pre-push(17.1): never block a push the user did not choose to block

The installed hook exits 0 with one line when ousast (or OUSAST_COMMAND) is
not on PATH, still chaining a prior hook. In Git hook mode without an explicit
--mode blocking, argument/usage errors (an invalid OUSAST_PUSH_DEADLINE, a cache
directory inside the repository, a refused experimental flag) and unexpected
exceptions print one "check did not run" line and exit 0. Blocking mode keeps
its usage errors. Requirement 9.1.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

tests/test_push_hook.py

@@ -105,3 +105,42 @@ def test_install_refuses_dangling_symlink(tmp_path):
     result = subprocess.run([str(installer), str(root)], capture_output=True)
     assert result.returncode != 0
     assert not target.exists()
+
+
+def test_missing_ousast_never_blocks_the_push(tmp_path):
+    """17.1 / Req 9.1: a hook whose executable is absent allows the push and says the check did not run."""
+    root, _, head, git = history(tmp_path)
+    remote = tmp_path / "remote.git"
+    subprocess.run(["git", "init", "--bare", str(remote)], check=True, capture_output=True)
+    git("remote", "add", "origin", str(remote))
+    hooks = root / ".hooks"
+    hooks.mkdir()
+    git("config", "core.hooksPath", ".hooks")
+    shutil.copyfile(Path(__file__).resolve().parents[1] / "ops/pre-push", hooks / "pre-push")
+    (hooks / "pre-push").chmod(0o755)
+    env = {**os.environ, "OUSAST_COMMAND": "ousast-not-installed-anywhere", "OUSAST_ARTIFACT_DIR": str(tmp_path / "a")}
+    result = subprocess.run(["git", "-C", str(root), "push", "origin", "HEAD:refs/heads/main"], env=env, capture_output=True)
+    assert result.returncode == 0, result.stderr
+    assert b"pre-push check did not run" in result.stdout + result.stderr
+    assert git("ls-remote", str(remote)).startswith(head)
+
+
+@pytest.mark.parametrize(
+    ("extra", "expected"),
+    [
+        (["--deadline", "abc"], 0),
+        (["--cache-dir", "INSIDE"], 0),
+        (["--deadline", "abc", "--mode", "blocking"], 2),
+    ],
+)
+def test_hook_mode_usage_errors_are_advisory_unless_blocking(tmp_path, extra, expected):
+    """17.1 / Req 9.1: invalid settings in hook mode allow the push; explicit blocking keeps exit 2."""
+    import sys
+
+    root, _, _, _ = history(tmp_path)
+    extra = [str(root / "cache") if item == "INSIDE" else item for item in extra]
+    command = [sys.executable, "-m", "openultrasast.cli", "pre-push", str(root), "--artifact", str(tmp_path / "r.json")]
+    result = subprocess.run([*command, *extra, "--remote", "origin", "/tmp/remote"], input=b"", capture_output=True, timeout=60)
+    assert result.returncode == expected, result.stderr
+    if expected == 0:
+        assert b"pre-push check did not run" in result.stdout

tests/test_push_vetoes.py

@@ -247,8 +247,28 @@ def test_cli_refuses_the_flag_outside_explicit_replay(tmp_path, capsys):
     from openultrasast.cli import main
 
     root, base, head, _ = history(tmp_path)
+    # Hook mode refuses the flag without running anything; since 17.1 (Req 9.1) the refusal is advisory
+    # (exit 0 with a line), because a usage error in a hook must never reject the push.
+    hook = ["pre-push", str(root), "--remote", "origin", "/x", "--artifact", str(tmp_path / "x.json")]
+    refused = main([*hook, "--experimental-record-vetoes"])
+    captured = capsys.readouterr()
+    assert refused == 0 and "requires explicit --base/--head replay" in captured.err
+    assert "pre-push check did not run" in captured.out and not (tmp_path / "x.json").exists()
     with pytest.raises(SystemExit):
-        main(["pre-push", str(root), "--remote", "origin", "/x", "--artifact", str(tmp_path / "x.json"), "--experimental-record-vetoes"])
+        main(
+            [
+                "pre-push",
+                str(root),
+                "--remote",
+                "origin",
+                "/x",
+                "--artifact",
+                str(tmp_path / "x.json"),
+                "--mode",
+                "blocking",
+                "--experimental-record-vetoes",
+            ]
+        )
     assert "requires explicit --base/--head replay" in capsys.readouterr().err
     code = main(
         [