@dzhechkov/harness-core 0.8.34 → 0.8.35

package/src/index.ts

@@ -12,6 +12,12 @@ export const HARNESS_CORE_VERSION: string =
 
 export { REPOSITORY_ORIGIN } from './repository-origin.js';
 
+// Fix-round 1 (feature recall-short-terms, Codex HIGH-1c): `dz recall`'s CLI printer needs the
+// single source of truth for "why did this query tokenize to nothing" without harness-cli taking
+// a new direct dependency on `@dzhechkov/memory` (a publishing-surface change outside this
+// feature's scope) — harness-core already depends on memory, so it re-exports the one helper.
+export { noSearchableTermsReason } from '@dzhechkov/memory';
+
 export * from './skills.js';
 export * from './apply.js';
 export {
@@ -246,6 +252,7 @@ export {
   applyLegHookEntries,
   applyLegStatus,
   applyLegReasonMessage,
+  probeApplyLeg,
   resolveIdleMs,
   IDLE_MS_INT32_MAX,
 } from './apply-leg.js';
@@ -255,6 +262,7 @@ export type {
   ApplyLegHookPresence,
   ApplyLegStatus,
   ApplyLegNotInstalledReason,
+  ApplyLegProbeResult,
   ResolvedIdleMs,
 } from './apply-leg.js';
 // embed-socket-short-path: the ONE resolver the daemon (inlined text), the recall hook (inlined
@@ -303,7 +311,7 @@ export {
   segmentRun,
 } from './eta.js';
 export type { CheckpointObservation, EtaEstimate, EtaInput, IncompleteCoverageSample, RunSegment, StageDurationSample, StageSample } from './eta.js';
-export { indexPatternsToAgentdb, resolveAgentdbPath, searchAgentdbPatterns, listAgentdbDzIds, resolveAgentdbEmbedder, resetAgentdbEmbedderCache, getAgentdbEmbedderCacheStats, cosineSimilarity, importVectorsToAgentdb, reindexAgentdbRows, bumpAgentdbUses, clearAgentdbQuarantine, deleteAgentdbByDzIds, readAgentdbRowsByTaskType, DZ_OWNED_TASK_TYPES, ensureAgentdbSchema } from './agentdb-index.js';
+export { indexPatternsToAgentdb, resolveAgentdbPath, searchAgentdbPatterns, listAgentdbDzIds, resolveAgentdbEmbedder, resetAgentdbEmbedderCache, getAgentdbEmbedderCacheStats, cosineSimilarity, importVectorsToAgentdb, reindexAgentdbRows, bumpAgentdbUses, clearAgentdbQuarantine, deleteAgentdbByDzIds, readAgentdbRowsByTaskType, DZ_OWNED_TASK_TYPES, ensureAgentdbSchema, readStoreGeneration, bumpStoreGeneration } from './agentdb-index.js';
 export type { AgentdbSearchHit, AgentdbSearchResult, AgentdbImportRow } from './agentdb-index.js';
 export { DEFAULT_EMBED_MODEL, LEGACY_EMBED_MODEL, DEFAULT_EMBED_DIM, KNOWN_EMBED_DIMS, resolveEmbedModel, readEmbedManifest, writeEmbedManifest, embedManifestPath, legacyEmbedManifest } from './embedding-config.js';
 export type { EmbedModelConfig, EmbedModelSource, EmbedManifest } from './embedding-config.js';

package/src/mutation-gate.ts

@@ -77,6 +77,22 @@ export interface MutationRegistry {
   readonly testCommand?: string;
   /** opt-in proof that the suite harness reached its clean completion path. */
   readonly requireCompletionReceipt?: boolean;
+  /**
+   * optional per-registry suite-run ceiling in milliseconds (mutation-gate-timeout-verdict FR-3):
+   * a package whose real baseline runs longer than the executor's 300000ms default (e.g. this
+   * repo's core package, MEASURED ≈5-8 min) declares its own floor here so `dz mutation-gate` with
+   * no `--timeout` flag still succeeds — precedence is flag > this field > the 300000ms default.
+   */
+  readonly timeoutMs?: number;
+  /**
+   * optional per-registry vitest worker ceiling (mutation-gate-baseline-honesty FR-2): baseline and
+   * mutant runs spawn the package's FULL `testCommand` at vitest's default worker count (= cpu
+   * cores), and under embedding-daemon tests (0.7-3.5 GB/process) this repo's core package measured
+   * load 62-358 and 0.4-1.8 GB free on an 8-core/16GB box — three full runs died overnight
+   * (0bb74d66). The same suite with `--maxWorkers=2` passed (6909/6909). Precedence is the
+   * `--max-workers` flag > this field > `min(4, max(1, floor(cpus/2)))`.
+   */
+  readonly maxWorkers?: number;
   readonly entries: readonly MutationRegistryEntry[];
 }
 
@@ -306,10 +322,12 @@ export function parseMutationRegistry(text: string): ParsedRegistry {
   let entriesRaw: unknown;
   let testCommand: string | undefined;
   let requireCompletionReceipt: boolean | undefined;
+  let timeoutMs: number | undefined;
+  let maxWorkers: number | undefined;
   if (Array.isArray(raw)) {
     entriesRaw = raw;
   } else if (raw && typeof raw === 'object') {
-    const obj = raw as { testCommand?: unknown; requireCompletionReceipt?: unknown; entries?: unknown };
+    const obj = raw as { testCommand?: unknown; requireCompletionReceipt?: unknown; timeoutMs?: unknown; maxWorkers?: unknown; entries?: unknown };
     entriesRaw = obj.entries;
     if (obj.testCommand !== undefined) {
       if (typeof obj.testCommand !== 'string' || obj.testCommand.trim() === '') {
@@ -323,6 +341,18 @@ export function parseMutationRegistry(text: string): ParsedRegistry {
       }
       requireCompletionReceipt = obj.requireCompletionReceipt;
     }
+    if (obj.timeoutMs !== undefined) {
+      if (typeof obj.timeoutMs !== 'number' || !Number.isFinite(obj.timeoutMs) || obj.timeoutMs <= 0) {
+        return { registry: null, entryResults: [], errors: ['timeoutMs must be a finite number > 0 when present'] };
+      }
+      timeoutMs = obj.timeoutMs;
+    }
+    if (obj.maxWorkers !== undefined) {
+      if (typeof obj.maxWorkers !== 'number' || !Number.isInteger(obj.maxWorkers) || obj.maxWorkers < 1) {
+        return { registry: null, entryResults: [], errors: ['maxWorkers must be a positive integer when present'] };
+      }
+      maxWorkers = obj.maxWorkers;
+    }
   }
   if (!Array.isArray(entriesRaw)) {
     return { registry: null, entryResults: [], errors: ['registry must be an array of entries or {testCommand?, requireCompletionReceipt?, entries: [...]}'] };
@@ -439,6 +469,8 @@ export function parseMutationRegistry(text: string): ParsedRegistry {
     registry: {
       ...(testCommand !== undefined ? { testCommand } : {}),
       ...(requireCompletionReceipt !== undefined ? { requireCompletionReceipt } : {}),
+      ...(timeoutMs !== undefined ? { timeoutMs } : {}),
+      ...(maxWorkers !== undefined ? { maxWorkers } : {}),
       entries,
     },
     entryResults,
@@ -446,6 +478,26 @@ export function parseMutationRegistry(text: string): ParsedRegistry {
   };
 }
 
+// ── Feature scoping (qe-step-gate-scoped-to-feature) — pure registry diff, no IO ───────────────
+//
+// Step 8's QE mutation gate ran the FULL registry unconditionally (MEASURED 2026-09-12: 358
+// entries on this repo's core package, 30-40 minutes, timed out INCONCLUSIVE every time), though a
+// feature only owns its own touched files and any entries it newly declares. The `--touched` and
+// `--added-since` CLI selectors (harness-cli's executor) scope the run; the executor reads the base
+// registry via `git show <ref>:<path>` (I/O) and hands both parsed registries to this PURE diff so
+// the comparison itself stays testable without a filesystem or git process (NFR-1).
+
+/** Entry ids present in `current` but absent from `base` (by id, not by content). A `null` base
+ *  means the registry did not exist at the reference point — every current entry counts as added. */
+export function registryEntriesAddedSince(
+  base: MutationRegistry | null,
+  current: MutationRegistry,
+): string[] {
+  if (base === null) return current.entries.map((entry) => entry.id);
+  const baseIds = new Set(base.entries.map((entry) => entry.id));
+  return current.entries.filter((entry) => !baseIds.has(entry.id)).map((entry) => entry.id);
+}
+
 // ── Mutation application — exact text surgery, exactly once (rule 1) ──────────────────────────
 
 export interface AppliedMutation {
@@ -732,7 +784,11 @@ export function attributeBaselineRedness(
     if (file !== null && !files.includes(file)) files.push(file);
   };
 
-  const vitestMatches = [...output.matchAll(/^\s*FAIL\s+(\S+)/gm)];
+  // mutation-gate-baseline-honesty FR-1: vitest 3 prints an optional POOL LABEL between `FAIL` and
+  // the file path (`FAIL  |serial| test/x.test.ts > case`, `FAIL  |parallel| …`) — the plain
+  // `(\S+)` used to capture the label itself as "the file", which normaliseReportedFile then
+  // rejects, turning a perfectly parseable red run into `unparseable from runner output`.
+  const vitestMatches = [...output.matchAll(/^\s*FAIL\s+(?:\|[^|\n]*\|\s+)?(\S+)/gm)];
   for (const match of vitestMatches) add(match[1] ?? '');
 
   const tapMatches = [...output.matchAll(/^not ok \d+\s+-\s+(.+)$/gm)];

package/src/operations.ts

@@ -6,7 +6,7 @@
  * @packageDocumentation
  */
 
-import { execFileSync, spawnSync } from 'node:child_process';
+import { execFileSync, spawnSync, type SpawnSyncOptionsWithStringEncoding } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
@@ -1542,6 +1542,33 @@ export async function runDoctor(options: { projectRoot: string }): Promise<Docto
               ? `embed socket present at ${resolved.path}${tmpdirNote}${engineNote} — recall injection can run`
               : `embed socket ABSENT at ${resolved.path}: the recall hook is wired but cannot inject (the hook self-heals on the next prompt; a persistent absence means the daemon cannot start)`,
           });
+
+          // APPLY-LEG INJECTS — live probe (feature `apply-leg-never-silent`, ADR-001 Decision 1).
+          // Issue #2's whole defect was that `installed`/`alive` above can ALL read green while the
+          // leg injects nothing in every session but one (a foreign install-root symptom the file-
+          // presence and socket-presence checks above cannot see by construction — they check for
+          // the RIGHT FILES at the RIGHT PATH, never whether the deployed COMMAND actually resolves
+          // to this project's store from a foreign cwd). This row is the difference: it runs the
+          // ACTUAL configured hook command end-to-end and is green ONLY on an observed injection.
+          // Deliberately a SEPARATE try/catch from the socket-alive check above: a probe failure
+          // must never suppress the (already useful) socket-presence row, and vice versa.
+          try {
+            const { probeApplyLeg } = await import('./apply-leg.js');
+            const probe = await probeApplyLeg(root);
+            checks.push({
+              name: 'apply-leg injects (live probe)',
+              ok: probe.ok,
+              detail: probe.ok
+                ? `live probe injected its beacon lesson in ${probe.elapsedMs}ms — the recall hook actually finds this project's store`
+                : `installed but silent: ${probe.reason ?? 'unknown'} (probed in ${probe.elapsedMs}ms) — dz setup wrote the hook, but it is not injecting anything into real sessions`,
+            });
+          } catch (err) {
+            checks.push({
+              name: 'apply-leg injects (live probe)',
+              ok: false,
+              detail: `live probe could not run: ${err instanceof Error ? err.message : String(err)}`,
+            });
+          }
         }
       }
     } catch {
@@ -1852,18 +1879,57 @@ function probeCodexVersion(): string | null {
  * with the helper's own self-failure note unable to fire because the process never started.
  * Grading on file presence would call that "installed".
  */
-export function probeHookLiveness(command: string, payload: string): { readonly status: number | null; readonly stderr: string } {
+/**
+ * `opts` (feature `apply-leg-never-silent`, ADR-001 D1): additive, optional — every pre-existing
+ * 2-arg caller (the Codex veto-hook liveness checks above) is unaffected. `cwd`/`env` let a caller
+ * reproduce the EXACT conditions a real invoking session presents (a foreign cwd, an overridden
+ * `CLAUDE_PROJECT_DIR`) rather than always running from THIS process's own cwd/env — the apply-leg
+ * live probe needs exactly that to prove install-root resolution end-to-end, not merely structurally.
+ * `stdout` is returned alongside `stderr`/`status` for the same reason: a UserPromptSubmit hook's
+ * payload (`hookSpecificOutput.additionalContext`) rides stdout, not stderr (see `probeApplyLeg`'s
+ * own doc comment for the measured stderr-visibility fact this displaces).
+ */
+export function probeHookLiveness(
+  command: string,
+  payload: string,
+  opts: { readonly cwd?: string; readonly env?: Readonly<Record<string, string>>; readonly timeoutMs?: number } = {},
+): { readonly status: number | null; readonly stdout: string; readonly stderr: string } {
   const shell = process.env['SHELL'] ?? '/bin/sh';
   try {
-    const res = spawnSync(shell, ['-lc', command], {
+    // AM-5 (fix round 1, apply-leg-never-silent): `detached: true` puts the shell in its OWN
+    // process GROUP (pgid === its own pid) instead of sharing the caller's — `spawnSync`'s own
+    // timeout kill signals only the DIRECT child (the shell), never anything the shell forked, so a
+    // `node "<hook>" || true` grandchild that is still running when the shell dies is orphaned but
+    // free to keep touching whatever this probe is about to remove (the beacon, the temp cwd).
+    // Killing the NEGATIVE pid below reaches the whole group in one signal. `@types/node`'s
+    // `SpawnSyncOptions` does not DECLARE `detached` (only the async `SpawnOptions` does) — MEASURED
+    // this is a typings gap, not a runtime one: a real child under `spawnSync(..., {detached:true})`
+    // reports its own pgid === its own pid (verified with `ps -o pgid=`), exactly as it would under
+    // async `spawn`. Widened via an inline type intersection rather than `as any` so every OTHER key
+    // stays checked.
+    const spawnOpts: SpawnSyncOptionsWithStringEncoding & { readonly detached?: boolean } = {
       input: payload,
       encoding: 'utf8',
-      timeout: 20_000,
-      env: { ...process.env, DZ_HOOK_LIVENESS_PROBE: '1' },
-    });
-    return { status: res.status, stderr: res.stderr ?? '' };
+      timeout: opts.timeoutMs ?? 20_000,
+      detached: true,
+      ...(opts.cwd !== undefined ? { cwd: opts.cwd } : {}),
+      env: { ...process.env, DZ_HOOK_LIVENESS_PROBE: '1', ...(opts.env ?? {}) },
+    };
+    const res = spawnSync(shell, ['-lc', command], spawnOpts);
+    // Belt, run on EVERY outcome (timeout OR a clean, on-time exit): a `node` grandchild can still
+    // be alive in the group even after the shell itself exited normally (e.g. it double-forked or
+    // outlived a `|| true` that already returned). ESRCH — the common, successful case, everything
+    // already exited — is swallowed; this is best-effort cleanup, never a probe failure.
+    if (typeof res.pid === 'number' && res.pid > 0) {
+      try {
+        process.kill(-res.pid, 'SIGKILL');
+      } catch {
+        /* group already gone */
+      }
+    }
+    return { status: res.status, stdout: res.stdout ?? '', stderr: res.stderr ?? '' };
   } catch (err) {
-    return { status: null, stderr: String((err as Error)?.message ?? err) };
+    return { status: null, stdout: '', stderr: String((err as Error)?.message ?? err) };
   }
 }
 
@@ -2043,7 +2109,7 @@ export function runSyncCodexHooks(options: CodexHooksSyncOptions = {}): CodexHoo
   //     a home that never opted in (the leg-1 F12 lesson).
   if (options.check === true) {
     const drift = diffCodexHooks(currentText, entries, manifest);
-    const live = drift.installed && options.liveness !== false ? probeHookLiveness(entries[0]!.command, ALLOWED_PROBE_PAYLOAD) : { status: null, stderr: '' };
+    const live = drift.installed && options.liveness !== false ? probeHookLiveness(entries[0]!.command, ALLOWED_PROBE_PAYLOAD) : { status: null, stdout: '', stderr: '' };
     const executable = drift.installed && (options.liveness === false || live.status === 0 || live.status === 2);
     // `--check` must report the TRUST axis too. Without it the report said `installed && executable`
     // with `trust: 'unknown'`, and the CLI printed a success word for it — the exact G-G/AM-17
@@ -2142,7 +2208,7 @@ export function runSyncCodexHooks(options: CodexHooksSyncOptions = {}): CodexHoo
 
 
   // (6) LIVENESS: exit 127 is ALLOW to the runtime, so it must never be graded as installed (G-L).
-  const live = options.liveness === false ? { status: 0, stderr: '' } : probeHookLiveness(entries[0]!.command, ALLOWED_PROBE_PAYLOAD);
+  const live = options.liveness === false ? { status: 0, stdout: '', stderr: '' } : probeHookLiveness(entries[0]!.command, ALLOWED_PROBE_PAYLOAD);
   const executable = live.status === 0 || live.status === 2;
   if (!executable) {
     warnings.push(

package/src/setup.ts

@@ -752,12 +752,17 @@ function installDriverDocs(projectRoot: string, force: boolean): string {
  * forth forever and neither step ever reports `skipped`, breaking the pre-existing
  * `setup.test.ts` "PreCompact merge is idempotent" contract (FR-6) this feature must not touch.
  *
- * ADDITIVE-ONLY, deliberately NOT `mergeManagedHookEntries`: this step never needs to REPLACE a
- * stale command text (the two commands `applyLegHookEntries()` emits do not change without an
- * `APPLY_LEG_VERSION` bump, and a version bump is about the FILE content, not the hook command) —
- * it only needs "is our command already referenced under this event, anywhere, in any position?".
- * That question is order-independent, so it can never itself be a source of reordering, and it is
- * exactly what keeps "Configure hooks" stable once the first run has established the layout above.
+ * ADD-OR-REPLACE-IN-PLACE, deliberately NOT `mergeManagedHookEntries`: this step never REORDERS —
+ * a match keeps its POSITION, only its command text is swapped — so it stays the same "is our
+ * command already referenced under this event, anywhere, in any position?" question
+ * `mergeManagedHookEntries`'s drop-and-reappend-at-tail algorithm answers differently (by moving
+ * the entry), which is exactly what "Configure hooks" must never do to a foreign SessionStart entry
+ * on the very first run (see above). Before feature `apply-leg-install-root` the two commands never
+ * changed without an `APPLY_LEG_VERSION` bump (a version bump is about the FILE content, not the
+ * hook command), so ADDITIVE-ONLY (skip on any match) and ADD-OR-REPLACE (rewrite text on a
+ * stale-form match) were behaviourally identical; an install-root migration now changes the command
+ * text on its own, independent of the file version, so a stale `CLAUDE_PROJECT_DIR`-relative entry
+ * from a pre-feature install must be rewritten in place on the next `dz setup`, not left stale.
  */
 function applyLegStepResult(opts: SetupOptions, backend: MemoryBackend): SetupStep {
   if (opts.noHooks) return { name: 'Install apply-leg', status: 'skipped', detail: '--no-hooks' };
@@ -812,9 +817,10 @@ function applyLegStepResult(opts: SetupOptions, backend: MemoryBackend): SetupSt
       wroteHelpers = true;
     }
 
-    // ADD-IF-MISSING, per event: FR-2's literal contract — "ours is added only if no command of
-    // the event already contains OUR entry". Never removes or reorders an existing entry (foreign
-    // OR our own) — see the WHY above for why that matters here.
+    // ADD-OR-REPLACE, per event: "ours is added when no command of the event references OUR marker
+    // yet, and REWRITTEN IN PLACE (same position) when one does but its text is stale". Never
+    // removes or reorders an existing entry (foreign OR our own) — see the WHY above for why that
+    // matters here.
     //
     // MEDIUM finding "совпадение подстроки в чужой команде" (fix round 1): the substring probe used
     // to be the bare filename (`recall-hook.cjs`), so a foreign command that merely MENTIONS the
@@ -823,20 +829,79 @@ function applyLegStepResult(opts: SetupOptions, backend: MemoryBackend): SetupSt
     // of the command we would emit, or the command containing our full relative PATH
     // (`.claude/helpers/<file>`, the same marker `applyLegStatus` structurally looks for) — a bare
     // filename mention under any other wrapper text no longer counts.
-    const entries = applyLegHookEntries();
+    // FR-2 (ADR-001 D2, apply-leg-install-root): bake THIS install's own absolute root into the
+    // two commands — the deployed helper already bakes an absolute CORE_DIST_DIR, so a relative
+    // command only masked that non-portability (issue #2, `Cannot find module` when project ===
+    // $HOME and a foreign session's CLAUDE_PROJECT_DIR pointed elsewhere, swallowed by
+    // `2>/dev/null || true`).
+    const entries = applyLegHookEntries(opts.projectRoot);
     const existingSettings = existsSync(settingsPath)
       ? (JSON.parse(readFileSync(settingsPath, 'utf-8')) as Record<string, unknown>)
       : {};
     const hooks = { ...((existingSettings['hooks'] ?? {}) as Record<string, unknown[]>) };
     let hooksAdded = false;
+    // ADD-OR-REPLACE, per event (FR-2/AC-3, apply-leg-install-root): a command that already
+    // invokes our marker path is OURS, whatever exact form it takes — a pre-feature
+    // `CLAUDE_PROJECT_DIR`-relative entry (or, in principle, a relocated install's stale absolute
+    // one) is REPLACED by the current command in place, never left stale AND never duplicated. An
+    // EXACT match of the command we would emit is a true no-op (idempotent re-setup — this is what
+    // keeps a routine re-run from ever thrashing the file, same guarantee the prior ADDITIVE-ONLY
+    // design gave when the command text truly never changed without a version bump; it can now
+    // change on install-root migration too, so replace must be part of the contract).
+    //
+    // AM-2 (fix round 1, HIGH): the prior version replaced the WHOLE matching GROUP
+    // (`hooks[event][i]`) with our bare `entry` — a group is Claude Code's matcher-plus-commands
+    // shape (`{matcher, hooks:[...]}`), so that discarded the group's `matcher` and any FOREIGN
+    // sibling command sharing the same `hooks[]` array whenever ours needed an upgrade. Fixed: only
+    // the ONE command object inside the group's own `hooks[]` array that matches OUR marker is
+    // replaced — the matcher and every other command in that array survive untouched. A single pass
+    // also now upgrades EVERY matching group, not just the first `findIndex` hit, so two stale
+    // managed entries left in two different groups (a prior bug's residue, or a hand-edited file)
+    // are both fixed in place rather than the second one being silently ignored.
     const addIfMissing = (event: string, ownCommand: string, markerPath: string, entry: unknown): void => {
       const current = Array.isArray(hooks[event]) ? hooks[event] : [];
-      const alreadyPresent = current.some((e) =>
-        commandsOf(e).some((cmd) => cmd === ownCommand || hookCommandInvokes(cmd, markerPath)),
-      );
-      if (alreadyPresent) return;
-      hooks[event] = [...current, entry];
-      hooksAdded = true;
+      let anyMatch = false;
+      let anyChanged = false;
+      const updated = current.map((e) => {
+        const cmds = commandsOf(e);
+        const matchesHere = cmds.some((cmd) => cmd === ownCommand || hookCommandInvokes(cmd, markerPath));
+        if (!matchesHere) return e;
+        anyMatch = true;
+        const group = e as { hooks?: { command?: unknown }[] };
+        if (!Array.isArray(group.hooks)) {
+          if (cmds.some((cmd) => cmd === ownCommand)) return e; // legacy flat, already exact
+          anyChanged = true;
+          return entry; // legacy flat {command:...} — nothing else to preserve
+        }
+        // Codex round-2 (AM-2 residual): a group that holds BOTH the exact own command and a stale
+        // copy (or two stale copies) used to be skipped as "already exact" — the stale twin stayed
+        // forever. Walk the group once: the first own/stale command becomes the exact form, every
+        // later own/stale copy is dropped, every foreign sibling and the group's `matcher` survive.
+        let seenOwn = false;
+        let groupChanged = false;
+        const newGroupHooks: { command?: unknown }[] = [];
+        for (const h of group.hooks) {
+          const cmd = String((h as { command?: unknown })?.command ?? '');
+          const isOurs = cmd === ownCommand || hookCommandInvokes(cmd, markerPath);
+          if (!isOurs) { newGroupHooks.push(h); continue; }
+          if (seenOwn) { groupChanged = true; continue; } // duplicate of ours — dropped
+          seenOwn = true;
+          if (cmd !== ownCommand) groupChanged = true;
+          newGroupHooks.push(cmd === ownCommand ? h : { ...h, command: ownCommand });
+        }
+        if (!groupChanged) return e;
+        anyChanged = true;
+        return { ...(e as Record<string, unknown>), hooks: newGroupHooks };
+      });
+      if (!anyMatch) {
+        hooks[event] = [...current, entry];
+        hooksAdded = true;
+        return;
+      }
+      if (anyChanged) {
+        hooks[event] = updated;
+        hooksAdded = true;
+      }
     };
     addIfMissing(
       'UserPromptSubmit',