nikivdev/code · warning

{}

Error message

{}

What it means

Raised by run_hook_eval in src/push_hook.rs when the Flow push policy evaluation returns allow=false for the pre-push context. The hook aborts the push (this binary runs as the git pre-push hook), printing either the policy's custom message or the default 'push denied by Flow push policy'.

Source

Thrown at src/push_hook.rs:48

    let policy = push_policy::load_merged_push_policy(&repo_root)?;
    let current_branch = current_branch(&repo_root)?;
    let updates = push_policy::parse_pre_push_updates(&input);
    let decision = push_policy::evaluate_pre_push(
        &PushContext {
            repo_root: repo_root.clone(),
            current_branch: current_branch.clone(),
            remote_name: cmd.remote_name.clone(),
            remote_url: cmd.remote_url.clone(),
            updates,
            orchestrated: env::var("FLOW_PUSH_ORCHESTRATED")
                .map(|value| value == "1")
                .unwrap_or(false),
        },
        &policy,
    );

    if !decision.allow {
        bail!(
            "{}",
            decision
                .message
                .unwrap_or_else(|| "push denied by Flow push policy".to_string())
        )
    }

    if decision.policy.run_prek {
        run_prek_validation(
            &repo_root,
            &policy,
            cmd.remote_name.as_deref(),
            cmd.remote_url.as_deref(),
            current_branch.as_deref(),
            decision.policy.home_branch.as_deref(),
        )?;
    }

View on GitHub (pinned to a747e741ae)

Solutions

1. Read the denial message printed by the error — it may name the violated policy rule
2. Push to the branch/remote the policy allows (e.g. open a PR targeting home_branch instead of pushing to it directly)
3. If the push is meant to be orchestrated, set FLOW_PUSH_ORCHESTRATED=1 as required, or adjust the push policy config if the rule is outdated

Example fix

// before: denied direct push to main
$ git push origin main
push denied by Flow push policy
// after
$ git checkout -b feature/x && git push origin feature/x

// check the effective policy before pushing
// f push hooks status / inspect the policy file for home_branch and orchestrated requirements
if std::env::var("FLOW_PUSH_ORCHESTRATED").as_deref() != Ok("1")
    && policy_requires_orchestration {
    eprintln!("policy requires orchestrated pushes; set FLOW_PUSH_ORCHESTRATED=1");
}

match result {
    Err(e) if e.to_string().contains("push denied by Flow push policy")
        || e.to_string().contains("denied") => {
        eprintln!("push blocked by policy: {}", e);
        // switch to the allowed branch/remote or adjust policy
    }
    Err(e) => return Err(e),
    Ok(v) => Ok(v),
}

When it happens

Trigger: A git push triggers the Flow pre-push hook; evaluate_pre_push returns a deny decision based on the merged push policy (e.g. pushing to a branch that is not the policy's home_branch, pushing from an unorchestrated context when required, or remote/branch restrictions).

Common situations: Developer pushing directly to a protected/home branch instead of a feature branch; FLOW_PUSH_ORCHESTRATED env var not set when the policy requires orchestrated pushes; pushing to the wrong remote; policy config file tightened by the team.

AI-assisted analysis of nikivdev/code@a747e741ae (2026-09-01). Data as JSON: /api/errors/69135ccd18063105. Report an issue: GitHub.