Keep default pre-push checks fast for contributors

The pre-push hook already treats live model smoke as optional at runtime, but an existing local config can keep it enabled after reinstalling the hook. Default hook installation now writes the fast local setting explicitly unless a provider selector is supplied, so fresh forks and repeated installs stay on the PR gate path by default while release maintainers can still opt into live smoke.

Constraint: Daily contributor pushes should not depend on real provider access or long desktop smoke runs
Rejected: Remove live smoke lanes entirely | release and provider changes still need an explicit high-confidence validation path
Confidence: high
Scope-risk: narrow
Directive: Keep live provider and desktop smoke opt-in for push hooks; use quality:smoke or baseline gates for release validation
Tested: bun test scripts/git-hooks/install.test.ts
Tested: bun run check:policy
Not-tested: Full bun run verify before commit; push hook will run the non-live PR gate

Author: NanmiCoder

scripts/git-hooks/install.test.ts

@@ -69,6 +69,29 @@ describe('installPrePushHook', () => {
     }
   })
 
+  test('disables stale live smoke settings during default install', () => {
+    const tempDir = mkdtempSync(join(tmpdir(), 'git-hook-install-test-'))
+    try {
+      runGit(tempDir, ['init'])
+      runGit(tempDir, ['config', '--local', 'quality.prePushLive', 'true'])
+      runGit(tempDir, ['config', '--local', 'quality.prePushProviderModels', 'codingplan:main:codingplan-main'])
+      const sourcePath = join(tempDir, 'source-pre-push')
+      writeFileSync(sourcePath, '#!/usr/bin/env bash\necho default\n')
+
+      const result = installPrePushHook({
+        rootDir: tempDir,
+        sourcePath,
+      })
+
+      expect(result.liveConfigured).toBe(false)
+      expect(readFileSync(result.hookPath, 'utf8')).toContain('echo default')
+      expect(runGit(tempDir, ['config', '--local', '--get', 'quality.prePushLive'])).toBe('false')
+      expect(runGit(tempDir, ['config', '--local', '--get', 'quality.prePushProviderModels'])).toBe('codingplan:main:codingplan-main')
+    } finally {
+      rmSync(tempDir, { recursive: true, force: true })
+    }
+  })
+
   test('stores live gate settings in local git config', () => {
     const tempDir = mkdtempSync(join(tmpdir(), 'git-hook-install-test-'))
     try {

scripts/git-hooks/install.ts

@@ -82,13 +82,14 @@ export function installPrePushHook(options: InstallPrePushHookOptions = {}): Ins
     gitConfig(rootDir, 'quality.allowMissingTests', 'true')
   }
 
-  if (options.live === false) {
-    gitConfig(rootDir, 'quality.prePushLive', 'false')
-  }
+  const shouldWriteGitConfig = !options.hookPath
+  const shouldEnableLive = options.live !== false && Boolean(options.liveProviderModels?.length)
 
-  if (options.liveProviderModels && options.liveProviderModels.length > 0) {
+  if (shouldWriteGitConfig && shouldEnableLive) {
     gitConfig(rootDir, 'quality.prePushLive', 'true')
-    gitConfig(rootDir, 'quality.prePushProviderModels', options.liveProviderModels.join(' '))
+    gitConfig(rootDir, 'quality.prePushProviderModels', options.liveProviderModels?.join(' ') ?? '')
+  } else if (shouldWriteGitConfig) {
+    gitConfig(rootDir, 'quality.prePushLive', 'false')
   }
 
   if (options.liveMode) {
@@ -162,11 +163,12 @@ function printHelp() {
   console.log(`Install the repository pre-push quality gate.
 
 Usage:
-  bun run hooks:install [-- --force] [-- --live-provider-model <selector>] [-- --live-mode smoke|baseline]
+  bun run hooks:install [-- --force] [-- --no-live] [-- --live-provider-model <selector>] [-- --live-mode smoke|baseline]
   bun run hooks:install -- --allow-cli-core-change --allow-coverage-baseline-change
 
 Examples:
   bun run hooks:install
+  bun run hooks:install -- --no-live
   bun run quality:providers
   bun run hooks:install -- --live-provider-model codingplan:main:codingplan-main
   bun run hooks:install -- --live-provider-model codingplan:main:codingplan-main --live-mode baseline