feat(hooks): require human approval before git push

[DevSecNinja]

What

Adds a Copilot preToolUse command hook that forces an explicit, interactive human approval before the agent runs any git push.

• .apm/hooks/git-push-approval.json — the hook definition (uses the bash command key, like tool-guardian).
• scripts/git-push-approval/require-push-approval.sh — the guard script.

Why here (why git push?)

A local commit is fully rewritable — git commit --amend, git reset, git rebase all work freely until it's pushed. git push is the first irreversible step that publishes work to a remote, so it's the correct chokepoint for a human checkpoint.

How it works

• Reads the tool invocation as JSON on stdin (toolName/toolArgs, and the VS Code tool_name/tool_input variant).
• When a shell tool (bash/powershell/shell) contains a git … push, it emits {"permissionDecision":"ask", ...} so the CLI prompts the user to approve. Every other tool call produces no decision and flows through the normal permission path.
• Always exits 0. preToolUse command hooks are fail-closed (a non-zero exit denies the call), so the script only ever upgrades the decision to ask and never blocks unrelated tools.
• Detection is scoped to a single command (separators ; & | break the match), so git status && npm run push does not prompt; git push, git push origin main, git -C /repo push, and /usr/bin/git --no-pager push do.
• jq is used when present with a pure-grep/sed fallback when it isn't.

Design choice: enabled by default

Unlike tool-guardian (a heavy blocker shipped with disableAllHooks), this hook ships enabled — an approval prompt is low-friction and being active is the entire point. Disable per session with SKIP_PUSH_APPROVAL=true.

Validation

• shellcheck (repo's strict .shellcheckrc) and shfmt (per .editorconfig): clean.
• tests/validate-prompts.sh and scripts/generate-index.sh: pass, no index drift (hooks aren't indexed).
• Functional matrix (13 cases): push variants → ask; commits, separators, legit push, non-shell edits, and the disable switch → allow. Includes a no-jq fallback run.

Ref: Copilot hooks reference.