[Bug]: Malformed events in an unregistered extension directory makes specify integration upgrade fail #5093

Bug Description

collect_extension_events reads events: straight from the raw extension.yml of any extension directory that is on disk but not in the registry (src/specify_cli/events/__init__.py:1137-1150). These values are never passed through validate_events, and _normalize_handlers only drops entries that are not mappings. A non-string matcher or a string timeout therefore reaches install_integration_events, where by_matcher.setdefault(matcher, ...) (line 1572) or cfg.get("timeout", 60) + EVENT_TIMEOUT_BUFFER (line 1576) raises TypeError, and the integration upgrade fails.

Steps to Reproduce

From a fresh clone after uv sync, save this as repro.py and run uv run python -I repro.py:

import subprocess, sys, tempfile
from pathlib import Path

specify = str(Path(sys.executable).parent / "specify")
proj = Path(tempfile.mkdtemp()) / "p"
subprocess.run([specify, "init", str(proj), "--integration", "claude",
                "--non-interactive", "--ignore-agent-tools"], capture_output=True)
ext = proj / ".specify/extensions/foo"
ext.mkdir(parents=True)

for bad in ("matcher: [Bash]", "timeout: '30'"):
    (ext / "extension.yml").write_text(
        'schema_version: "1.0"\nextension:\n  id: foo\n'
        f"events:\n  pre_tool_use:\n    command: speckit.foo.x\n    {bad}\n")
    r = subprocess.run([specify, "integration", "upgrade", "claude", "--force"],
                       cwd=proj, capture_output=True, text=True)
    print(f"--- {bad} (exit {r.returncode})")
    print("\n".join((r.stdout + r.stderr).strip().splitlines()[-3:]))

Expected Behavior

The malformed handler should be rejected or skipped with a message, and the upgrade should succeed. validate_events rejects both values ("invalid 'matcher': must be a string" and "invalid 'timeout': must be a positive integer"). The comments at src/specify_cli/events/__init__.py:918-920 and 1932-1933 say a non-string matcher is rejected at validation time so that it cannot crash by_matcher.setdefault later. The _normalize_handlers docstring (lines 877-884) says malformed entries are dropped so they never reach installation and crash.

Actual Behavior

--- matcher: [Bash] (exit 1)
Error: Failed to upgrade integration 'claude'.
Details: unhashable type: 'list'
The previous integration files may still be in place.
--- timeout: '30' (exit 1)
Error: Failed to upgrade integration 'claude'.
Details: can only concatenate str (not "int") to str
The previous integration files may still be in place.

Specify CLI Version

1.2.4.dev0 (main at 27d14e2)

AI Agent

Claude Code

Operating System

Linux 6.18 (Ubuntu container)

Python Version

Python 3.12.3

Error Logs

Error: Failed to upgrade integration 'claude'.
Details: unhashable type: 'list'

Additional Context

The _normalize_handlers docstring also says entries that lack a command are dropped, but they are not: _normalize_handlers([{"matcher": "Bash"}]) returns [{"matcher": "Bash"}]. Running the raw-YAML fallback through the same validation as registered manifests would cover all of these.

Also reproduced on macOS (Darwin 25.6, arm64) with Python 3.14.4 and uv run python -I repro.py against 27d14e2; the output matches the above apart from the Python 3.14 wording of the error message.

AI Disclosure

Found and reproduced with Claude Code (model: Claude Opus 4.8), run autonomously under human supervision. The human reporter re-ran every reproduction above before filing.