fix(retrofit): union hook groups by command within a matcher (dogfood F1+F3)

[tigers1997]

What & why

The 2026-05-30 dogfood (upgrading an adjacent Next.js/pnpm project from cc-configure 2.6.0 to post-2.6.0 HEAD) surfaced a HIGH-severity defect that PR #61 had explicitly scoped out.

deep_merge_settings deduped hook groups per event by whole-dict == (_merge_unique_list). When the configurator moves a hook between releases from a standalone matcher group to a bundled one — exactly what the post-2.6.0 safety change does, splitting a lone block-dangerous-bash Bash group into [block-dangerous-bash, check-package-availability] — the two group dicts aren't equal, so the new bundled group is appended. The user's .claude/settings.json ends with two Bash groups both containing block-dangerous-bash, which then fires twice on every Bash call.

PR #61 called this "rare … out of scope." The dogfood revises that: adding a hook to an existing matcher group is the normal way a module grows, so ~100% of safety-module users upgrading 2.6.0→latest inherit a double-firing dangerous-bash guard. Silent and security-relevant.

The fix

• F1 — _merge_hook_groups replaces whole-group dedup on the hooks path: key by matcher, union inner hooks[] by command, append a configurator command only when it's absent from every existing group sharing that matcher. The standalone+bundled pair collapses to one group, each command wired once.
  • User customizations survive untouched: a different command, a different matcher, or a tweaked-timeout copy under the same matcher is preserved (PR fix(retrofit): dedupe hook groups so repeated --retrofit stops inflating settings.json #61's test-user-customizations-preserved still passes).
  • The old N+1 self-heal still collapses exact whole-group duplicates.
  • [ MERGED ] summary gains an "N hook command(s)" counter.
• F3 — belt-and-suspenders. check_settings_validates gains a third check (_find_duplicate_hook_commands) flagging any command wired more than once under the same (event, matcher). Keyed by matcher, so the legitimate "same command under different matchers" case is not flagged. Emits a [ SETTINGS WARNINGS ] line. The merge prevents the corruption on every shipped upgrade path; F3 is the net for a residual already-corrupted file (e.g. a user who tracked unreleased HEAD — that bundled patch was never tagged, so no released upgrade produces it).

Scope boundary (honest)

A config already corrupted with two same-matcher groups is not auto-collapsed by the merge (that would collide with PR #61's deliberate same-command-different-timeout preservation). It is instead caught by F3 (verified). Real-world population of that state ≈ the dogfood author's own project, already hand-fixed.

Tests / CI

• New TDD fixtures (both fail against the old _merge_unique_list):
  • test/retrofit-hooks/test-standalone-bundled-merge.sh — the exact dogfood shape.
  • test/schema-hygiene/test-duplicate-hook-commands.sh — same-matcher dup flagged, cross-matcher allowed, within-group caught, clean + no-hooks-key pass.
• CI gap fixed: test/retrofit-hooks/ and test/schema-hygiene/ (created by PRs fix(schema-hygiene): retire //-stub pattern + drop unvalidatable skillOverrides #60/fix(retrofit): dedupe hook groups so repeated --retrofit stops inflating settings.json #61) were never wired into check.yml — they only ran locally. Both dirs are now workflow steps, so all 7 prior fixtures + the 2 new ones run in CI for the first time.
• Full end-to-end retrofit reproduction confirms block-dangerous-bash=1, check-package-availability=1, dupes=NONE after a standalone→bundled upgrade.
• configure.py --check clean. Adversarially reviewed (verdict: SHIP); non-list hooks[] append-path crash hardened with a coercion guard for parity with the read-side helpers.

Not in this PR

Dogfood findings F2, F4–F8 are separate follow-ups. Upstream survey (CC 2.1.155–2.1.158, SchemaStore #5723 still open) found nothing forcing a tested_up_to bump — 2.1.150 stays pinned.

🤖 Generated with Claude Code

[claude]

VERDICT: PASS

Clean, well-scoped fix. The _merge_hook_groups replacement for _merge_unique_list on the hooks path correctly addresses the F1 double-firing regression, the F3 _find_duplicate_hook_commands validator provides the right belt-and-suspenders net, the two new TDD fixtures directly cover the dogfood shape and the cross-matcher non-flagging invariant, and wiring the previously-local retrofit-hooks/ and schema-hygiene/ suites into check.yml closes a CI gap that predates this PR. CHANGELOG ## Unreleased entry present; no new third-party code; no changes to templates/discipline-skills/; no new settings.json schema keys.