fix: unofficial PyPI warning (#1982) and legacy extension command name auto-correction (#2017)#2027
Draft
mbachorik wants to merge 7 commits intogithub:mainfrom
Draft
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR improves user safety and extension compatibility by warning against unofficial PyPI packages, adding a post-install verification step, and making legacy community extension command names auto-correct (with warnings) instead of hard-failing. It also stabilizes a previously flaky preset-catalog test by preventing unintended live community catalog lookups.
Changes:
- Add prominent documentation warnings that Spec Kit’s official packages are only distributed from
github/spec-kit, plus a recommendedspecify versionverification step. - In extension manifest validation, auto-correct common legacy 2-part command names to the required 3-part
speckit.{extension}.{command}form and surface compatibility warnings on install. - Make
TestPresetCatalog::test_search_with_cached_datadeterministic by restricting catalogs to default-only via a project-levelpreset-catalogs.yml.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
README.md |
Adds an “official source only” warning and a specify version verification step after install instructions. |
docs/installation.md |
Adds the same warning and a verification section recommending specify version. |
src/specify_cli/extensions.py |
Adds command-name regex constant, manifest warnings, and auto-correction logic for legacy command names. |
src/specify_cli/__init__.py |
Prints manifest compatibility warnings after successful specify extension add. |
tests/test_extensions.py |
Adds tests for both auto-correction paths and the no-warning valid path; updates an existing docstring. |
tests/test_presets.py |
Writes .specify/preset-catalogs.yml in a test to avoid community-catalog network flakiness. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
mbachorik
force-pushed
the
fix/pypi-warning-and-legacy-extension-names
branch
from
56c6b66 to
44d1996
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
mnriem
requested changes
Mar 31, 2026
Collaborator
mnriem
left a comment
mnriem
left a comment
There was a problem hiding this comment.
Please address Copilot feedback. If not applicable, please explain why
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
mnriem
requested changes
Mar 31, 2026
Collaborator
mnriem
left a comment
mnriem
left a comment
There was a problem hiding this comment.
Please address Copilot feedback
Contributor
Author
|
@mnriem I've bundled this with the fix for 2/3dot alias notation. Will wait for feedback from the reporter (or we decide tonight and agree on fix). Will address all copilot feedback as usual .. (switching it to draft so it does not spam you) |
…ication (github#1982) Clarify that only packages from github/spec-kit are official, and add `specify version` as a post-install verification step to help users catch accidental installation of an unrelated package with the same name. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…iling (github#2017) Community extensions that predate the strict naming requirement use two common legacy formats ('speckit.command' and 'extension.command'). Instead of rejecting them outright, auto-correct to the required 'speckit.{extension}.{command}' pattern and emit a compatibility warning so authors know they need to update their manifest. Names that cannot be safely corrected (e.g. single-segment names) still raise ValidationError. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… network calls test_search_with_cached_data asserted exactly 2 results but was getting 4 because _get_merged_packs() queries the full built-in catalog stack (default + community). The community catalog had no local cache and hit the network, returning real presets. Writing a project-level preset-catalogs.yml that pins the test to the default URL only makes the count assertions deterministic. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The upstream github#1994 added alias validation in _collect_manifest_command_names, which also rejected legacy 2-part alias names (e.g. 'speckit.verify'). Extend the same auto-correction logic from _validate() to cover aliases, so both 'speckit.command' and 'extension.command' alias formats are corrected to 'speckit.{ext_id}.{command}' with a compatibility warning instead of hard-failing. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- _try_correct_command_name: only correct 'X.Y' to 'speckit.ext_id.Y'
when X matches ext_id, preventing misleading warnings followed by
install failure due to namespace mismatch
- _validate: add aliases type/string guards matching _collect_manifest
_command_names defensive checks
- _validate: track command renames and rewrite any hook.*.command
references that pointed at a renamed command, emitting a warning
- test: fix test_command_name_autocorrect_no_speckit_prefix to use
ext_id matching the legacy namespace; add namespace-mismatch test
- test: replace redundant preset-catalogs.yml isolation with
monkeypatch.delenv("SPECKIT_PRESET_CATALOG_URL") so the env var
cannot bypass catalog restriction in CI environments
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…t validation (github#2017) - Remove accidental hook reference from alias auto-correction test (fixture has after_tasks hook whose command matches the alias being renamed, causing a spurious second warning) - Update collision test fixture to use a primary command collision instead of an alias-based one (alias namespace enforcement now makes cross-extension alias collisions impossible by design) - Update test_command_with_aliases and test_copilot_aliases_get_companion_prompts to use the new 2-part alias format (ext-id.command) rather than the legacy 3-part speckit.ext.command form - Normalize aliases: null to aliases: [] in _validate() so downstream cmd_info.get('aliases', []) cannot return None when the YAML key exists but is explicitly null Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
mbachorik
force-pushed
the
fix/pypi-warning-and-legacy-extension-names
branch
from
3fed7f7 to
caee3e0
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…orrection to ext_id (github#2017) - Raise ValidationError with a clear message if the manifest 'hooks' value is not a mapping (previously would AttributeError on .items()) - Restrict _try_correct_alias_name 3-part correction (speckit.X.Y → X.Y) to only apply when X == ext_id; when X differs the alias is squatting a foreign namespace and should be rejected, not silently rewritten Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
README.mdanddocs/installation.mdthat the only official packages are published fromgithub/spec-kit; any same-named PyPI packages are unaffiliated. Also addsspecify versionas a recommended post-install verification step.docguard.guardorspeckit.verify), auto-correct it to the requiredspeckit.{extension}.{command}pattern and emit a compatibility warning so authors know to update their manifest. Names that cannot be safely corrected still raiseValidationError.TestPresetCatalog::test_search_with_cached_data) that was making live network calls to the community catalog, causing non-deterministic result counts.Changes
docs/installation.md/README.mdspecify versionverification step added after install instructionssrc/specify_cli/extensions.pyExtensionManifest.__init__: initialisesself.warnings: List[str]ExtensionManifest._validate(): on invalid command name, attempts auto-correction before raisingExtensionManifest._try_correct_command_name(): new static method handlingX.Y → speckit.X.Yandspeckit.Y → speckit.{ext_id}.Y_COMMAND_NAME_RE: compiled class-level regex constant (replaces two rawre.matchcalls)src/specify_cli/__init__.pyextension_add: prints compatibility warnings frommanifest.warningsafter successful installtests/test_extensions.pytests/test_presets.pytest_search_with_cached_data: writes a project-levelpreset-catalogs.ymlto restrict the test to the default catalog only, preventing live community catalog network callsTest plan
specify extension add --from <legacy-zip>installs with a compatibility warning instead of failingspecify extension add --from <valid-zip>installs silently (no warning)invalid-name) still raiseValidationError🤖 Generated with Claude Code