[BUG] security-guidance 2.0.6 registers five indistinguishable Bash handlers

Preflight Checklist

• [x] I searched open and closed issues and did not find this reported.
• [x] This is a single bug report.
• [x] Reproduced with the currently installed Claude Code version listed below.

What's Wrong?

The official security-guidance plugin version 2.0.6 registers five PostToolUse command-hook handlers under one matcher: "Bash" group. All five handlers use the same command:

"command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/sg-python.sh\" \"${CLAUDE_PLUGIN_ROOT}/hooks/security_reminder_hook.py\""

They differ only by their handler-level if filters:

• Bash(git commit:*)
• Bash(git push:*)
• Bash(gt create:*)
• Bash(gt modify:*)
• Bash(gt submit:*)

Claude Code's hook registration/inspection surface exposes these as five indistinguishable copies of the same Bash handler. This makes the plugin appear to have registered the same broad Bash hook five times and inflates the apparent hook count, while hiding the only useful distinction: each handler's if condition.

The source is the plugin-owned file:

~/.claude/plugins/cache/claude-plugins-official/security-guidance/2.0.6/hooks/hooks.json

The cached file matches the current claude-plugins-official marketplace copy byte-for-byte (SHA-256 A1CF22C2D2E38C709F252D654FF0666F06D0E1AB3AC92AB3A0ECF8F01EBF698D).

This report is about registration/inspection clarity and hook-count accuracy. The documented handler-level if filtering should prevent nonmatching handlers from spawning, so I am not claiming that all five subprocesses execute for every Bash call.

What Should Happen?

Either:

1. Hook inspection/registration output should include each handler's if condition, so the five registrations are distinguishable; or
2. The official plugin should consolidate the repeated handlers if the same behavior and per-command rewake messages can be preserved.

At minimum, /hooks and hook-registration diagnostics should not present conditional handlers as identical broad Bash hooks.

Steps to Reproduce

1. Install or enable security-guidance@claude-plugins-official version 2.0.6.
2. Open Claude Code and inspect configured hooks (for example with /hooks).
3. Navigate to PostToolUse / Bash.
4. Observe five registrations with the same matcher and command, without a visible distinction for their if filters.
5. Inspect the plugin-owned hooks/hooks.json and confirm that the five entries differ only by if and rewake metadata.

Claude Model

Not model-dependent.

Is this a regression?

Unknown.

Last Working Version

Unknown.

Claude Code Version

2.1.225

Platform

Anthropic API / subscription.

Operating System

Windows.

Terminal/Shell

PowerShell with Git Bash available.

Additional Information

• Plugin: security-guidance@claude-plugins-official
• Plugin version: 2.0.6
• Marketplace checkout commit observed locally: 9d7c52c7a43c0b4d89d312f7d2024f837e6cc758
• No local plugin patch was applied.