From bf18ca3ef596d98eae8e0204943beb48684273bf Mon Sep 17 00:00:00 2001
From: Paul O'Reilly <hello@pauloreilly.nz>
Date: Fri, 8 May 2026 17:03:12 +1200
Subject: [PATCH] fix(agent-repo): capture git push output explicitly for
 diagnosis
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Probe 6 (2026-05-08) showed git push failing twice with exit 1 and
zero visible output — the previous form `if cmd 2>&1; then` redirected
git's stderr to stdout where the entrypoint's stderr-only log capture
missed it. CP-side log showed only the bash `set -x` trace, not the
actual git error message (e.g., "Permission denied (publickey)" or
"remote: pre-receive hook rejected").

Refactor the push retry loop:
- Capture output to PUSH_OUT via $() with `2>&1`
- Wrap in set +e/set -e to detect non-zero without aborting
- echo PUSH_OUT to stderr (where set -x trace also goes) so the
  entrypoint's stderr capture sees it

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 harnesses/contexts/agent-repo/v1/finalize.sh | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/harnesses/contexts/agent-repo/v1/finalize.sh b/harnesses/contexts/agent-repo/v1/finalize.sh
index a10d084..8d710db 100644
--- a/harnesses/contexts/agent-repo/v1/finalize.sh
+++ b/harnesses/contexts/agent-repo/v1/finalize.sh
@@ -344,13 +344,23 @@ for attempt in $(seq 1 $((PUSH_RETRIES + 1))); do
         sleep 5
         echo "Retry $attempt: git push $REPO_URL HEAD:refs/heads/$BRANCH --force"
     fi
-    if timeout 120 git push "$REPO_URL" "HEAD:refs/heads/$BRANCH" --force 2>&1; then
+    # Capture push output explicitly to stderr so it shows in finalize-error
+    # capture (the previous `if cmd 2>&1; then` form let git stderr go to
+    # stdout where it was lost — the actual push error message wasn't
+    # visible in CP logs, hiding e.g. "Permission denied (publickey)" or
+    # "remote: error: ..." rejections. Real incident: 2026-05-08 probe 6
+    # silently failed for 6 retries with no visible reason.
+    set +e
+    PUSH_OUT=$(timeout 120 git push "$REPO_URL" "HEAD:refs/heads/$BRANCH" --force 2>&1)
+    PUSH_EXIT=$?
+    set -e
+    echo "git push attempt $attempt exit=$PUSH_EXIT, output:" >&2
+    echo "$PUSH_OUT" >&2
+    if [ "$PUSH_EXIT" -eq 0 ]; then
         echo "Push succeeded (attempt $attempt)"
         PUSHED=true
-        PUSH_EXIT=0
         break
     else
-        PUSH_EXIT=$?
         echo "Push attempt $attempt failed with exit code $PUSH_EXIT"
         if [ "$attempt" -lt $((PUSH_RETRIES + 1)) ]; then
             echo "Will retry..."