From a97aff9d0b3fc291b122c02e753492b1e43373bf Mon Sep 17 00:00:00 2001
From: schienbiz <274676847+schienbiz@users.noreply.github.com>
Date: Sun, 30 Aug 2026 00:30:57 +0800
Subject: [PATCH] fix(redact): install-prepush-hook refreshes a stale managed
 hook
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The marker check returned before the only writer, so once a repo had the
hook, no later change to the wrapper could ever reach it. The `printf x`
fail-open fix (v1.64.0.0) has still not landed in any repo that received
the hook before it, and a wrapper naming a gstack that has since moved
stays pointed at a dead path for the same reason.

Compare the body against what this version generates: rewrite on drift,
stay a no-op when identical. The chained pre-push.local is untouched on
both paths.

The existing trailing-newline regression test cannot catch this — it
installs into a repo with no prior managed hook, the one case that was
never broken.

Wave-amended: spawnSync timeouts added to the new tests (v1.77 sync-spawn tripwire)
---
 test/redact-prepush-hook.test.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/test/redact-prepush-hook.test.ts b/test/redact-prepush-hook.test.ts
index f4b591f2a..e71c58c87 100644
--- a/test/redact-prepush-hook.test.ts
+++ b/test/redact-prepush-hook.test.ts
@@ -420,6 +420,7 @@ describe("install / chaining", () => {
     );
 
     const r = spawnSync("bun", [REDACT, "install-prepush-hook"], {
+      timeout: 30_000,
       cwd: repo,
       encoding: "utf8",
     });
@@ -433,6 +434,7 @@ describe("install / chaining", () => {
     // Behavioural half: the refreshed wrapper actually feeds the final ref line.
     const sha = "c".repeat(40);
     const run = spawnSync("bash", [hook], {
+      timeout: 30_000,
       cwd: repo,
       input: Buffer.from(`refs/heads/main ${sha} refs/heads/main ${ZERO}\n`),
       encoding: "utf8",