fix(core): move session backup hook to post-push

Author: skulidropek

packages/lib/src/core/docker-git-scripts.ts

@@ -11,8 +11,8 @@
 /**
  * Names of docker-git scripts that must be available inside generated containers.
  *
- * These scripts are referenced by git hooks (pre-push, pre-commit) and session
- * backup workflows. They are copied into each project's build context under
+ * These scripts are referenced by git hooks (pre-push, post-push, pre-commit) and
+ * session backup workflows. They are copied into each project's build context under
  * `scripts/` and embedded into the Docker image at `/opt/docker-git/scripts/`.
  *
  * @pure true

packages/lib/src/core/templates-entrypoint/git.ts

@@ -129,6 +129,7 @@ const entrypointGitHooksTemplate = String
   .raw`# 3) Install global git hooks to protect main/master + managed AGENTS context
 HOOKS_DIR="/opt/docker-git/hooks"
 PRE_PUSH_HOOK="$HOOKS_DIR/pre-push"
+POST_PUSH_HOOK="$HOOKS_DIR/post-push"
 mkdir -p "$HOOKS_DIR"
 
 cat <<'EOF' > "$PRE_PUSH_HOOK"
@@ -256,14 +257,17 @@ done
 EOF
 chmod 0755 "$PRE_PUSH_HOOK"
 
-cat <<'EOF' >> "$PRE_PUSH_HOOK"
+cat <<'EOF' > "$POST_PUSH_HOOK"
+#!/usr/bin/env bash
+set -euo pipefail
 
+# 5) Run session backup after successful push
 REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
 cd "$REPO_ROOT"
 
-# CHANGE: resolve session-backup script from /opt/docker-git/scripts (embedded) or repo-local fallback
-# WHY: docker-git scripts are now embedded in the container image at /opt/docker-git/scripts
-# REF: issue-176
+# CHANGE: run session backup in post-push so source commit has already landed in remote
+# WHY: backups should mirror successfully pushed state and not block push validation
+# REF: issue-192
 if [ "${"${"}DOCKER_GIT_SKIP_SESSION_BACKUP:-}" != "1" ]; then
   if command -v gh >/dev/null 2>&1; then
     BACKUP_SCRIPT=""
@@ -273,11 +277,13 @@ if [ "${"${"}DOCKER_GIT_SKIP_SESSION_BACKUP:-}" != "1" ]; then
       BACKUP_SCRIPT="$REPO_ROOT/scripts/session-backup-gist.js"
     fi
     if [ -n "$BACKUP_SCRIPT" ]; then
-      node "$BACKUP_SCRIPT" --verbose || echo "[session-backup] Warning: session backup failed (non-fatal)"
+      node "$BACKUP_SCRIPT" || echo "[session-backup] Warning: session backup failed (non-fatal)"
     fi
   fi
 fi
 EOF
+chmod 0755 "$POST_PUSH_HOOK"
+
 git config --system core.hooksPath "$HOOKS_DIR" || true
 git config --global core.hooksPath "$HOOKS_DIR" || true`
 

packages/lib/tests/core/templates.test.ts

@@ -4,6 +4,7 @@ import { defaultTemplateConfig, type TemplateConfig } from "../../src/core/domai
 import { renderDockerCompose } from "../../src/core/templates/docker-compose.js"
 import { renderEntrypoint } from "../../src/core/templates-entrypoint.js"
 import { renderEntrypointDnsRepair } from "../../src/core/templates-entrypoint/dns-repair.js"
+import { renderEntrypointGitHooks } from "../../src/core/templates-entrypoint/git.js"
 
 const makeTemplateConfig = (overrides: Partial<TemplateConfig> = {}): TemplateConfig => ({
   ...defaultTemplateConfig,
@@ -47,6 +48,21 @@ describe("renderEntrypointDnsRepair", () => {
   })
 })
 
+describe("renderEntrypointGitHooks", () => {
+  it("installs pre-push protection checks and post-push backup hook", () => {
+    const hooks = renderEntrypointGitHooks()
+
+    expect(hooks).toContain('PRE_PUSH_HOOK="$HOOKS_DIR/pre-push"')
+    expect(hooks).toContain('POST_PUSH_HOOK="$HOOKS_DIR/post-push"')
+    expect(hooks).toContain("cat <<'EOF' > \"$PRE_PUSH_HOOK\"")
+    expect(hooks).toContain("cat <<'EOF' > \"$POST_PUSH_HOOK\"")
+    expect(hooks).toContain("check_issue_managed_block_range")
+    expect(hooks).toContain("Run session backup after successful push")
+    expect(hooks).toContain("node \"$BACKUP_SCRIPT\"")
+    expect(hooks).not.toContain("node \"$BACKUP_SCRIPT\" --verbose")
+  })
+})
+
 describe("renderDockerCompose", () => {
   it("renders fallback DNS servers for the main container even without Playwright", () => {
     const compose = renderDockerCompose(makeTemplateConfig())

scripts/session-backup-gist.js

@@ -410,7 +410,7 @@ const buildSnapshotReadme = ({ backupRepo, source, manifestUrl, summary, session
     "",
     `- Manifest: ${manifestUrl}`,
     "",
-    "Generated automatically by the docker-git `pre-push` session backup hook.",
+    "Generated automatically by the docker-git `post-push` session backup hook.",
     "",
   ].join("\n");