credential, and half a token no longer matches the
+            # pattern); then the ref whole and the remote's words capped,
+            # so a long ref cannot crowd out the reason.
+            ref, summary = redact_secrets(ref), redact_secrets(summary)
+            text = f"{ref} {summary[:_PUSH_REASON_MAX_CHARS]}".strip() or line
+        else:
+            text = redact_secrets(line.lstrip("! ").strip() or line)
+        reasons.append(text)
+    if not reasons:
+        return None
+    return "; ".join(reasons)
+
+
 class WorktreeError(Exception):
     """Raised when worktree operations fail."""
 
 
+class GitCommandError(WorktreeError):
+    """A git command exited non-zero, carrying both of its streams.
+
+    A ``WorktreeError`` like before, so every existing handler is
+    unaffected. The two attributes are for a caller that knows the
+    command's output format and can read more from it than the message
+    does — ``push --porcelain``, whose per-ref reason is on stdout.
+    """
+
+    def __init__(
+        self, message: str, *, stdout: str = "", stderr: str = ""
+    ) -> None:
+        super().__init__(message)
+        self.stdout = stdout
+        self.stderr = stderr
+
+
+class PushRejectedError(WorktreeError):
+    """Git rejected the push for a ref, named with the reason it gave.
+
+    Decided by git itself before the remote is asked (a stale lease, a
+    non-fast-forward) or by the remote (a protection rule). Distinct from
+    :class:`ctrlrelay.core.publish.PushRefusedError`, which is the relay
+    declining to push at all. ``reason`` is the ``!`` line from
+    ``push --porcelain`` so a caller can log it as its own field
+    instead of parsing it back out of the message.
+    """
+
+    def __init__(self, message: str, *, reason: str | None = None) -> None:
+        super().__init__(message)
+        self.reason = reason
+
+
 class DefaultBranchDivergedError(WorktreeError):
     """The bare clone's default branch cannot fast-forward to origin's.
 
@@ -340,14 +468,23 @@ class WorktreeManager:
             raise
 
         if proc.returncode != 0:
-            err = stderr.decode().strip()
+            err = stderr.decode(errors="replace").strip()
+            out = stdout.decode(errors="replace").strip()
             declined = (
                 _rejections_are_only_non_fast_forward(err)
                 if tolerate_non_fast_forward
                 else []
             )
             if not declined:
-                raise WorktreeError(f"git failed: {err}")
+                # Both streams, because which one carried the reason
+                # depends on the command: a `--porcelain` push puts it
+                # on stdout (#269).
+                raise GitCommandError(
+                    "git failed: "
+                    + _git_failure_detail(out, err, proc.returncode),
+                    stdout=out,
+                    stderr=err,
+                )
             stuck = sorted(set(declined) & protected_refs)
             if stuck:
                 raise DefaultBranchDivergedError(
@@ -1113,16 +1250,52 @@ class WorktreeManager:
                         "not overwriting it"
                     )
                 expected_remote_sha = remote
-            await self._run_git(
-                *git(
-                    "push", "--no-verify", "--porcelain",
-                    f"--force-with-lease=refs/heads/{branch}:"
-                    f"{expected_remote_sha}",
-                    url, f"{sha}:refs/heads/{branch}",
-                ),
-                env=env,
-                timeout=_GIT_TRANSFER_TIMEOUT_SECONDS,
-            )
+            try:
+                await self._run_git(
+                    *git(
+                        "push", "--no-verify", "--porcelain",
+                        f"--force-with-lease=refs/heads/{branch}:"
+                        f"{expected_remote_sha}",
+                        url, f"{sha}:refs/heads/{branch}",
+                    ),
+                    env=env,
+                    timeout=_GIT_TRANSFER_TIMEOUT_SECONDS,
+                )
+            except GitCommandError as exc:
+                # The remote's reason for refusing the ref is on
+                # stdout, which the generic message now carries but
+                # buries after git's summary line. Pull it out so the
+                # reason leads, and hand it up as its own field (#269).
+                reason = parse_push_rejection(exc.stdout)
+                if reason is None:
+                    raise
+                from ctrlrelay.core.redact import redact_secrets, tail
+
+                said = tail(redact_secrets("; ".join(
+                    line.strip()
+                    for line in exc.stderr.splitlines()
+                    if line.strip().startswith("remote:")
+                )), _GIT_ERROR_TAIL_CHARS)
+                _logger.error(
+                    "publish.push.rejected",
+                    extra={
+                        "repo": repo,
+                        "session_id": session_id,
+                        "branch": branch,
+                        "sha": sha,
+                        "reason": reason,
+                    },
+                )
+                # The reason leads; git's own failure text follows, as the
+                # message carried it before, for anything matching on it.
+                raise PushRejectedError(
+                    f"git failed: push rejected by {url}: {reason}"
+                    + (f"; {said}" if said else "")
+                    # Already scrubbed where it was built; again here, so
+                    # this line does not depend on that.
+                    + f"; {redact_secrets(str(exc))}",
+                    reason=reason,
+                ) from exc
         finally:
             shutil.rmtree(workdir, ignore_errors=True)
         log_event(