pre-push rejects any push that would update refs/heads/main, however the command is spelled; pre-commit and pre-merge-commit refuse commits while main is checked out. npm install enables them via core.hooksPath. The README documents the three layers of protection for main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>