From b34f1fd3f295a2ff4648bdbbffd81da8966def2c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=93=B8=E6=BE=9C=20+=20=E5=86=B0=E6=9C=94?=
 <zhulan.bingshuo@guanghu.local>
Date: Tue, 14 Jul 2026 18:35:54 -0700
Subject: [PATCH] =?UTF-8?q?=E9=93=B8=E6=BE=9C=20+=20=E5=86=B0=E6=9C=94=20?=
 =?UTF-8?q?=C2=B7=20=E5=A2=9E=E5=8A=A0=E6=97=A7=E9=97=A8=E7=A6=81=E4=BF=9D?=
 =?UTF-8?q?=E7=95=99=E5=BC=8F=E4=B8=B2=E8=81=94=E9=83=A8=E7=BD=B2=E5=99=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../install-chained-pre-receive.sh            | 51 +++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 zero-point/core-channel/revive-guard/install-chained-pre-receive.sh

diff --git a/zero-point/core-channel/revive-guard/install-chained-pre-receive.sh b/zero-point/core-channel/revive-guard/install-chained-pre-receive.sh
new file mode 100644
index 0000000..e29a136
--- /dev/null
+++ b/zero-point/core-channel/revive-guard/install-chained-pre-receive.sh
@@ -0,0 +1,51 @@
+#!/bin/bash
+# Install the navigation guard beside an existing Forgejo pre-receive hook.
+# The existing hook remains first in the execution chain and is preserved as a
+# rollback file.  This script must run only in an authorized server session.
+
+set -euo pipefail
+
+HOOK_DIR="${1:-}"
+MODE="${2:-reject}"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+SUPPORT_DIR="${HOOK_DIR}/guanghu-navigation-guard"
+ORIGINAL="${HOOK_DIR}/pre-receive.before-navigation"
+HOOK="${HOOK_DIR}/pre-receive"
+
+if [ -z "${HOOK_DIR}" ] || [ ! -d "${HOOK_DIR}" ]; then
+    echo "usage: $0 <existing-bare-repo-hooks-dir> [reject|notify]" >&2
+    exit 2
+fi
+if [ ! -f "${HOOK}" ]; then
+    echo "refusing: existing pre-receive hook is required for chained install" >&2
+    exit 2
+fi
+if [ -e "${ORIGINAL}" ]; then
+    echo "refusing: rollback hook already exists: ${ORIGINAL}" >&2
+    exit 3
+fi
+
+mkdir -p "${SUPPORT_DIR}"
+install -m 0755 "${SCRIPT_DIR}/pre-receive-guard.py" "${SUPPORT_DIR}/pre-receive-guard.py"
+install -m 0755 "${SCRIPT_DIR}/navigation-memory-guard.py" "${SUPPORT_DIR}/navigation-memory-guard.py"
+python3 -m py_compile "${SUPPORT_DIR}/pre-receive-guard.py" "${SUPPORT_DIR}/navigation-memory-guard.py"
+
+cp -p "${HOOK}" "${ORIGINAL}"
+
+cat > "${HOOK}" <<WRAPPER
+#!/bin/bash
+# Guanghu chained pre-receive: preserved legacy hook first, navigation guard second.
+set -o pipefail
+HOOK_DIR="${HOOK_DIR}"
+ORIGINAL="${ORIGINAL}"
+SUPPORT_DIR="${SUPPORT_DIR}"
+REFS="\$(mktemp "\${HOOK_DIR}/.pre-receive.refs.XXXXXX")"
+trap 'rm -f "\${REFS}"' EXIT
+cat > "\${REFS}"
+"\${ORIGINAL}" < "\${REFS}" || exit \$?
+PRE_RECEIVE_MODE="${MODE}" python3 "\${SUPPORT_DIR}/pre-receive-guard.py" < "\${REFS}"
+WRAPPER
+chmod 0755 "${HOOK}"
+
+echo "installed chained pre-receive guard"
+echo "rollback: cp -p ${ORIGINAL} ${HOOK}"