Make pre-push protection safe when chained after stdin-consuming hooks

[CodeDeficient]

Problem

.githooks/pre-push reads Git's pre-push ref-update records from standard input. The setup script refuses to replace an existing pre-push hook and tells users to manually chain KarpeSlop from it.

If the existing hook consumes stdin before invoking .githooks/pre-push, KarpeSlop receives EOF, checks no refs, and exits successfully. A push targeting main or master can then bypass this local guard.

Desired behavior

Manual chaining must preserve the Git ref-update stream for the KarpeSlop hook, or the installer must provide a supported wrapper/chaining mechanism that guarantees the guard runs with the original stdin.

Scope

• Reproduce with an existing stdin-consuming pre-push hook.
• Define a supported chaining contract.
• Add regression coverage for multi-ref input and consumed-stdin scenarios.
• Keep server-side protected-branch enforcement documented as the authoritative safeguard.

Relationship

Follow-up from PR #31: #31

[coderabbitai]

🔗 Related PRs

#31 - chore: block direct pushes to protected branches [open]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!