cowork-bot: scan intra-env duplicate-key collision warning

scan merges all config files in an environment directory via dict.update(),
so two files defining the same flattened key with different values silently
resolved to glob-order winner. Now emits a stderr warning naming both files
(stderr so --output json stdout stays machine-readable) and globs files in
sorted order for deterministic winner selection. +3 tests (158 pass, ruff clean).

Author: cowork-bot

src/configdrift/cli.py

@@ -36,6 +36,8 @@ def require_license(product: str) -> None:  # type: ignore[misc]
     invoke_without_command=True,
 )
 console = Console()
+# Warnings that must not pollute machine-readable (JSON) stdout go to stderr.
+_warn_console = Console(stderr=True)
 
 _require_license_strict: bool = False
 
@@ -283,21 +285,35 @@ def scan(
     files_loaded = 0
     for env_name, dir_path in dir_mapping.items():
         env_configs[env_name] = {}
+        key_sources: dict[str, str] = {}  # flattened key -> file that provided it
         p = Path(dir_path)
         if not p.is_dir():
             console.print(
                 f"[yellow]Warning: '{dir_path}' is not a directory, skipping.[/yellow]"
             )
             continue
-        # Load all supported config files in the directory and merge
+        # Load all supported config files in the directory and merge.
+        # Later files silently overwrite earlier ones via dict.update(); surface
+        # conflicting duplicate keys instead of letting glob order pick a winner.
         for ext in ("*.yaml", "*.yml", "*.json", "*.toml", "*.env"):
-            for f in p.glob(ext):
+            for f in sorted(p.glob(ext)):
                 try:
                     data = load_file(str(f))
-                    env_configs[env_name].update(data)
-                    files_loaded += 1
                 except Exception as e:
                     console.print(f"[yellow]Warning: could not load {f}: {e}[/yellow]")
+                    continue
+                for k, v in data.items():
+                    prev_file = key_sources.get(k)
+                    if prev_file is not None and env_configs[env_name].get(k) != v:
+                        _warn_console.print(
+                            f"[yellow]Warning: key '{k}' is defined with conflicting "
+                            f"values in {prev_file} and {f} (environment "
+                            f"'{env_name}'); using the value from {f} "
+                            "(alphabetical filename order).[/yellow]"
+                        )
+                    key_sources[k] = str(f)
+                env_configs[env_name].update(data)
+                files_loaded += 1
 
     # Silent-failure guard: if nothing was actually loaded, any "no drift"
     # result would be a false green. Fail loudly instead.

tests/test_cli.py

@@ -521,6 +521,60 @@ def test_scan_baseline_loaded_nothing_exits_1(self):
             assert result.exit_code == 1
             assert "loaded no config" in result.stdout
 
+class TestScanKeyCollisionWarning:
+    """Scan must warn when two files in one env define the same key differently."""
+
+    def test_scan_conflicting_duplicate_key_warns(self):
+        with tempfile.TemporaryDirectory() as tmpdir:
+            dev = Path(tmpdir) / "dev"
+            prod = Path(tmpdir) / "prod"
+            dev.mkdir()
+            prod.mkdir()
+            (dev / "a_app.yaml").write_text(yaml.dump({"host": "localhost"}))
+            (dev / "b_extra.yaml").write_text(yaml.dump({"port": 8080}))
+            (prod / "a_app.yaml").write_text(yaml.dump({"host": "one.example.com"}))
+            (prod / "b_extra.yaml").write_text(
+                yaml.dump({"host": "two.example.com", "port": 8080})
+            )
+            result = runner.invoke(app, ["scan", str(dev), str(prod)])
+            assert result.exit_code == 0, f"STDOUT: {result.stdout}"
+            # Warning goes to stderr so JSON/table stdout stays machine-readable.
+            assert "conflicting" in result.stderr
+            assert "'host'" in result.stderr
+
+    def test_scan_identical_duplicate_keys_no_warning(self):
+        """Same key+value in two files is redundant but not conflicting."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            dev = Path(tmpdir) / "dev"
+            prod = Path(tmpdir) / "prod"
+            dev.mkdir()
+            prod.mkdir()
+            (dev / "a.yaml").write_text(yaml.dump({"host": "localhost"}))
+            (dev / "b.yaml").write_text(yaml.dump({"host": "localhost"}))
+            (prod / "a.yaml").write_text(yaml.dump({"host": "prod.example.com"}))
+            (prod / "b.yaml").write_text(yaml.dump({"host": "prod.example.com"}))
+            result = runner.invoke(app, ["scan", str(dev), str(prod)])
+            assert result.exit_code == 0
+            assert "conflicting" not in result.stdout
+
+    def test_scan_collision_uses_alphabetical_order(self):
+        """The surviving value comes from the alphabetically-last file."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            dev = Path(tmpdir) / "dev"
+            prod = Path(tmpdir) / "prod"
+            dev.mkdir()
+            prod.mkdir()
+            (dev / "c.yaml").write_text(yaml.dump({"host": "localhost"}))
+            (prod / "a.yaml").write_text(yaml.dump({"host": "from-a"}))
+            (prod / "z.yaml").write_text(yaml.dump({"host": "from-z"}))
+            result = runner.invoke(
+                app, ["scan", str(dev), str(prod), "--output", "json"]
+            )
+            assert result.exit_code == 0
+            data = json.loads(result.stdout)
+            host_change = next(c for c in data["prod"]["changes"] if c["key"] == "host")
+            assert host_change["new_value"] == "from-z"
+
     def test_scan_healthy_still_works(self):
         with tempfile.TemporaryDirectory() as tmpdir:
             dev = Path(tmpdir) / "dev"