github/github-spec-kit
1
0
Fork 0
mirror of https://github.com/github/spec-kit.git synced 2026-07-03 12:28:06 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: add specify bundle command (#3070)

Browse Source 
* docs: dogfood Spec Kit — bundler SDD artifacts + constitution

Scaffold Spec Kit (--integration copilot) and run the full SDD workflow
against the `specify bundle` subcommand feature:

- spec.md (4 user stories, 31 FRs, 8 success criteria) + clarifications
- plan.md, research.md, data-model.md, contracts/, quickstart.md
- tasks.md (43 dependency-ordered tasks, organized by user story)
- Spec Kit Constitution v1.0.0 (code quality, testing, UX, performance,
  dependency/security principles) derived from deep codebase analysis
- plan Constitution Check + tasks grounded against the ratified principles

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat(bundler): add `specify bundle` subcommand for role-based setups

Implements the Spec Kit Bundler as a `specify bundle ...` subcommand group
that calls existing primitive machinery in-process with zero new dependencies,
per the v1.0.0 constitution (Principles I-V).

Adds the `specify_cli.bundler` package (models, services, lib helpers) and the
`commands/bundle` Typer group wiring search, info, list, install, update,
remove, validate, build, init, and catalog list/add/remove (with --json and
--offline). Includes manifest/catalog schemas, version + integration-clash
gating, discovery-only refusal, idempotent install with atomic rollback,
non-collateral removal, and offline-first catalog resolution.

Ships an 82-test suite (contract/unit/integration), four sample role bundles
(product-manager, business-analyst, security-researcher, developer), README
"Bundles" docs, and an AGENTS.md pitfall on the test-venv gotcha. Marks
tasks T001-T043 complete and records follow-ups T044 (live in-process
primitive dispatch) and T045 (install from a local artifact path).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs(contributing): document running the full test suite via project .venv

Add a "Running the full test suite" subsection under Automated checks covering
`uv pip install -e ".[test]"` + `.venv/bin/python -m pytest`, with the
shared/global editable-install contamination caveat that mirrors the AGENTS.md
pitfall.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat(bundler): wire real in-process primitive install + local-artifact install

Closes the two follow-ups left after the initial bundler landing.

T044 — DefaultPrimitiveInstaller now performs real installs through existing
machinery instead of raising "use the primitive command" errors:
- presets/extensions install via their reusable managers
  (install_from_directory / install_from_zip); bundled assets install fully
  offline, catalog assets are fetched only when the network is allowed.
- workflows/steps delegate to the existing `workflow add` / `workflow step add`
  command callables in-process (project root as cwd), avoiding any duplicated
  download/validation logic (Principle I).
- `--offline` is threaded through DefaultPrimitiveInstaller(allow_network=…) so
  network-only kinds refuse with an actionable message rather than silently
  reaching out.

T045 — `specify bundle install` now accepts a local path (a built .zip
artifact, a bundle directory, or a bundle.yml) and installs directly without
consulting the catalog stack; bundle-ids still resolve via the stack.

Adds 13 tests (routing, offline gating, local-source resolution, and an
end-to-end offline build → install → list → remove of the bundled
agent-context extension). Bundler suite: 95 passing; ruff clean. Marks T044
and T045 complete in tasks.md.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs(bundler): append Phase 8 convergence tasks from converge assessment

Ran the converge command: assessed the codebase against spec.md, plan.md,
tasks.md, and the v1.0.0 constitution. Appended 7 traceable gap-closure tasks
(T046–T052) as a new "Phase 8: Convergence" section. Append-only — no existing
tasks were modified and no application code was changed.

Findings: 1 CRITICAL (Constitution III — bundle group undocumented under
docs/reference/), 3 HIGH (FR-005/SC-007 validate references; FR-009/SC-002 info
expansion; FR-012 install-time init), 3 MEDIUM (FR-013 integration precedence;
FR-020 surface overlaps; FR-028 update refresh).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Implement Phase 8 convergence tasks (T046–T052)

Close the gaps the converge command found between the bundler spec/plan/
constitution and the code:

- T046: add docs/reference/bundles.md documenting the full `specify bundle`
  command group; link it from docs/reference/overview.md (Constitution III).
- T047: wire a reference checker into `bundle validate` (services/references.py);
  online runs fail and name unresolved component references, offline runs warn.
- T048: expand `bundle info` to enumerate the full component set (versions,
  preset priority/strategy) plus the bundle integration — info == install.
- T049/T050: `bundle install`/`bundle init` now scaffold an uninitialized
  project via the existing `specify init` machinery, choosing the integration by
  precedence (override → bundle-declared → Copilot + OS default script type).
- T051: surface foreseeable component overlaps during info and install.
- T052: `bundle update` refreshes already-installed components via a new
  refresh path in install_bundle, preserving primitive-level overrides.

Adds unit/contract/integration coverage (107 tests pass).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* converge: append Phase 9 (T053) — surface bundle trust indicator

Re-run of converge after Phase 8. The seven Phase 8 tasks are verified closed.
One residual partial gap remains: the `verified`/trust indicator (FR-010,
FR-027) is exposed only in `bundle info --json`, absent from `bundle search`
(the primary discovery surface) and `bundle info` text. Appended as a single
new task for implement to complete. Append-only; no code changed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Implement T053 — surface bundle trust indicator in discovery

`bundle search` (text + JSON) and `bundle info` (text + JSON) now expose each
catalog entry's verification/trust level (verified vs community), so users can
judge a bundle's trust before installing, per FR-010 / FR-027. Previously
`verified` was only present in `bundle info --json`.

Adds contract coverage; 108 tests pass.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: dogfood Spec Kit — bundler SDD artifacts + constitution

Scaffold Spec Kit (--integration copilot) and run the full SDD workflow
against the `specify bundle` subcommand feature:

- spec.md (4 user stories, 31 FRs, 8 success criteria) + clarifications
- plan.md, research.md, data-model.md, contracts/, quickstart.md
- tasks.md (43 dependency-ordered tasks, organized by user story)
- Spec Kit Constitution v1.0.0 (code quality, testing, UX, performance,
  dependency/security principles) derived from deep codebase analysis
- plan Constitution Check + tasks grounded against the ratified principles

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat(bundler): add `specify bundle` subcommand for role-based setups

Implements the Spec Kit Bundler as a `specify bundle ...` subcommand group
that calls existing primitive machinery in-process with zero new dependencies,
per the v1.0.0 constitution (Principles I-V).

Adds the `specify_cli.bundler` package (models, services, lib helpers) and the
`commands/bundle` Typer group wiring search, info, list, install, update,
remove, validate, build, init, and catalog list/add/remove (with --json and
--offline). Includes manifest/catalog schemas, version + integration-clash
gating, discovery-only refusal, idempotent install with atomic rollback,
non-collateral removal, and offline-first catalog resolution.

Ships an 82-test suite (contract/unit/integration), four sample role bundles
(product-manager, business-analyst, security-researcher, developer), README
"Bundles" docs, and an AGENTS.md pitfall on the test-venv gotcha. Marks
tasks T001-T043 complete and records follow-ups T044 (live in-process
primitive dispatch) and T045 (install from a local artifact path).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs(contributing): document running the full test suite via project .venv

Add a "Running the full test suite" subsection under Automated checks covering
`uv pip install -e ".[test]"` + `.venv/bin/python -m pytest`, with the
shared/global editable-install contamination caveat that mirrors the AGENTS.md
pitfall.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat(bundler): wire real in-process primitive install + local-artifact install

Closes the two follow-ups left after the initial bundler landing.

T044 — DefaultPrimitiveInstaller now performs real installs through existing
machinery instead of raising "use the primitive command" errors:
- presets/extensions install via their reusable managers
  (install_from_directory / install_from_zip); bundled assets install fully
  offline, catalog assets are fetched only when the network is allowed.
- workflows/steps delegate to the existing `workflow add` / `workflow step add`
  command callables in-process (project root as cwd), avoiding any duplicated
  download/validation logic (Principle I).
- `--offline` is threaded through DefaultPrimitiveInstaller(allow_network=…) so
  network-only kinds refuse with an actionable message rather than silently
  reaching out.

T045 — `specify bundle install` now accepts a local path (a built .zip
artifact, a bundle directory, or a bundle.yml) and installs directly without
consulting the catalog stack; bundle-ids still resolve via the stack.

Adds 13 tests (routing, offline gating, local-source resolution, and an
end-to-end offline build → install → list → remove of the bundled
agent-context extension). Bundler suite: 95 passing; ruff clean. Marks T044
and T045 complete in tasks.md.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs(bundler): append Phase 8 convergence tasks from converge assessment

Ran the converge command: assessed the codebase against spec.md, plan.md,
tasks.md, and the v1.0.0 constitution. Appended 7 traceable gap-closure tasks
(T046–T052) as a new "Phase 8: Convergence" section. Append-only — no existing
tasks were modified and no application code was changed.

Findings: 1 CRITICAL (Constitution III — bundle group undocumented under
docs/reference/), 3 HIGH (FR-005/SC-007 validate references; FR-009/SC-002 info
expansion; FR-012 install-time init), 3 MEDIUM (FR-013 integration precedence;
FR-020 surface overlaps; FR-028 update refresh).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Implement Phase 8 convergence tasks (T046–T052)

Close the gaps the converge command found between the bundler spec/plan/
constitution and the code:

- T046: add docs/reference/bundles.md documenting the full `specify bundle`
  command group; link it from docs/reference/overview.md (Constitution III).
- T047: wire a reference checker into `bundle validate` (services/references.py);
  online runs fail and name unresolved component references, offline runs warn.
- T048: expand `bundle info` to enumerate the full component set (versions,
  preset priority/strategy) plus the bundle integration — info == install.
- T049/T050: `bundle install`/`bundle init` now scaffold an uninitialized
  project via the existing `specify init` machinery, choosing the integration by
  precedence (override → bundle-declared → Copilot + OS default script type).
- T051: surface foreseeable component overlaps during info and install.
- T052: `bundle update` refreshes already-installed components via a new
  refresh path in install_bundle, preserving primitive-level overrides.

Adds unit/contract/integration coverage (107 tests pass).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* converge: append Phase 9 (T053) — surface bundle trust indicator

Re-run of converge after Phase 8. The seven Phase 8 tasks are verified closed.
One residual partial gap remains: the `verified`/trust indicator (FR-010,
FR-027) is exposed only in `bundle info --json`, absent from `bundle search`
(the primary discovery surface) and `bundle info` text. Appended as a single
new task for implement to complete. Append-only; no code changed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Implement T053 — surface bundle trust indicator in discovery

`bundle search` (text + JSON) and `bundle info` (text + JSON) now expose each
catalog entry's verification/trust level (verified vs community), so users can
judge a bundle's trust before installing, per FR-010 / FR-027. Previously
`verified` was only present in `bundle info --json`.

Adds contract coverage; 108 tests pass.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): address PR review — annotations, Windows paths, HTTPS, errors, reproducible builds

Resolves automated review feedback on github/spec-kit#3070:

- validator: drop redundant string-quoting on ReferenceChecker's
  `str | None` return so the annotation evaluates as a real union under
  `from __future__ import annotations`.
- adapters: normalize Windows drive-letter paths (e.g. C:\...) to the
  local-file branch so offline file catalogs resolve on Windows.
- adapters: enforce HTTPS (HTTP only for localhost) and require a host on
  remote catalog URLs before any network call, mirroring
  specify_cli.catalogs URL validation (MITM/downgrade protection).
- adapters: pass `origin` to loads_json for local files and HTTP payloads
  so JSON parse errors name the real source instead of <string>.
- manifest: parse component `priority` defensively, raising an actionable
  BundlerError on non-integer values instead of a raw ValueError.
- packager: write zip members with a fixed timestamp + permissions so
  identical inputs yield byte-for-byte identical artifacts (genuinely
  reproducible builds), and strengthen the determinism test accordingly.

Adds regression tests for priority validation, plain-HTTP/host rejection,
and byte-level artifact reproducibility (111 bundler tests pass; ruff clean).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): address PR review round 2 — nested output dir + file:// URLs

- packager: when --output points inside the bundle directory, exclude the
  whole output subtree from collection so previously-built artifacts are
  never re-packaged (prevents broken reproducibility and unbounded growth).
- adapters: resolve file:// catalog URLs via url2pathname and preserve
  netloc, so Windows file URLs (file:///C:/...) and UNC shares
  (file://server/share) resolve correctly instead of dropping the host or
  producing /C:/x.

Adds regression tests for nested-output exclusion and file:// resolution
(113 bundler tests pass; ruff clean).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): address PR review round 3 — discovery UX + hardening

- bundle search/info: fall back to the built-in/user catalog stack instead of
  requiring a Spec Kit project, so discovery works in a fresh directory (and
  the README/quickstart examples now match actual behavior). install still
  auto-initializes a project as before.
- packager: traverse with os.walk(followlinks=False) and prune symlinked
  directories before descending, so a symlink-to-dir can no longer pull in
  out-of-tree files (which previously turned "skip symlinks" into a hard
  ensure_within() failure and did extra filesystem work).
- records: parse contributed-component priority defensively, raising an
  actionable BundlerError on a corrupt records file instead of leaking a raw
  ValueError/traceback.
- installer: give install_bundle's manifest parameter an explicit
  BundleManifest | None type for a clearer, safer service API.

Adds regression tests for project-less search/info, symlinked-dir pruning,
and corrupt-priority records (117 bundler tests pass; ruff clean).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): address PR review round 4 + markdownlint exclusions

Review fixes:
- bundle info: expand the manifest regardless of install policy so
  discovery-only bundles remain inspectable (only install is refused).
- _download_manifest: handle local .zip download_url by extracting bundle.yml
  (via _local_manifest_source), and add a real remote HTTPS fetch path using
  the shared authenticated, redirect-validated open_url client (HTTPS enforced
  on the initial URL and every redirect; offline still refuses).
- _run_init: thread the --offline flag through to the init callback so
  `bundle install/init --offline` never performs network init.
- conflict.ConflictReport: use field(default_factory=list) and drop the
  None + __post_init__ workaround.
- CatalogSource.from_dict: parse priority defensively, raising an actionable
  BundlerError naming the source + offending value instead of a raw ValueError.

markdownlint:
- Exclude .specify/, .github/, and specs/ (and their subdirectories) from
  markdownlint so the in-flight dogfooding scaffolding doesn't trip the linter.

Adds regression tests for discovery-only info, local-zip download_url, and
non-integer catalog priority (120 bundler tests pass; ruff clean; the PR's own
markdown lints clean).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): address PR review round 5 + ignore generated files in whitespace check

Review fixes:
- packager: exclude any prior build artifact for this bundle (matching
  <id>-*.zip), not just the current output path, so older artifacts next to
  bundle.yml are never re-packaged.
- docs(bundles): correct the note — `search` and `info` work without a project
  (they fall back to the built-in/user catalog stack); only list/update/remove/
  catalog require an initialized project.

CI / generated files:
- .gitattributes: mark the generated dogfooding scaffolding (.specify/**, the
  speckit .github agent/prompt files, copilot-instructions.md, specs/**) with
  -whitespace so `git diff --check` (the Lint workflow's whitespace gate) stops
  flagging emitted trailing whitespace. These files are produced by
  `specify init` and are scrubbed before merge.

Adds a regression test for prior-artifact exclusion (121 bundler tests pass;
ruff clean).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): collision-resistant catalog ids, canonical local paths, explicit uninstalled result

Addresses review round 6 (PR #3070):
- catalog_config._derive_id now combines host label with the URL path stem so
  multiple catalogs from the same host get distinct, stable default ids.
- add_source canonicalizes local file paths to absolute before persisting, so
  project config no longer depends on the caller's cwd.
- InstallResult gains a dedicated `uninstalled` list; remove_bundle no longer
  overloads `installed` for removals, and the CLI prints from `uninstalled`.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): confine config writes, guard indeterminate integration, fix validate docs

Addresses review round 7 (PR #3070):
- save_records and catalog_config._write now pass within=project_root to
  dump_json/dump_yaml, refusing symlinked .specify paths that escape the
  project (defense-in-depth, matching the rest of the codebase).
- resolve_install_plan now fails when a bundle pins an integration but the
  project's active integration cannot be determined and no explicit
  --integration override was given, instead of silently adopting the bundle's
  required integration (FR-019 guard). CLI passes integration_explicit.
- docs/reference/bundles.md: corrected the validate semantics to describe the
  actual best-effort online behavior (unreachable catalogs warn, not fail).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): Windows path handling + review round 8 hardening

Fix Windows CI failures:
- is_safe_relpath now rejects POSIX-absolute (/abs) and Windows drive-absolute
  (C:\x, UNC) paths on every OS, instead of passing them through on Windows
  where os.path.isabs('/abs') is False and Path('/abs').parts yields '\\'.
- _download_manifest treats a Windows drive-letter download_url (C:\bundle.yml,
  which urlparse reads as scheme 'c') as a local file, fixing the empty
  component set in `bundle info` on Windows.

Address review round 8 (PR #3070):
- Bundled workflows now install under --offline (locate via
  _locate_bundled_workflow) instead of being refused unconditionally.
- bundle update preserves the original installed_at timestamp on refresh
  (import find_record; reuse the existing record's timestamp).
- _derive_id lowercases the host label so 'Example.com' and 'example.com'
  produce the same deterministic id.
- CatalogEntry.from_dict validates 'tags' is a list and 'verified' is a real
  boolean, raising BundlerError on invalid untrusted shapes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): normalize SemVer prerelease spellings before version parsing

Addresses review round 9 (PR #3070): parse_version and is_semver now apply the
same prerelease normalization (mirroring specify_cli._version._normalize_tag)
so SemVer spellings like 1.2.3-rc1 / 1.2.3-alpha1 validate and compare
consistently across is_semver, parse_version, and satisfies. Leading 'v' is
also stripped. Keeps the manifest validator and constraint checks in agreement.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): no collateral removal + enforce manifest-pinned versions

Addresses review round 10 (PR #3070):
- install_bundle records only the components this bundle actually contributed:
  freshly-installed components, plus pre-existing ones already owned by this
  bundle (refresh) or a sibling bundle (shared/refcounted). A component that is
  installed on disk but tracked by no bundle was installed independently and is
  no longer attributed, so `bundle remove` won't uninstall it (FR-022).
- preset/extension/workflow install paths now verify the active catalog's
  advertised version matches the manifest-pinned component.version before
  downloading/installing, raising BundlerError on mismatch so bundles stay
  reproducible. When a catalog advertises no version the pin can't be enforced
  and installation proceeds.

Added regression tests: independent pre-existing component survives removal;
version-mismatch refusal (helper + workflow path).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat(scripts): add SPECIFY_INIT_DIR to target a member project from the repo root (#2892)

* feat(scripts): add SPECIFY_INIT_DIR to target a member project from the repo root

Resolve an explicit SPECIFY_INIT_DIR project override once in the core
get_repo_root / Get-RepoRoot, so a non-interactive / CI caller can target a
member project (the directory containing .specify/) from a monorepo root
without cd. Strict by design: the path must exist and contain .specify/,
otherwise it hard-errors with no silent fallback.

- Single resolver in core; the git feature-branch script inherits it by
  sourcing core, with no per-extension copies.
- PS resolver verifies the resolved path is a directory (Resolve-Path also
  succeeds for files) so a file value errors as "not an existing directory".
- get_feature_paths splits decl/assignment so a SPECIFY_INIT_DIR failure
  propagates instead of being masked by `local`.
- create-new-feature-branch: when core is absent (only git-common loaded) and
  SPECIFY_INIT_DIR is set, hard-error rather than silently using the git root.
- Document SPECIFY_INIT_DIR and SPECIFY_FEATURE_DIRECTORY in the core reference.
- Tests for valid/relative/trailing-slash/file/missing/no-.specify targets,
  feature-axis composition, the no-core guard, and a PowerShell mirror.

* fix: guard SPECIFY_INIT_DIR with stale core scripts

* docs: clarify SPECIFY_FEATURE_DIRECTORY precedence wording

* fix: normalize trailing slash in PowerShell SPECIFY_INIT_DIR resolver

Resolve-Path preserves a trailing separator from its input, so a
SPECIFY_INIT_DIR ending in a slash returned a root that didn't match the
bash resolver (whose `cd && pwd` strips it). That broke
test_ps_trailing_slash_tolerated on the CI runners, which do have pwsh.
Trim it with TrimEndingDirectorySeparator (no-op on a bare root or a path
with no trailing separator).

Also fix the misleading test comment: the PowerShell mirror runs on the
CI ubuntu/windows runners (they ship pwsh), it is not skipped there.

* test: normalize bash path expectations on Windows

* docs: clarify SPECIFY_INIT_DIR root helpers

* chore: sync dogfooded .specify core scripts with SPECIFY_INIT_DIR

Mirror the SPECIFY_INIT_DIR resolver (resolve_specify_init_dir in
common.sh) into the committed dogfooding .specify/scripts/bash copies so
the git extension's create-new-feature-branch.sh finds an up-to-date
common.sh instead of failing with "requires updated Spec Kit core
scripts". Fixes the test_init_dir.py CI failures.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): harden remote catalog fetch and config parsing

- adapters: route catalog HTTP fetches through the shared authenticated
  client (authentication.http.open_url) so auth.json tokens apply and the
  Authorization header is stripped on cross-host/downgrade redirects.
  Reject any redirect that leaves HTTPS via a redirect_validator and
  re-validate the final URL after redirects, closing the urlopen
  auto-redirect MITM/downgrade gap.
- catalog_config._read: raise an actionable BundlerError when the config
  top level is not a mapping, 'catalogs' is not a list, or an entry is
  not a mapping, instead of letting list(<str>) produce a downstream
  AttributeError.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): tighten record read confinement, policy gate, and precedence

Addresses review 4534504799:

- records.load_records: confine the read via ensure_within(project_root,
  ...) so a symlinked/traversal-escaping .specify cannot read arbitrary
  files outside the project (matches the write path's within= guard).
- catalog_config._slug: lowercase so derived catalog ids are
  deterministic across platforms and case-variant duplicates can't slip
  past the case-sensitive dup check.
- installer.install_bundle: reword the docstring's misleading "atomic on
  failure" claim to describe the real scoped guarantee (record written
  only on full success; rollback limited to newly-installed components).
- bundle update: enforce the source install_policy like install, refusing
  to update from a discovery-only source (FR-025).
- catalog source precedence: the CLI now passes ~/.specify as the user
  config dir so project > user > built-in precedence is actually
  reachable (previously the user scope was silently ignored).
- .gitattributes: scope the specs whitespace exemption to the generated
  dogfooding feature dir (specs/001-spec-kit-bundler/**) instead of all
  of specs/**.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): no collateral refresh, catalog id integrity, loud info

Addresses review 4534571362:

- installer: in refresh mode (bundle update) only re-apply already-
  installed components that this bundle (or a sibling) owns. Components
  installed independently and tracked by no bundle are now skipped, never
  refreshed, so update cannot make collateral changes (FR-022).
- catalog.load_catalog_payload: validate each entry's own id is present
  and matches its enclosing bundles key, rejecting catalogs that would
  otherwise list a spoofed or unresolvable id.
- bundle info: stop swallowing manifest download failures. If the
  manifest can't be resolved (e.g. --offline against an https download_url
  or a download failure), surface the error and exit non-zero instead of
  silently degrading to catalog `provides` counts, preserving the "info
  == what install applies" guarantee.

Added regressions: refresh leaves independently-installed components
untouched, catalog id key/field mismatch + missing id rejection, and
info exits non-zero when the manifest is unresolvable offline.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): confine catalog-config and integration-marker reads

Addresses review 4534716790: two more state reads bypassed the
symlink/path-escape confinement that records and the write paths already
enforce.

- catalog_config._read: validate the config path with
  ensure_within(project_root, ...) before exists()/read, so a symlinked
  .specify resolving outside project_root is rejected instead of read.
- lib.project.active_integration: confine the .specify/integration.json
  read the same way; an out-of-tree escape is treated as "not
  determinable" (returns None) rather than followed.

Added regressions covering both via a symlinked .specify pointing
outside the project root.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): validate manifest tags, disambiguate derived ids by full host

Addresses review 4534768419:

- manifest.from_dict: reject a non-list `tags` (e.g. a bare string) instead
  of splitting it character-by-character, matching the catalog parser and
  the schema contract (tags = list of strings).
- catalog_config._derive_id: derive ids from the full host (TLD included)
  so example.com and example.net no longer collide on the same id. Updated
  the affected id assertions.
- CHANGELOG: call out the new `specify bundle` command group in the
  unreleased section (the PR's headline user-facing feature).
- .gitattributes: clarify the specs whitespace exemption — the dogfooding
  feature dir is scrubbed before merge (not retained), so it doesn't weaken
  checks for kept docs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore(gitattributes): retain whitespace exemption for constitution.md

The project constitution (.specify/memory/constitution.md) is the one
dogfooding artifact carried forward past the pre-merge scrub. Give it its
own standalone whitespace exemption so it survives removal of the broader
.specify/** generated-scaffolding exemption.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): accurate uninstall count, confine catalog read, safe bundle id

Addresses review 4534812056:

- installer.remove_bundle: only count a component as uninstalled when
  installer.remove() actually ran; components already absent on disk are
  reported as skipped, keeping the uninstalled count accurate.
- catalog.load_source_stack: confine the project-scoped .specify config read
  with ensure_within, so a symlinked .specify/ resolving outside the project
  root is refused (consistent with the bundler's other guarded reads).
- manifest: enforce a filesystem-safe slug for bundle.id in structural
  validation; packager.build_bundle adds an ensure_within defense-in-depth
  check so a crafted id can never push the artifact outside the output dir.

Also reverts the CHANGELOG entry (the changelog is updated separately).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): validate requires/provides shapes in manifest and catalog

Addresses review 4534855443:

- manifest: validate requires.tools and requires.mcp as list-of-strings via
  a shared _parse_str_list helper (also reused for tags), so a bare string
  like `tools: docker` is rejected with an actionable BundlerError instead of
  being split character-by-character.
- catalog.CatalogEntry.from_dict: validate that `requires` and `provides` are
  mappings before accessing them, so an untrusted catalog payload with
  `requires: "..."` raises a named BundlerError rather than escaping as a raw
  AttributeError traceback.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): require README.md when building a bundle artifact

Addresses review 4534938014: build_bundle now fails early with an
actionable error when README.md is missing, matching the documented
artifact contract (manifest + README) instead of silently producing a
bundle with no human-facing description.

Also reverts CHANGELOG.md to the upstream/main copy.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): validate record shapes; drop stale install --refresh claim

Addresses review 4534969692:

- records.InstalledBundleRecord.from_dict: hard-error when
  contributed_components is not a list, instead of iterating a corrupt
  bare string character-by-character.
- records.load_records: validate the top-level 'bundles' field is a list and
  fail with a clear BundlerError when a corrupt file makes it a mapping/string.
- PR description: remove the inaccurate "supports --refresh" note from
  `bundle install` (refresh is the `bundle update` path); docs already omit it.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): refuse symlinked .specify, reject bad url schemes, IPv6 ids

Addresses review 4534997724:

- lib.project.find_project_root: a symlinked .specify is no longer accepted
  as a project root (is_dir() follows symlinks), matching the confinement the
  rest of the CLI applies and avoiding confusing downstream failures.
- catalog_config.add_source: reject unsupported url schemes (ssh://, ftp://,
  ...) up front instead of silently treating them as local paths; local paths
  containing ':' but not '://' are still allowed.
- catalog_config._derive_id: derive the host via urlparse().hostname so IPv6
  literals, credentials, and ports no longer corrupt the derived id.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): strict semver, narrow artifact skip, preserve priority 0

Addresses review 4535084048:

- versioning.is_semver: enforce a full MAJOR.MINOR.PATCH SemVer (with optional
  pre-release/build) via a dedicated regex, instead of accepting any
  packaging.version.Version-parseable string (e.g. "1", "1.0"). This makes
  BundleManifest.structural_errors() reject non-semver versions.
- packager: narrow the prior-artifact skip pattern to semver-named zips
  (<id>-<x.y.z>.zip) so legitimate assets like <id>-assets.zip are still
  packaged.
- primitives (preset + extension install): use an explicit `is None` check so
  an intentional priority of 0 is preserved instead of being replaced by the
  default.

Adds regressions: non-semver rejection ("1"/"1.0"/"1.2.3.4"), asset-not-
excluded vs semver-artifact-excluded, and priority-0 pass-through.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): artifact regex for prerelease+build; clarify integration/priority docs

Addresses review 4535132279:

- packager: the prior-artifact skip regex now matches semver names carrying
  both a prerelease and build-metadata segment (e.g. 1.0.0-rc1+build5), so such
  an existing artifact is excluded rather than re-packaged — keeping builds
  bounded/deterministic, consistent with is_semver().
- docs/reference/bundles.md: correct the install integration wording.
  --integration selects the integration when initializing a new project and
  confirms the target when a pinned bundle's active integration can't be
  determined; it does NOT override a bundle that targets a specific integration
  (a mismatch aborts with no changes).
- examples/security-researcher README: reword the preset priority note in terms
  of the numeric comparison (ascending priority order) to avoid inverting the
  meaning.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): --integration can't bypass clash guard; honest rollback docs

Addresses review 4535159341:

- bundle install: for an already-initialized project, the project's recorded
  active integration is now authoritative. --integration no longer overrides it
  (which let a copilot project install a claude-pinned bundle via
  `--integration claude`, bypassing the FR-019 clash guard). The override still
  selects the integration at init time and confirms the target only when the
  active integration cannot be determined.
- docs/reference/bundles.md: reword the install guarantee to match the
  implementation — no provenance record is written unless the install fully
  succeeds, and rollback of this run's components is best-effort (removal errors
  are swallowed, so partial on-disk state may remain). Dropped the inaccurate
  "atomic / rolls back everything" claim.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): validate component kind/id when loading records

Addresses review 4535194606: _component_from_dict now rejects a contributed
component whose 'kind' is not a supported component kind or whose 'id' is
empty, raising a BundlerError that explicitly flags the records file as
corrupt. Previously such a record loaded successfully and only failed later
(e.g. in primitive_manager() during bundle remove/update) with a less
actionable error.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): address review 4535234003 (7 findings)

- versioning: tolerate an uppercase `V` prefix in `_normalize_semver` and
  `is_semver`, mirroring specify_cli._version tag normalization (V -> v) so
  `V1.2.3` parses and validates consistently.
- validator: import BundlerError and narrow the speckit_version constraint
  except clause to `BundlerError` only, so programming errors are no longer
  masked behind an "invalid constraint" message.
- bundle update: accept `--integration` and thread it through
  resolve_install_plan the same way `bundle install` does (override used only
  when the active integration can't be auto-detected), so integration-pinned
  bundles can be updated where `.specify/integration.json` is missing/unreadable.
- bundle validate: fold reference warnings into `report.warnings` so the
  ValidationReport is the single warning channel at the CLI layer.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* test(bundler): make update --integration help assertion ANSI-safe

Rich can split the "--integration" option label with ANSI escape codes
between the two leading dashes, so the literal substring check failed under
CI's terminal settings. Match the un-split option word instead, mirroring how
test_bundle_help_lists_all_commands checks bare command names.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): preserve exec bits in artifacts; document install-time pins

Addresses review 4535280786:

- packager.build_bundle: no longer forces every ZIP member to 0644, which
  stripped the executable bit from bundled scripts (e.g. extension hook
  scripts) and could break them after extraction. Permissions are now
  normalized reproducibly to 0755 when the source file has any execute bit
  set, otherwise 0644 — identical inputs still yield byte-for-byte identical
  artifacts.
- installer.install_bundle + docs/reference/bundles.md: document that version
  pins are enforced install-time only. Because primitive is_installed checks
  are id-based (not version-aware), an already-present component is skipped
  during install without comparing its on-disk version to the manifest pin;
  pins are guaranteed applied only on a real install or `bundle update` refresh.

Added a regression asserting executable sources map to 0755 and plain files to
0644 in the built artifact.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* test(bundler): skip exec-bit packager test on Windows

Windows filesystems do not carry Unix execute bits, so chmod(0o755) is a no-op
and the source file reports no execute bit — the packager then correctly stores
the member as 0644. The assertion that an executable source maps to 0755 is only
meaningful on POSIX, so skip it on nt rather than asserting platform-specific
behavior.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): normalize prerelease spellings inside version constraints

Addresses review 4535327154: parse_version() normalized SemVer prerelease
spellings (e.g. 1.2.3-rc1 -> 1.2.3rc1) but parse_constraint() passed the
constraint to packaging.SpecifierSet unmodified, so ">=1.2.3-rc1" raised
InvalidSpecifier even though the same spelling is accepted for installed
versions. parse_constraint() now normalizes the version portion of each
comma-separated clause via the shared _normalize_semver helper, so prerelease
handling is consistent across versions and constraints.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(bundler): validate schema versions and required record identity fields

Addresses review 4535351596:

- records.load_records: validate the on-disk 'schema_version' (required;
  forward-compatible across same-major minor bumps) and fail fast with an
  actionable error on a missing/unknown version, rather than silently parsing a
  possibly-incompatible format and risking incorrect bundle attribution/removal.
- records.InstalledBundleRecord.from_dict: treat missing 'bundle_id' or
  'version' as corruption and raise BundlerError, instead of coercing them to
  empty strings that let later list/remove/update operations behave
  unpredictably.
- catalog_config._read: validate 'schema_version' when present (same-major
  compatibility) and fail fast on an unsupported version so an incompatible
  future config shape can't be mis-parsed into a wrong effective catalog stack.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore(bundler): scrub generated dogfooding scaffold before merge

The bundler feature was developed by dogfooding Spec Kit on itself. Now that
the work is complete, remove all generated scaffolding so it does not land in
the repository on merge:

- specs/001-spec-kit-bundler/** (spec, plan, research, data-model, contracts,
  quickstart, tasks, checklists)
- .specify/** (extensions, integrations, scripts, templates, workflows,
  feature/init/integration metadata)
- .github/agents/speckit.*.agent.md, .github/prompts/speckit.*.prompt.md, and
  .github/copilot-instructions.md (Copilot integration scaffold)

Retained: .specify/memory/constitution.md — the single dogfooding artifact
carried forward — with its whitespace exemption in .gitattributes.

.gitattributes and .markdownlint-cli2.jsonc are reverted to the upstream
baseline (plus the constitution whitespace exemption), dropping the now-moot
exemptions for the removed scaffold.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Pascal THUET <pascal.thuet@arte.tv>
This commit is contained in:
Manfred Riem
2026-06-19 17:07:20 -05:00
committed by GitHub
parent c2204871ec
commit 487af97864
58 changed files with 6721 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/specify_cli/__init__.py
View File

@@ -609,6 +609,13 @@ from .presets._commands import register as _register_preset_cmds # noqa: E402
_register_preset_cmds(app)
# ===== Bundle Commands =====
# Bundler subcommand group (specify bundle ...) — see commands/bundle/.
from .commands.bundle import register as _register_bundle_cmds # noqa: E402
_register_bundle_cmds(app)
# ===== Extension Commands =====

19
src/specify_cli/bundler/__init__.py Normal file
View File

@@ -0,0 +1,19 @@
"""Spec Kit bundler — importable, Typer-free logic for the ``specify bundle`` group.
This package holds the models, services, and helpers behind the ``specify bundle``
subcommand. It is intentionally free of any Typer/CLI imports so the orchestration
logic can be unit-tested independently of the command surface (Constitution
Principle I). The CLI wiring lives in ``specify_cli.commands.bundle``.
"""
from __future__ import annotations
__all__ = ["BundlerError"]
class BundlerError(Exception):
"""Base class for all actionable bundler errors.
Carrying a clean message lets the CLI layer print a single, user-facing line
on stderr and exit non-zero without leaking a traceback (Constitution
Principle V — explicit, actionable errors).
"""

2
src/specify_cli/bundler/commands_impl/__init__.py Normal file
View File

@@ -0,0 +1,2 @@
"""Bundler command-implementation helpers (kept thin; logic lives in services)."""
from __future__ import annotations

191
src/specify_cli/bundler/commands_impl/catalog_config.py Normal file
View File

@@ -0,0 +1,191 @@
"""Persistence for the project-scoped catalog config (``.specify/bundle-catalogs.yml``).
Only project scope is writable; built-in defaults are never deleted (they can be
overridden by adding a same-id source). The on-disk shape mirrors
``bundle-catalog.schema.md``: ``{schema_version, catalogs: [{id,url,priority,install_policy}]}``.
"""
from __future__ import annotations
from pathlib import Path
from urllib.parse import urlparse
import re
from .. import BundlerError
from ..lib.yamlio import dump_yaml, ensure_within, load_yaml
from ..models.catalog import (
CONFIG_FILENAME,
BUILTIN_DEFAULT_STACK,
CatalogSource,
InstallPolicy,
Scope,
)
CONFIG_SCHEMA_VERSION = "1.0"
_BUILTIN_IDS = {raw["id"] for raw in BUILTIN_DEFAULT_STACK}
# Windows absolute paths like ``C:\catalog.json`` parse with a single-letter
# ``scheme`` under urlparse; treat them as local files rather than URLs.
_WINDOWS_DRIVE_RE = re.compile(r"^[A-Za-z]:[\\/]")
def _config_path(project_root: Path) -> Path:
return Path(project_root) / ".specify" / CONFIG_FILENAME
def _read(project_root: Path) -> list[dict]:
# Confine the read (parity with the write path's within= guard): refuse to
# follow a symlinked or traversal-escaping .specify that resolves outside
# project_root.
path = ensure_within(project_root, _config_path(project_root))
if not path.exists():
return []
data = load_yaml(path)
if data is None:
return []
if not isinstance(data, dict):
raise BundlerError(
f"Malformed catalog config at {path}: expected a mapping at the top "
f"level, got {type(data).__name__}."
)
schema_version = data.get("schema_version")
if schema_version is not None and (
str(schema_version).strip().split(".")[0]
!= CONFIG_SCHEMA_VERSION.split(".")[0]
):
raise BundlerError(
f"Unsupported catalog config schema version "
f"'{str(schema_version).strip()}' at {path}; this Spec Kit "
f"understands version {CONFIG_SCHEMA_VERSION}. The file may have been "
"written by a newer version or is corrupt."
)
catalogs = data.get("catalogs")
if catalogs is None:
return []
if not isinstance(catalogs, list):
raise BundlerError(
f"Malformed catalog config at {path}: 'catalogs' must be a list, "
f"got {type(catalogs).__name__}."
)
for entry in catalogs:
if not isinstance(entry, dict):
raise BundlerError(
f"Malformed catalog config at {path}: each catalog entry must be "
f"a mapping, got {type(entry).__name__}."
)
return list(catalogs)
def _write(project_root: Path, catalogs: list[dict]) -> None:
payload = {"schema_version": CONFIG_SCHEMA_VERSION, "catalogs": catalogs}
dump_yaml(_config_path(project_root), payload, within=project_root)
def _slug(value: str) -> str:
# Lowercase so derived ids are deterministic and case-insensitive across
# platforms (e.g. 'Team-A.json' and 'team-a.json' yield the same id),
# keeping the case-sensitive duplicate check from admitting logical dupes.
return "".join(ch if ch.isalnum() else "-" for ch in value.lower()).strip("-")
_REMOTE_SCHEMES = {"http", "https", "file", "builtin"}
def _is_local_path(url: str) -> bool:
"""True when *url* denotes a local filesystem path rather than a URL."""
if _WINDOWS_DRIVE_RE.match(url):
return True
scheme = urlparse(url).scheme.lower()
return scheme not in _REMOTE_SCHEMES
def _canonicalize_url(url: str) -> str:
"""Make local file paths absolute so config is independent of the caller's cwd.
Remote URLs (``http(s)://``, ``file://``, ``builtin://``) are returned
unchanged; only bare/relative local paths are resolved to an absolute path.
"""
if _is_local_path(url):
return str(Path(url).expanduser().resolve())
return url
def _derive_id(url: str) -> str:
parsed = urlparse(url)
if parsed.netloc:
# Use .hostname (not netloc.split(':')) so credentials, ports, and IPv6
# literals (e.g. https://[2001:db8::1]/x) are handled correctly. Use the
# full host (TLD included) so different domains sharing a second-level
# label (example.com vs example.net) don't collide. _slug() lowercases
# and turns separators into dashes, so 'Example.com' -> 'example-com'.
host = parsed.hostname or ""
path_stem = Path(parsed.path).stem if parsed.path else ""
parts = [p for p in (_slug(host), _slug(path_stem)) if p]
return "-".join(parts) or "catalog"
stem = Path(parsed.path or url).stem
return _slug(stem) or "catalog"
def add_source(
project_root: Path,
url: str,
*,
policy: str,
priority: int,
source_id: str | None = None,
) -> CatalogSource:
url = url.strip()
if not url:
raise BundlerError("A catalog url is required.")
parsed = urlparse(url)
if not (parsed.scheme or parsed.path):
raise BundlerError(f"Invalid catalog url: '{url}'.")
# Reject unsupported URL schemes (e.g. ssh://, ftp://) up front so they are
# never silently canonicalized as local filesystem paths. Local paths that
# merely contain a ':' but no '://' (e.g. Windows drives) are still allowed.
if "://" in url and parsed.scheme.lower() not in _REMOTE_SCHEMES:
raise BundlerError(
f"Unsupported catalog url scheme '{parsed.scheme}://' in '{url}'. "
"Use http(s)://, file://, builtin://, or a local path."
)
url = _canonicalize_url(url)
install_policy = InstallPolicy.parse(policy)
resolved_id = (source_id or _derive_id(url)).strip()
catalogs = _read(project_root)
for existing in catalogs:
if existing.get("id") == resolved_id or existing.get("url") == url:
raise BundlerError(
f"Catalog source '{resolved_id}' (or url) already exists in this project."
)
entry = {
"id": resolved_id,
"url": url,
"priority": int(priority),
"install_policy": install_policy.value,
}
catalogs.append(entry)
_write(project_root, catalogs)
return CatalogSource.from_dict(entry, Scope.PROJECT)
def remove_source(project_root: Path, id_or_url: str) -> str:
target = id_or_url.strip()
if target in _BUILTIN_IDS:
raise BundlerError(
f"'{target}' is a built-in default source and cannot be deleted "
"(add a same-id source to override it instead)."
)
catalogs = _read(project_root)
remaining = [
c for c in catalogs if c.get("id") != target and c.get("url") != target
]
if len(remaining) == len(catalogs):
raise BundlerError(
f"No project-scoped catalog source matching '{target}' was found."
)
_write(project_root, remaining)
return target

2
src/specify_cli/bundler/lib/__init__.py Normal file
View File

@@ -0,0 +1,2 @@
"""Shared, dependency-light helpers for the bundler (YAML/JSON IO, versioning, project detection)."""
from __future__ import annotations

62
src/specify_cli/bundler/lib/project.py Normal file
View File

@@ -0,0 +1,62 @@
"""Spec Kit project detection and active-integration resolution."""
from __future__ import annotations
from pathlib import Path
from .. import BundlerError
from .yamlio import ensure_within, load_json
DEFAULT_INTEGRATION = "copilot"
def find_project_root(start: Path | None = None) -> Path | None:
"""Return the nearest ancestor (incl. *start*) containing a ``.specify/`` dir, or None.
A symlinked ``.specify`` is not accepted as a project root: following it
could read/write outside the intended tree, and other CLI surfaces refuse
it for the same reason.
"""
current = Path(start or Path.cwd()).resolve()
for candidate in (current, *current.parents):
marker = candidate / ".specify"
if marker.is_dir() and not marker.is_symlink():
return candidate
return None
def require_project_root(start: Path | None = None) -> Path:
"""Return the Spec Kit project root or raise an actionable error."""
root = find_project_root(start)
if root is None:
raise BundlerError(
"Not a Spec Kit project (no .specify/ directory). "
"Run 'specify bundle init' or 'specify init' first."
)
return root
def active_integration(project_root: Path) -> str | None:
"""Return the project's active integration id, if recorded.
Spec Kit records the chosen integration in ``.specify/integration.json``
during init. Returns None when it cannot be determined (e.g. agnostic).
"""
marker = Path(project_root) / ".specify" / "integration.json"
# Confine the read (mirrors records/catalog IO): refuse to follow a
# symlinked or traversal-escaping .specify that resolves outside
# project_root. An escape is treated as "not determinable".
try:
marker = ensure_within(project_root, marker)
except BundlerError:
return None
if not marker.exists():
return None
try:
data = load_json(marker)
except BundlerError:
return None
if isinstance(data, dict):
value = data.get("integration") or data.get("id") or data.get("active")
if isinstance(value, str) and value:
return value
return None

99
src/specify_cli/bundler/lib/versioning.py Normal file
View File

@@ -0,0 +1,99 @@
"""SemVer parsing and constraint evaluation, built on ``packaging`` (already a dependency)."""
from __future__ import annotations
import re
from packaging.specifiers import InvalidSpecifier, SpecifierSet
from packaging.version import InvalidVersion, Version
from .. import BundlerError
# Common SemVer prerelease spellings (``1.2.3-rc1``, ``1.2.3-alpha.1``) that
# PEP 440 / ``packaging`` rejects verbatim. Normalized to PEP 440 before
# parsing so prerelease versions validate consistently (mirrors
# ``specify_cli._version._normalize_tag``).
_PRERELEASE_PATTERN = re.compile(
r"^([0-9]+\.[0-9]+\.[0-9]+)[-.]?(alpha|beta|a|b|rc)[-.]?([0-9]+)(.*)$",
flags=re.IGNORECASE,
)
def _normalize_semver(value: str) -> str:
"""Normalize common SemVer prerelease spellings into PEP 440 text."""
text = str(value)
normalized = text[1:] if text[:1] in ("v", "V") else text
match = _PRERELEASE_PATTERN.match(normalized)
if match is None:
return normalized
base, label, number, rest = match.groups()
pep440_label = {"alpha": "a", "beta": "b"}.get(label.lower(), label.lower())
return f"{base}{pep440_label}{number}{rest}"
def parse_version(value: str) -> Version:
"""Parse a version string into a comparable :class:`Version`."""
try:
return Version(_normalize_semver(value))
except InvalidVersion as exc:
raise BundlerError(f"Invalid version '{value}': {exc}") from exc
_SPECIFIER_CLAUSE = re.compile(r"^\s*(===|==|~=|!=|<=|>=|<|>)?\s*(.*?)\s*$")
def _normalize_constraint(value: str) -> str:
"""Normalize the version portion of each clause in a constraint string.
``packaging.SpecifierSet`` rejects SemVer prerelease spellings like
``>=1.2.3-rc1`` verbatim, even though :func:`parse_version` accepts the same
spelling for installed versions. Normalize each comma-separated clause's
version so prerelease handling is consistent across versions and constraints.
"""
clauses = []
for raw in str(value).split(","):
if not raw.strip():
continue
match = _SPECIFIER_CLAUSE.match(raw)
operator, version = match.groups()
clauses.append(f"{operator or ''}{_normalize_semver(version)}")
return ",".join(clauses)
def parse_constraint(value: str) -> SpecifierSet:
"""Parse a version constraint such as ``>=0.9.0`` into a :class:`SpecifierSet`."""
try:
return SpecifierSet(_normalize_constraint(value))
except InvalidSpecifier as exc:
raise BundlerError(
f"Invalid version constraint '{value}': {exc}"
) from exc
def satisfies(installed: str, constraint: str) -> bool:
"""Return True if *installed* satisfies *constraint* (e.g. ``">=0.9.0"``).
Pre-releases are allowed so a dev/pre build of Spec Kit still counts.
"""
spec = parse_constraint(constraint)
version = parse_version(installed)
return spec.contains(version, prereleases=True)
_SEMVER_RE = re.compile(
r"^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)"
r"(?:-(?:(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)"
r"(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?"
r"(?:\+(?:[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$"
)
def is_semver(value: str) -> bool:
"""Return True only for a full ``MAJOR.MINOR.PATCH`` SemVer string.
Stricter than ``packaging.version.Version``, which also accepts partial
versions like ``"1"`` or ``"1.0"``. An optional leading ``v`` or ``V`` is
tolerated (mirrors ``_normalize_semver``).
"""
text = str(value)
core = text[1:] if text[:1] in ("v", "V") else text
return bool(_SEMVER_RE.match(core))

119
src/specify_cli/bundler/lib/yamlio.py Normal file
View File

@@ -0,0 +1,119 @@
"""YAML/JSON read-write helpers with path confinement (Constitution Principles IV & V).
All reads/writes go through these functions so that:
- IO failures degrade into actionable :class:`~specify_cli.bundler.BundlerError`s
rather than raw tracebacks, and
- every path can be confined to an allowed root via :func:`ensure_within`.
"""
from __future__ import annotations
import json
import os
import re
from pathlib import Path, PurePosixPath
from typing import Any
import yaml
from .. import BundlerError
def ensure_within(root: Path, candidate: Path) -> Path:
"""Resolve *candidate* and guarantee it stays within *root*.
Refuses path-traversal payloads and symlink escapes. Returns the resolved,
confined path. Raises :class:`BundlerError` if the path escapes *root*.
"""
root_resolved = Path(root).resolve()
# Resolve symlinks so a symlinked component cannot point outside the root.
candidate_resolved = Path(candidate).resolve()
try:
candidate_resolved.relative_to(root_resolved)
except ValueError as exc:
raise BundlerError(
f"Refusing path '{candidate}' — it escapes the allowed root '{root}'."
) from exc
return candidate_resolved
def load_yaml(path: Path) -> Any:
"""Parse a YAML file, returning ``{}`` for an empty document."""
path = Path(path)
if not path.exists():
raise BundlerError(f"File not found: {path}")
try:
with path.open("r", encoding="utf-8") as handle:
return yaml.safe_load(handle) or {}
except yaml.YAMLError as exc:
raise BundlerError(f"Invalid YAML in {path}: {exc}") from exc
except OSError as exc:
raise BundlerError(f"Could not read {path}: {exc}") from exc
def dump_yaml(path: Path, data: Any, *, within: Path | None = None) -> Path:
"""Write *data* as YAML to *path* (optionally confined to *within*)."""
path = Path(path)
if within is not None:
path = ensure_within(within, path)
try:
path.parent.mkdir(parents=True, exist_ok=True)
with path.open("w", encoding="utf-8") as handle:
yaml.safe_dump(data, handle, sort_keys=False, default_flow_style=False)
except OSError as exc:
raise BundlerError(f"Could not write {path}: {exc}") from exc
return path
def load_json(path: Path) -> Any:
"""Parse a JSON file."""
path = Path(path)
if not path.exists():
raise BundlerError(f"File not found: {path}")
try:
with path.open("r", encoding="utf-8") as handle:
return json.load(handle)
except json.JSONDecodeError as exc:
raise BundlerError(f"Invalid JSON in {path}: {exc}") from exc
except OSError as exc:
raise BundlerError(f"Could not read {path}: {exc}") from exc
def loads_json(text: str, *, origin: str = "<string>") -> Any:
"""Parse JSON from a string (used for catalog payloads fetched as text)."""
try:
return json.loads(text)
except json.JSONDecodeError as exc:
raise BundlerError(f"Invalid JSON from {origin}: {exc}") from exc
def dump_json(path: Path, data: Any, *, within: Path | None = None) -> Path:
"""Write *data* as pretty JSON to *path* (optionally confined to *within*)."""
path = Path(path)
if within is not None:
path = ensure_within(within, path)
try:
path.parent.mkdir(parents=True, exist_ok=True)
with path.open("w", encoding="utf-8") as handle:
json.dump(data, handle, indent=2, sort_keys=False)
handle.write("\n")
except OSError as exc:
raise BundlerError(f"Could not write {path}: {exc}") from exc
return path
def is_safe_relpath(rel: str) -> bool:
"""Return True if *rel* is a project-relative path with no traversal/absolute parts.
Platform-independent: a POSIX-absolute path (``/abs``) or a Windows
drive-absolute path (``C:\\x``) is rejected on every OS, since these strings
can appear in untrusted catalog/manifest data regardless of the host.
"""
if not rel:
return False
normalized = rel.replace("\\", "/")
if os.path.isabs(rel) or normalized.startswith("/"):
return False
if re.match(r"^[A-Za-z]:", normalized): # Windows drive-absolute (C:/...)
return False
parts = PurePosixPath(normalized).parts
return ".." not in parts

2
src/specify_cli/bundler/models/__init__.py Normal file
View File

@@ -0,0 +1,2 @@
"""Bundler data models (manifest, catalog, records)."""
from __future__ import annotations

258
src/specify_cli/bundler/models/catalog.py Normal file
View File

@@ -0,0 +1,258 @@
"""Catalog models: source stack (priority + install policy) and catalog entries.
Mirrors ``contracts/bundle-catalog.schema.md``. The stack precedence is
project > user > built-in; install is permitted only from ``install-allowed``
sources.
"""
from __future__ import annotations
from dataclasses import dataclass, field
from enum import Enum
from pathlib import Path
from typing import Any
from .. import BundlerError
from ..lib.yamlio import ensure_within, load_yaml
CONFIG_FILENAME = "bundle-catalogs.yml"
class InstallPolicy(str, Enum):
INSTALL_ALLOWED = "install-allowed"
DISCOVERY_ONLY = "discovery-only"
@classmethod
def parse(cls, value: Any) -> "InstallPolicy":
text = str(value or "").strip()
for policy in cls:
if policy.value == text:
return policy
raise BundlerError(
f"Invalid install_policy '{value}' "
f"(must be one of {[p.value for p in cls]})."
)
class Scope(str, Enum):
PROJECT = "project"
USER = "user"
BUILTIN = "built-in"
# Built-in default stack (used when no project/user config overrides it).
BUILTIN_DEFAULT_STACK: tuple[dict[str, Any], ...] = (
{"id": "default", "url": "builtin://default", "priority": 1,
"install_policy": InstallPolicy.INSTALL_ALLOWED.value},
{"id": "community", "url": "builtin://community", "priority": 2,
"install_policy": InstallPolicy.DISCOVERY_ONLY.value},
)
@dataclass(frozen=True)
class CatalogSource:
id: str
url: str
priority: int
install_policy: InstallPolicy
scope: Scope = Scope.PROJECT
@property
def install_allowed(self) -> bool:
return self.install_policy is InstallPolicy.INSTALL_ALLOWED
@classmethod
def from_dict(cls, data: Any, scope: Scope) -> "CatalogSource":
if not isinstance(data, dict):
raise BundlerError("Each catalog source must be a mapping.")
source_id = str(data.get("id", "")).strip()
url = str(data.get("url", "")).strip()
if not source_id:
raise BundlerError("A catalog source is missing its 'id'.")
if not url:
raise BundlerError(f"Catalog source '{source_id}' is missing its 'url'.")
priority = data.get("priority")
if priority is None:
raise BundlerError(f"Catalog source '{source_id}' is missing its 'priority'.")
if isinstance(priority, bool) or not isinstance(priority, (int, str)):
raise BundlerError(
f"Catalog source '{source_id}' has a non-integer priority: {priority!r}."
)
try:
priority_int = int(priority)
except (TypeError, ValueError):
raise BundlerError(
f"Catalog source '{source_id}' has a non-integer priority: {priority!r}."
) from None
return cls(
id=source_id,
url=url,
priority=priority_int,
install_policy=InstallPolicy.parse(data.get("install_policy")),
scope=scope,
)
def to_dict(self) -> dict[str, Any]:
return {
"id": self.id,
"url": self.url,
"priority": self.priority,
"install_policy": self.install_policy.value,
}
def _parse_tags(value: Any, entry_id: str) -> tuple[str, ...]:
"""Coerce a catalog entry's ``tags`` into a tuple of strings.
Catalogs are untrusted input: a bare string would otherwise be iterated
character-by-character, so reject anything that is not a list/tuple.
"""
if value is None:
return ()
if isinstance(value, (str, bytes)) or not isinstance(value, (list, tuple)):
raise BundlerError(
f"Catalog entry '{entry_id}': 'tags' must be a list of strings."
)
return tuple(str(t) for t in value)
def _parse_verified(value: Any, entry_id: str) -> bool:
"""Validate a catalog entry's ``verified`` flag is a real boolean.
``bool("false")`` is truthy, so coercing arbitrary strings would silently
mark untrusted entries as verified; require an actual boolean instead.
"""
if isinstance(value, bool):
return value
raise BundlerError(
f"Catalog entry '{entry_id}': 'verified' must be a boolean (true/false)."
)
@dataclass(frozen=True)
class CatalogEntry:
id: str
name: str
version: str
role: str
description: str
author: str
license: str
download_url: str
requires_speckit_version: str
provides: dict[str, int] = field(default_factory=dict)
repository: str | None = None
tags: tuple[str, ...] = ()
verified: bool = False
# Resolution provenance (filled in by the catalog stack at lookup time):
source_id: str | None = None
source_policy: InstallPolicy | None = None
@classmethod
def from_dict(cls, data: Any) -> "CatalogEntry":
if not isinstance(data, dict):
raise BundlerError("Each catalog entry must be a mapping.")
entry_id = str(data.get("id", "")).strip()
requires = data.get("requires") or {}
if not isinstance(requires, dict):
raise BundlerError(
f"Catalog entry '{entry_id or '<unknown>'}': 'requires' must be a "
"mapping when present."
)
provides_raw = data.get("provides") or {}
if not isinstance(provides_raw, dict):
raise BundlerError(
f"Catalog entry '{entry_id or '<unknown>'}': 'provides' must be a "
"mapping when present."
)
return cls(
id=entry_id,
name=str(data.get("name", "")).strip(),
version=str(data.get("version", "")).strip(),
role=str(data.get("role", "")).strip(),
description=str(data.get("description", "")).strip(),
author=str(data.get("author", "")).strip(),
license=str(data.get("license", "")).strip(),
download_url=str(data.get("download_url", "")).strip(),
requires_speckit_version=str(requires.get("speckit_version", "")).strip(),
provides=dict(provides_raw),
repository=(str(data["repository"]) if data.get("repository") else None),
tags=_parse_tags(data.get("tags"), entry_id),
verified=_parse_verified(data.get("verified", False), entry_id),
)
def with_provenance(self, source: CatalogSource) -> "CatalogEntry":
return CatalogEntry(
id=self.id, name=self.name, version=self.version, role=self.role,
description=self.description, author=self.author, license=self.license,
download_url=self.download_url,
requires_speckit_version=self.requires_speckit_version,
provides=self.provides, repository=self.repository, tags=self.tags,
verified=self.verified, source_id=source.id,
source_policy=source.install_policy,
)
def load_catalog_payload(data: Any) -> dict[str, CatalogEntry]:
"""Parse a catalog JSON payload into ``{bundle_id: CatalogEntry}``."""
if not isinstance(data, dict):
raise BundlerError("Catalog payload must be a JSON object.")
bundles_raw = data.get("bundles")
if not isinstance(bundles_raw, dict):
raise BundlerError("Catalog payload is missing a 'bundles' object.")
entries: dict[str, CatalogEntry] = {}
for bundle_id, entry_raw in bundles_raw.items():
key = str(bundle_id)
entry = CatalogEntry.from_dict(entry_raw)
# The enclosing key is the authoritative bundle id used by
# search/resolve/install. Reject entries whose own ``id`` is missing or
# disagrees with the key, so a malformed or malicious catalog can't list
# an id that resolves to a different (or no) bundle.
if not entry.id:
raise BundlerError(
f"Catalog entry for '{key}' is missing its 'id' field."
)
if entry.id != key:
raise BundlerError(
f"Catalog entry id mismatch: key '{key}' != entry id "
f"'{entry.id}'."
)
entries[key] = entry
return entries
def load_source_stack(project_root: Path, user_config_dir: Path | None = None) -> list[CatalogSource]:
"""Build the effective, priority-sorted source stack (project > user > built-in).
A source id present at a higher-precedence scope overrides the same id at a
lower scope. The built-in default stack is always the fallback.
"""
by_id: dict[str, CatalogSource] = {}
# Lowest precedence first; later writes override earlier ones for the same id.
for raw in BUILTIN_DEFAULT_STACK:
src = CatalogSource.from_dict(raw, Scope.BUILTIN)
by_id[src.id] = src
if user_config_dir is not None:
_merge_config(by_id, Path(user_config_dir) / CONFIG_FILENAME, Scope.USER)
# Confine the project-scoped read: refuse a symlinked .specify/ that
# resolves outside the project root (consistent with other guarded reads).
project_config = Path(project_root) / ".specify" / CONFIG_FILENAME
if project_config.exists():
ensure_within(project_root, project_config)
_merge_config(by_id, project_config, Scope.PROJECT)
return sorted(by_id.values(), key=lambda s: (s.priority, s.id))
def _merge_config(by_id: dict[str, CatalogSource], config_path: Path, scope: Scope) -> None:
if not config_path.exists():
return
data = load_yaml(config_path)
catalogs = data.get("catalogs") if isinstance(data, dict) else None
if not catalogs:
return
for raw in catalogs:
src = CatalogSource.from_dict(raw, scope)
by_id[src.id] = src

263
src/specify_cli/bundler/models/manifest.py Normal file
View File

@@ -0,0 +1,263 @@
"""Bundle manifest model (``bundle.yml``) — parsing and structural normalization.
Mirrors ``contracts/bundle-manifest.schema.md``. Structural validation (shape,
required fields, enum/semver checks) lives here; *reference* resolution against a
catalog stack lives in the validator/resolver services.
"""
from __future__ import annotations
import re
from dataclasses import dataclass, field
from pathlib import Path
from typing import Any
from .. import BundlerError
from ..lib.versioning import is_semver
from ..lib.yamlio import load_yaml
SUPPORTED_SCHEMA_VERSIONS = {"1.0"}
PRESET_STRATEGIES = {"replace", "prepend", "append", "wrap"}
COMPONENT_KINDS = ("extensions", "presets", "steps", "workflows")
# A bundle id must be a filesystem-safe slug: it is interpolated into artifact
# filenames (e.g. ``<id>-<version>.zip``), so path separators or traversal
# segments must never appear.
_SAFE_BUNDLE_ID = re.compile(r"^[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?$")
@dataclass(frozen=True)
class ComponentRef:
"""A pointer to an existing Spec Kit primitive a bundle installs."""
kind: str # one of COMPONENT_KINDS (singularized concept), stored plural-of-origin
id: str
version: str | None = None
source: str | None = None
priority: int | None = None # presets only
strategy: str | None = None # presets only
def label(self) -> str:
return f"{self.kind[:-1]}:{self.id}@{self.version or 'unpinned'}"
@dataclass(frozen=True)
class IntegrationRef:
id: str
@dataclass(frozen=True)
class Requires:
speckit_version: str
tools: tuple[str, ...] = ()
mcp: tuple[str, ...] = ()
@dataclass(frozen=True)
class BundleMeta:
id: str
name: str
version: str
role: str
description: str
author: str
license: str
@dataclass
class BundleManifest:
schema_version: str
bundle: BundleMeta
requires: Requires
integration: IntegrationRef | None = None
extensions: list[ComponentRef] = field(default_factory=list)
presets: list[ComponentRef] = field(default_factory=list)
steps: list[ComponentRef] = field(default_factory=list)
workflows: list[ComponentRef] = field(default_factory=list)
tags: tuple[str, ...] = ()
source_path: Path | None = None
@property
def components(self) -> list[ComponentRef]:
"""All installable component references in deterministic order."""
return [*self.extensions, *self.presets, *self.steps, *self.workflows]
# -- construction ---------------------------------------------------------
@classmethod
def from_file(cls, path: Path) -> "BundleManifest":
data = load_yaml(path)
manifest = cls.from_dict(data)
manifest.source_path = Path(path)
return manifest
@classmethod
def from_dict(cls, data: Any) -> "BundleManifest":
if not isinstance(data, dict):
raise BundlerError("Manifest must be a YAML mapping at the top level.")
schema_version = str(data.get("schema_version", "")).strip()
bundle_raw = data.get("bundle")
if not isinstance(bundle_raw, dict):
raise BundlerError("Manifest is missing the required 'bundle' mapping.")
meta = BundleMeta(
id=str(bundle_raw.get("id", "")).strip(),
name=str(bundle_raw.get("name", "")).strip(),
version=str(bundle_raw.get("version", "")).strip(),
role=str(bundle_raw.get("role", "")).strip(),
description=str(bundle_raw.get("description", "")).strip(),
author=str(bundle_raw.get("author", "")).strip(),
license=str(bundle_raw.get("license", "")).strip(),
)
requires_raw = data.get("requires") or {}
if not isinstance(requires_raw, dict):
raise BundlerError("'requires' must be a mapping when present.")
requires = Requires(
speckit_version=str(requires_raw.get("speckit_version", "")).strip(),
tools=_parse_str_list(requires_raw.get("tools"), "requires.tools"),
mcp=_parse_str_list(requires_raw.get("mcp"), "requires.mcp"),
)
integration = None
integration_raw = data.get("integration")
if isinstance(integration_raw, dict) and integration_raw.get("id"):
integration = IntegrationRef(id=str(integration_raw["id"]).strip())
provides = data.get("provides") or {}
if not isinstance(provides, dict):
raise BundlerError("'provides' must be a mapping when present.")
tags_raw = data.get("tags")
if tags_raw is None:
tags_raw = []
else:
tags_raw = _parse_str_list(tags_raw, "tags")
manifest = cls(
schema_version=schema_version,
bundle=meta,
requires=requires,
integration=integration,
extensions=_parse_refs("extensions", provides.get("extensions")),
presets=_parse_refs("presets", provides.get("presets")),
steps=_parse_refs("steps", provides.get("steps")),
workflows=_parse_refs("workflows", provides.get("workflows")),
tags=tuple(str(t) for t in tags_raw),
)
return manifest
# -- structural validation ------------------------------------------------
def structural_errors(self) -> list[str]:
"""Return a list of human-readable structural problems (empty == valid)."""
errors: list[str] = []
if self.schema_version not in SUPPORTED_SCHEMA_VERSIONS:
errors.append(
f"schema_version '{self.schema_version or '<missing>'}' is not supported "
f"(supported: {sorted(SUPPORTED_SCHEMA_VERSIONS)})."
)
required = {
"bundle.id": self.bundle.id,
"bundle.name": self.bundle.name,
"bundle.version": self.bundle.version,
"bundle.role": self.bundle.role,
"bundle.description": self.bundle.description,
"bundle.author": self.bundle.author,
"bundle.license": self.bundle.license,
"requires.speckit_version": self.requires.speckit_version,
}
for field_path, value in required.items():
if not value:
errors.append(f"Missing required field: {field_path}.")
if self.bundle.version and not is_semver(self.bundle.version):
errors.append(f"bundle.version '{self.bundle.version}' is not valid semver.")
if self.bundle.id and not _SAFE_BUNDLE_ID.match(self.bundle.id):
errors.append(
f"bundle.id '{self.bundle.id}' must be a slug "
"(lowercase letters, digits, '.', '_', '-'; no path separators)."
)
for ref in self.components:
if not ref.id:
errors.append(f"A {ref.kind[:-1]} entry is missing its 'id'.")
if ref.kind != "steps" and not ref.version:
errors.append(
f"{ref.kind[:-1]} '{ref.id or '<unknown>'}' must be pinned to a 'version'."
)
if ref.version and not is_semver(ref.version):
errors.append(
f"{ref.kind[:-1]} '{ref.id}' has invalid version '{ref.version}'."
)
for ref in self.presets:
if ref.priority is None:
errors.append(f"preset '{ref.id}' must declare an integer 'priority'.")
if ref.strategy is None or ref.strategy not in PRESET_STRATEGIES:
errors.append(
f"preset '{ref.id}' has invalid strategy '{ref.strategy}' "
f"(must be one of {sorted(PRESET_STRATEGIES)})."
)
return errors
def is_agnostic(self) -> bool:
"""True when the bundle declares no integration (inherits the active one)."""
return self.integration is None
def _parse_str_list(raw: Any, field_name: str) -> tuple[str, ...]:
"""Coerce a manifest list-of-strings field into a tuple of strings.
Rejects a bare string/bytes (which would otherwise be iterated
character-by-character) and any non-list/tuple, matching the manifest
contract (``string[]``).
"""
if raw is None:
return ()
if isinstance(raw, (str, bytes)) or not isinstance(raw, (list, tuple)):
raise BundlerError(f"'{field_name}' must be a list of strings when present.")
return tuple(str(item) for item in raw)
def _parse_refs(kind: str, raw: Any) -> list[ComponentRef]:
if raw is None:
return []
if not isinstance(raw, list):
raise BundlerError(f"provides.{kind} must be a list when present.")
refs: list[ComponentRef] = []
for item in raw:
if not isinstance(item, dict):
raise BundlerError(f"Each provides.{kind} entry must be a mapping.")
priority = _parse_priority(kind, item.get("priority"))
refs.append(
ComponentRef(
kind=kind,
id=str(item.get("id", "")).strip(),
version=(str(item["version"]).strip() if item.get("version") else None),
source=(str(item["source"]).strip() if item.get("source") else None),
priority=priority,
strategy=(str(item["strategy"]).strip() if item.get("strategy") else None),
)
)
return refs
def _parse_priority(kind: str, raw: Any) -> int | None:
if raw is None:
return None
if isinstance(raw, bool) or not isinstance(raw, (int, str)):
raise BundlerError(
f"provides.{kind} priority must be an integer, got {raw!r}."
)
try:
return int(raw)
except (TypeError, ValueError):
raise BundlerError(
f"provides.{kind} priority must be an integer, got {raw!r}."
) from None

229
src/specify_cli/bundler/models/records.py Normal file
View File

@@ -0,0 +1,229 @@
"""Installed-bundle records — provenance for precise list/remove/update.
Records are stored as JSON at ``.specify/bundle-records.json``. Each record
captures exactly which components a bundle contributed so removal touches only
that bundle's components and never collateral (FR-022, SC-004).
"""
from __future__ import annotations
from dataclasses import dataclass
from datetime import datetime, timezone
from pathlib import Path
from typing import Any
from .. import BundlerError
from ..lib.yamlio import dump_json, ensure_within, load_json
from .manifest import COMPONENT_KINDS, ComponentRef
RECORDS_FILENAME = "bundle-records.json"
RECORDS_SCHEMA_VERSION = "1.0"
@dataclass(frozen=True)
class InstalledBundleRecord:
bundle_id: str
version: str
contributed_components: tuple[ComponentRef, ...]
installed_at: str
@classmethod
def create(
cls,
bundle_id: str,
version: str,
components: list[ComponentRef],
installed_at: str | None = None,
) -> "InstalledBundleRecord":
return cls(
bundle_id=bundle_id,
version=version,
contributed_components=tuple(components),
installed_at=installed_at or _utc_now(),
)
def to_dict(self) -> dict[str, Any]:
return {
"bundle_id": self.bundle_id,
"version": self.version,
"installed_at": self.installed_at,
"contributed_components": [
_component_to_dict(c) for c in self.contributed_components
],
}
@classmethod
def from_dict(cls, data: Any) -> "InstalledBundleRecord":
if not isinstance(data, dict):
raise BundlerError("Each installed-bundle record must be a mapping.")
components_raw = data.get("contributed_components") or []
if not isinstance(components_raw, list):
raise BundlerError(
"Corrupt record: 'contributed_components' must be a list."
)
bundle_id = str(data.get("bundle_id", "")).strip()
version = str(data.get("version", "")).strip()
if not bundle_id:
raise BundlerError(
"Corrupt records file: an installed-bundle record is missing "
"its 'bundle_id'."
)
if not version:
raise BundlerError(
f"Corrupt records file: record for bundle '{bundle_id}' is "
"missing its 'version'."
)
return cls(
bundle_id=bundle_id,
version=version,
installed_at=str(data.get("installed_at", "")).strip(),
contributed_components=tuple(
_component_from_dict(c) for c in components_raw
),
)
def records_path(project_root: Path) -> Path:
return Path(project_root) / ".specify" / RECORDS_FILENAME
def _check_schema_version(value: Any, *, path: Path, required: bool) -> None:
"""Reject a records file whose schema version we cannot safely parse.
A future incompatible format (or a corrupted file) must fail fast with an
actionable error rather than being silently mis-parsed, which could lead to
incorrect bundle attribution or removal. Forward-compatible minor bumps that
keep the same major version are accepted.
"""
if value is None:
if required:
raise BundlerError(
f"Corrupt records file: {path} — missing 'schema_version'. "
f"Expected version {RECORDS_SCHEMA_VERSION}."
)
return
seen = str(value).strip()
if seen.split(".")[0] != RECORDS_SCHEMA_VERSION.split(".")[0]:
raise BundlerError(
f"Unsupported records schema version '{seen}' at {path}; this "
f"Spec Kit understands version {RECORDS_SCHEMA_VERSION}. The file may "
"have been written by a newer version or is corrupt."
)
def load_records(project_root: Path) -> list[InstalledBundleRecord]:
# Defense in depth (mirrors the write path's within= confinement): refuse to
# read through a symlinked or traversal-escaping ``.specify`` that resolves
# outside project_root.
path = ensure_within(project_root, records_path(project_root))
if not path.exists():
return []
data = load_json(path)
if not isinstance(data, dict):
raise BundlerError(f"Corrupt records file: {path}")
_check_schema_version(data.get("schema_version"), path=path, required=True)
bundles = data.get("bundles") or []
if not isinstance(bundles, list):
raise BundlerError(
f"Corrupt records file: {path} — 'bundles' must be a list."
)
return [InstalledBundleRecord.from_dict(item) for item in bundles]
def save_records(project_root: Path, records: list[InstalledBundleRecord]) -> None:
payload = {
"schema_version": RECORDS_SCHEMA_VERSION,
"updated_at": _utc_now(),
"bundles": [r.to_dict() for r in records],
}
dump_json(records_path(project_root), payload, within=project_root)
def find_record(
records: list[InstalledBundleRecord], bundle_id: str
) -> InstalledBundleRecord | None:
for record in records:
if record.bundle_id == bundle_id:
return record
return None
def upsert_record(
records: list[InstalledBundleRecord], record: InstalledBundleRecord
) -> list[InstalledBundleRecord]:
"""Return a new list with *record* replacing any same-id record (append otherwise)."""
updated = [r for r in records if r.bundle_id != record.bundle_id]
updated.append(record)
return updated
def remove_record(
records: list[InstalledBundleRecord], bundle_id: str
) -> list[InstalledBundleRecord]:
return [r for r in records if r.bundle_id != bundle_id]
def components_still_needed(
records: list[InstalledBundleRecord], exclude_bundle_id: str
) -> set[tuple[str, str]]:
"""Set of ``(kind, id)`` component keys required by bundles other than the excluded one."""
needed: set[tuple[str, str]] = set()
for record in records:
if record.bundle_id == exclude_bundle_id:
continue
for component in record.contributed_components:
needed.add((component.kind, component.id))
return needed
def _component_to_dict(ref: ComponentRef) -> dict[str, Any]:
data: dict[str, Any] = {"kind": ref.kind, "id": ref.id}
if ref.version is not None:
data["version"] = ref.version
if ref.source is not None:
data["source"] = ref.source
if ref.priority is not None:
data["priority"] = ref.priority
if ref.strategy is not None:
data["strategy"] = ref.strategy
return data
def _component_from_dict(data: Any) -> ComponentRef:
if not isinstance(data, dict):
raise BundlerError("Each contributed component must be a mapping.")
kind = str(data.get("kind", "")).strip()
cid = str(data.get("id", "")).strip()
if kind not in COMPONENT_KINDS:
raise BundlerError(
f"Corrupt records file: component 'kind' must be one of "
f"{list(COMPONENT_KINDS)}, got {kind or '<missing>'!r}."
)
if not cid:
raise BundlerError(
"Corrupt records file: a contributed component is missing its 'id'."
)
return ComponentRef(
kind=kind,
id=cid,
version=(str(data["version"]) if data.get("version") else None),
source=(str(data["source"]) if data.get("source") else None),
priority=_parse_priority(data.get("priority")),
strategy=(str(data["strategy"]) if data.get("strategy") else None),
)
def _parse_priority(raw: Any) -> int | None:
if raw is None:
return None
if isinstance(raw, bool) or not isinstance(raw, (int, str)):
raise BundlerError(f"Component priority must be an integer, got {raw!r}.")
try:
return int(raw)
except (TypeError, ValueError):
raise BundlerError(
f"Component priority must be an integer, got {raw!r}."
) from None
def _utc_now() -> str:
return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")

2
src/specify_cli/bundler/services/__init__.py Normal file
View File

@@ -0,0 +1,2 @@
"""Bundler services (catalog stack, resolver, installer, conflict, validator, packager)."""
from __future__ import annotations

193
src/specify_cli/bundler/services/adapters.py Normal file
View File

@@ -0,0 +1,193 @@
"""Concrete adapters: catalog fetching and primitive installation.
These wire the bundler's injectable seams to the real environment:
* :func:`make_catalog_fetcher` returns an offline-first fetcher that reads
built-in catalogs and local/pinned file URLs without network, and falls back
to a timeout-bounded HTTP GET only for ``http(s)://`` sources.
* :class:`DefaultPrimitiveInstaller` dispatches component install/remove to the
existing Spec Kit primitive machinery in-process.
"""
from __future__ import annotations
import re
from pathlib import Path
from urllib.parse import ParseResult, urlparse
from urllib.request import url2pathname
from .. import BundlerError
from ..lib.yamlio import loads_json
from ..models.catalog import CatalogSource
from ..models.manifest import ComponentRef
# Built-in catalog payloads ship empty by default; a host distribution can
# replace these with curated content. Keeping them here makes ``search``/``info``
# work fully offline against the default stack.
_BUILTIN_CATALOGS: dict[str, dict] = {
"builtin://default": {
"schema_version": "1.0",
"catalog_url": "builtin://default",
"bundles": {},
},
"builtin://community": {
"schema_version": "1.0",
"catalog_url": "builtin://community",
"bundles": {},
},
}
HTTP_TIMEOUT_SECONDS = 10
# Windows absolute paths like ``C:\catalog.json`` parse with a single-letter
# ``scheme`` under urlparse; treat them as local files rather than URLs.
_WINDOWS_DRIVE_RE = re.compile(r"^[A-Za-z]:[\\/]")
def _is_windows_drive_path(url: str) -> bool:
return bool(_WINDOWS_DRIVE_RE.match(url))
def _file_url_to_path(parsed: ParseResult) -> Path:
"""Convert a ``file://`` URL to a local path.
Uses ``url2pathname`` for percent-decoding and OS-correct separators, and
preserves ``netloc`` so UNC paths (``file://server/share``) and Windows
drive URLs (``file:///C:/x``) resolve correctly instead of dropping host
or producing ``/C:/x``.
"""
netloc = parsed.netloc
if netloc and netloc.lower() != "localhost":
# UNC share: file://server/share/... -> \\server\share\...
return Path(url2pathname(f"//{netloc}{parsed.path}"))
return Path(url2pathname(parsed.path))
def _validate_remote_url(source_id: str, url: str) -> None:
"""Restrict remote catalogs to HTTPS (HTTP only for localhost) with a host.
Mirrors ``specify_cli.catalogs`` URL validation to avoid MITM/downgrade
issues before any network call.
"""
parsed = urlparse(url)
is_localhost = parsed.hostname in ("localhost", "127.0.0.1", "::1")
if parsed.scheme != "https" and not (parsed.scheme == "http" and is_localhost):
raise BundlerError(
f"Catalog '{source_id}' URL must use HTTPS (got {parsed.scheme}://). "
"HTTP is only allowed for localhost."
)
if not parsed.netloc:
raise BundlerError(
f"Catalog '{source_id}' URL must be a valid URL with a host: {url}"
)
def make_catalog_fetcher(*, allow_network: bool = True):
"""Return a fetcher callable suitable for :class:`CatalogStack`.
When *allow_network* is False, ``http(s)://`` sources raise instead of
touching the network (used by offline tests and ``--offline`` flows).
"""
def fetch(source: CatalogSource) -> dict:
url = source.url
parsed = urlparse(url)
scheme = parsed.scheme.lower()
if scheme == "builtin":
payload = _BUILTIN_CATALOGS.get(url)
if payload is None:
raise BundlerError(f"Unknown built-in catalog '{url}'.")
return payload
if scheme == "file":
path = _file_url_to_path(parsed)
if not path.exists():
raise BundlerError(f"Catalog file not found: {path}")
return loads_json(path.read_text(encoding="utf-8"), origin=str(path))
if scheme == "" or _is_windows_drive_path(url):
path = Path(url)
if not path.exists():
raise BundlerError(f"Catalog file not found: {path}")
return loads_json(path.read_text(encoding="utf-8"), origin=str(path))
if scheme in ("http", "https"):
if not allow_network:
raise BundlerError(
f"Network access disabled; cannot fetch catalog '{source.id}' "
f"from {url}."
)
_validate_remote_url(source.id, url)
return _http_get_json(source.id, url)
raise BundlerError(f"Unsupported catalog URL scheme: {url}")
return fetch
def _http_get_json(source_id: str, url: str) -> dict:
"""Fetch catalog JSON over HTTP(S) via the shared authenticated client.
Routing through :func:`specify_cli.authentication.http.open_url` gives
``auth.json`` token support and strips the ``Authorization`` header when a
redirect leaves the entry's trusted hosts or downgrades the scheme. We also
reject any redirect that leaves HTTPS (the ``redirect_validator`` runs
*before* each hop) and re-validate the final URL after redirects, so the
HTTPS/host guarantee from ``_validate_remote_url`` is preserved end to end
rather than only on the initial URL.
"""
from ...authentication.http import open_url
def _validate_redirect(_old_url: str, new_url: str) -> None:
_validate_remote_url(source_id, new_url)
try:
with open_url(
url,
timeout=HTTP_TIMEOUT_SECONDS,
redirect_validator=_validate_redirect,
) as response:
final_url = response.geturl()
_validate_remote_url(source_id, final_url)
raw = response.read().decode("utf-8")
except BundlerError:
raise
except Exception as exc: # noqa: BLE001
raise BundlerError(f"Failed to fetch catalog from {url}: {exc}") from exc
return loads_json(raw, origin=final_url)
class DefaultPrimitiveInstaller:
"""Dispatch component install/remove to existing primitive machinery.
This adapter is intentionally thin: it owns no install logic of its own,
delegating entirely to the per-primitive managers so the bundler honours
Principle I (no duplicated primitive logic).
*allow_network* mirrors the bundle command's ``--offline`` flag: when False,
component kinds that can only be sourced from a remote catalog refuse rather
than touching the network. Bundled presets/extensions still install offline.
"""
def __init__(self, *, allow_network: bool = True) -> None:
self._allow_network = allow_network
def is_installed(self, project_root: Path, component: ComponentRef) -> bool:
manager = self._manager_for(component, project_root)
return manager.is_installed(component)
def install(self, project_root: Path, component: ComponentRef) -> None:
manager = self._manager_for(component, project_root)
manager.install(component)
def remove(self, project_root: Path, component: ComponentRef) -> None:
manager = self._manager_for(component, project_root)
manager.remove(component)
def _manager_for(self, component: ComponentRef, project_root: Path):
# Lazy import to avoid import cycles and keep startup cheap (Principle IV).
from .primitives import primitive_manager
return primitive_manager(
component.kind, project_root, allow_network=self._allow_network
)

114
src/specify_cli/bundler/services/catalog_stack.py Normal file
View File

@@ -0,0 +1,114 @@
"""Catalog stack: aggregate bundle entries across sources with precedence + policy.
Loads each source's catalog payload (via an injectable fetcher so tests stay
offline), then resolves a bundle id to the highest-precedence entry while
recording whether installation is permitted by that source's policy.
"""
from __future__ import annotations
from dataclasses import dataclass
from pathlib import Path
from typing import Callable
from .. import BundlerError
from ..models.catalog import (
CatalogEntry,
CatalogSource,
load_catalog_payload,
load_source_stack,
)
# A fetcher returns the raw JSON payload (a dict) for a given source.
CatalogFetcher = Callable[[CatalogSource], dict]
@dataclass
class ResolvedBundle:
entry: CatalogEntry
source: CatalogSource
@property
def install_allowed(self) -> bool:
return self.source.install_allowed
class CatalogStack:
def __init__(
self,
sources: list[CatalogSource],
fetcher: CatalogFetcher,
) -> None:
# Highest precedence (lowest priority number) first.
self._sources = sorted(sources, key=lambda s: (s.priority, s.id))
self._fetcher = fetcher
self._payloads: dict[str, dict[str, CatalogEntry]] = {}
@classmethod
def load(
cls,
project_root: Path,
fetcher: CatalogFetcher,
user_config_dir: Path | None = None,
) -> "CatalogStack":
sources = load_source_stack(project_root, user_config_dir)
return cls(sources, fetcher)
@property
def sources(self) -> list[CatalogSource]:
return list(self._sources)
def _entries_for(self, source: CatalogSource) -> dict[str, CatalogEntry]:
if source.id not in self._payloads:
try:
raw = self._fetcher(source)
except BundlerError:
raise
except Exception as exc: # noqa: BLE001 - surface as chained BundlerError
raise BundlerError(
f"Failed to load catalog '{source.id}' ({source.url}): {exc}"
) from exc
self._payloads[source.id] = load_catalog_payload(raw)
return self._payloads[source.id]
def resolve(self, bundle_id: str) -> ResolvedBundle:
"""Return the highest-precedence entry for *bundle_id* or raise."""
for source in self._sources:
entries = self._entries_for(source)
entry = entries.get(bundle_id)
if entry is not None:
return ResolvedBundle(entry=entry.with_provenance(source), source=source)
raise BundlerError(
f"Bundle '{bundle_id}' was not found in any configured catalog."
)
def search(self, query: str = "") -> list[ResolvedBundle]:
"""Return entries matching *query* (substring over id/name/role/tags/description).
Each bundle id appears once, resolved at its highest-precedence source.
Results are sorted by bundle id for deterministic output.
"""
needle = query.strip().lower()
seen: dict[str, ResolvedBundle] = {}
for source in self._sources:
for bundle_id, entry in self._entries_for(source).items():
if bundle_id in seen:
continue
if needle and not _matches(entry, needle):
continue
seen[bundle_id] = ResolvedBundle(
entry=entry.with_provenance(source), source=source
)
return [seen[k] for k in sorted(seen)]
def _matches(entry: CatalogEntry, needle: str) -> bool:
haystack = " ".join(
[
entry.id,
entry.name,
entry.role,
entry.description,
" ".join(entry.tags),
]
).lower()
return needle in haystack

54
src/specify_cli/bundler/services/conflict.py Normal file
View File

@@ -0,0 +1,54 @@
"""Conflict detection across the installed-bundle stack.
The single cross-bundle conflict point is the active integration (FR-019).
Component-level overlaps (same preset id at different priorities, etc.) are
resolved by the existing primitive machinery's own precedence rules, so the
bundler only needs to guard the integration invariant and surface informational
overlaps.
"""
from __future__ import annotations
from dataclasses import dataclass, field
from ..models.manifest import BundleManifest
from ..models.records import InstalledBundleRecord
@dataclass
class ConflictReport:
integration_clash: str | None = None # message when a hard clash exists
overlaps: list[str] = field(default_factory=list) # components already provided
@property
def has_blocking_conflict(self) -> bool:
return self.integration_clash is not None
def detect_conflicts(
manifest: BundleManifest,
active_integration: str | None,
installed: list[InstalledBundleRecord],
) -> ConflictReport:
report = ConflictReport()
if manifest.integration is not None and active_integration:
if manifest.integration.id != active_integration:
report.integration_clash = (
f"Bundle targets integration '{manifest.integration.id}' but the "
f"project's active integration is '{active_integration}'."
)
already: dict[tuple[str, str], str] = {}
for record in installed:
for component in record.contributed_components:
already[(component.kind, component.id)] = record.bundle_id
for component in manifest.components:
owner = already.get((component.kind, component.id))
if owner and owner != manifest.bundle.id:
report.overlaps.append(
f"{component.kind[:-1]} '{component.id}' is already provided by "
f"bundle '{owner}'."
)
return report

210
src/specify_cli/bundler/services/installer.py Normal file
View File

@@ -0,0 +1,210 @@
"""Installer: apply an :class:`InstallPlan` via existing primitive machinery.
The actual component installation (extensions, presets, steps, workflows) is
delegated to a :class:`PrimitiveInstaller` so the bundler never re-implements
primitive logic (Principle I) and integration tests can inject a deterministic,
offline fake (Principle II/IV). The real adapter dispatches in-process to the
existing extension/preset/step/workflow machinery.
Installation is idempotent and stops on first failure with no partial record
write (FR-018, SC partial-failure-stop).
"""
from __future__ import annotations
from dataclasses import dataclass, field
from pathlib import Path
from typing import Protocol
from .. import BundlerError
from ..models.manifest import BundleManifest, ComponentRef
from ..models.records import (
InstalledBundleRecord,
components_still_needed,
find_record,
load_records,
remove_record,
save_records,
upsert_record,
)
from .conflict import detect_conflicts
from .resolver import InstallPlan
class PrimitiveInstaller(Protocol):
"""Adapter over the existing Spec Kit primitive install/remove machinery."""
def is_installed(self, project_root: Path, component: ComponentRef) -> bool: ...
def install(self, project_root: Path, component: ComponentRef) -> None: ...
def remove(self, project_root: Path, component: ComponentRef) -> None: ...
@dataclass
class InstallResult:
bundle_id: str
installed: list[ComponentRef] = field(default_factory=list)
skipped: list[ComponentRef] = field(default_factory=list)
refreshed: list[ComponentRef] = field(default_factory=list)
uninstalled: list[ComponentRef] = field(default_factory=list)
@property
def changed(self) -> bool:
return bool(self.installed or self.refreshed)
def install_bundle(
project_root: Path,
plan: InstallPlan,
installer: PrimitiveInstaller,
manifest: BundleManifest | None = None,
refresh: bool = False,
) -> InstallResult:
"""Execute *plan*, recording provenance. Idempotent, with bounded rollback.
Atomicity is scoped, not global: on failure only the components newly
installed during *this* call are rolled back, and the provenance record is
written solely on full success (a failure records nothing). Components that
were already installed beforehand — including those re-applied when *refresh*
is True — are never rolled back.
When *refresh* is True (used by ``specify bundle update``), components that
are already installed are re-applied through the primitive machinery so they
are brought up to the plan's pinned versions, rather than skipped. Primitive
config (e.g. preset priority overrides) is preserved by the underlying
machinery.
Version-pin enforcement is install-time only. The primitive ``is_installed``
checks are id-based (they do not compare versions), so when a component is
already present and *refresh* is False it is skipped without verifying that
the on-disk version matches the manifest pin. Pins are therefore only
guaranteed to be applied when the bundler actually performs an install or a
refresh; running ``specify bundle update`` re-applies every owned component
at its pinned version.
"""
records = load_records(project_root)
if manifest is not None:
report = detect_conflicts(manifest, plan.effective_integration, records)
if report.has_blocking_conflict:
raise BundlerError(report.integration_clash)
result = InstallResult(bundle_id=plan.bundle_id)
existing = find_record(records, plan.bundle_id)
prior_ours = {
(c.kind, c.id) for c in existing.contributed_components
} if existing is not None else set()
# Components already attributed to a *different* installed bundle: these are
# legitimately shareable (refcounted on removal), so this bundle may also
# claim them. A component that is installed on disk but tracked by no bundle
# was installed independently and must NOT be attributed here — otherwise
# removing this bundle would uninstall it (collateral removal, FR-022).
other_tracked = {
(c.kind, c.id)
for r in records
if r.bundle_id != plan.bundle_id
for c in r.contributed_components
}
contributed: list[ComponentRef] = []
done: list[ComponentRef] = []
try:
for component in plan.components:
key = (component.kind, component.id)
if installer.is_installed(project_root, component):
# A component is "ours" only when this bundle (or a sibling
# bundle) already owns it. Independently-installed components
# are never attributed and — crucially — never refreshed, so
# ``bundle update`` cannot make collateral changes to things it
# does not own (FR-022).
owned = key in prior_ours or key in other_tracked
if refresh and owned:
_refresh_component(project_root, installer, component)
result.refreshed.append(component)
else:
result.skipped.append(component)
if owned:
contributed.append(component)
continue
installer.install(project_root, component)
done.append(component)
result.installed.append(component)
contributed.append(component)
except BundlerError:
_rollback(project_root, installer, done)
raise
except Exception as exc: # noqa: BLE001
_rollback(project_root, installer, done)
raise BundlerError(
f"Failed to install bundle '{plan.bundle_id}': {exc}. "
"No changes were recorded."
) from exc
record = InstalledBundleRecord.create(
bundle_id=plan.bundle_id,
version=plan.version,
components=contributed,
# Preserve the original install time across refresh/update so
# ``bundle list`` keeps reporting when the bundle was first installed.
installed_at=existing.installed_at if existing is not None else None,
)
save_records(project_root, upsert_record(records, record))
return result
def remove_bundle(
project_root: Path,
bundle_id: str,
installer: PrimitiveInstaller,
) -> InstallResult:
"""Remove a bundle, uninstalling only components no other bundle still needs."""
records = load_records(project_root)
target = next((r for r in records if r.bundle_id == bundle_id), None)
if target is None:
raise BundlerError(f"Bundle '{bundle_id}' is not installed.")
still_needed = components_still_needed(records, exclude_bundle_id=bundle_id)
result = InstallResult(bundle_id=bundle_id)
for component in target.contributed_components:
key = (component.kind, component.id)
if key in still_needed:
result.skipped.append(component)
continue
if installer.is_installed(project_root, component):
installer.remove(project_root, component)
result.uninstalled.append(component)
else:
result.skipped.append(component)
save_records(project_root, remove_record(records, bundle_id))
return result
def _refresh_component(
project_root: Path,
installer: PrimitiveInstaller,
component: ComponentRef,
) -> None:
"""Re-apply an already-installed component to bring it up to its pinned version.
Prefers a primitive-provided ``refresh`` hook when available; otherwise falls
back to a re-install through the existing idempotent install path.
"""
op = getattr(installer, "refresh", None)
if callable(op):
op(project_root, component)
else:
installer.install(project_root, component)
def _rollback(
project_root: Path,
installer: PrimitiveInstaller,
done: list[ComponentRef],
) -> None:
for component in reversed(done):
try:
installer.remove(project_root, component)
except Exception: # noqa: BLE001 - best-effort rollback
continue

145
src/specify_cli/bundler/services/packager.py Normal file
View File

@@ -0,0 +1,145 @@
"""Packager: produce a single versioned distributable artifact from a bundle dir.
``specify bundle build`` zips the manifest, README, and any local assets into
``<id>-<version>.zip``. Build refuses on an invalid manifest, pointing the
author to ``validate``. All file reads are confined within the bundle source
directory (Principle V path confinement).
"""
from __future__ import annotations
import os
import re
import zipfile
from dataclasses import dataclass
from pathlib import Path
from .. import BundlerError
from ..lib.yamlio import ensure_within
from ..models.manifest import BundleManifest
from .validator import validate_manifest
# Files/dirs never included in an artifact.
EXCLUDE_NAMES = {".git", "__pycache__", ".DS_Store"}
# Fixed member timestamp (zip epoch) for reproducible, byte-stable artifacts.
_FIXED_TIMESTAMP = (1980, 1, 1, 0, 0, 0)
@dataclass
class BuildResult:
artifact_path: Path
file_count: int
def build_bundle(
bundle_dir: Path,
output_dir: Path | None = None,
) -> BuildResult:
bundle_dir = Path(bundle_dir).resolve()
manifest_path = bundle_dir / "bundle.yml"
if not manifest_path.exists():
raise BundlerError(f"No bundle.yml found in '{bundle_dir}'.")
# The artifact contract requires a human-facing README.md alongside the
# manifest; refuse early rather than publish a bundle with no description.
if not (bundle_dir / "README.md").exists():
raise BundlerError(
f"No README.md found in '{bundle_dir}'. Every bundle must ship a "
"README.md describing it."
)
manifest = BundleManifest.from_file(manifest_path)
report = validate_manifest(manifest)
if not report.ok:
raise BundlerError(
"Refusing to build an invalid manifest. Run 'specify bundle validate' "
"and fix:\n - " + "\n - ".join(report.errors)
)
out_dir = Path(output_dir).resolve() if output_dir else bundle_dir
out_dir.mkdir(parents=True, exist_ok=True)
artifact_name = f"{manifest.bundle.id}-{manifest.bundle.version}.zip"
artifact_path = out_dir / artifact_name
# Defense in depth: even though validate_manifest() rejects unsafe ids, make
# sure a crafted id cannot push the artifact outside the output directory.
ensure_within(out_dir, artifact_path)
# If the output dir lives inside the bundle, skip its whole subtree so
# previously-built artifacts are never re-packaged (keeps builds
# reproducible and bounded).
skip_dir = out_dir if out_dir != bundle_dir and _is_within(bundle_dir, out_dir) else None
# Also skip any prior build artifact for this bundle (e.g. an older
# <id>-<version>.zip sitting next to bundle.yml), not just the current one.
# Match only a semver-looking version segment so legitimate assets that
# merely start with the bundle id (e.g. <id>-assets.zip) are still packaged.
artifact_re = re.compile(
rf"^{re.escape(manifest.bundle.id)}-"
r"\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?\.zip$"
)
files = _collect_files(
bundle_dir, skip=artifact_path, skip_dir=skip_dir, artifact_re=artifact_re
)
with zipfile.ZipFile(artifact_path, "w", zipfile.ZIP_DEFLATED) as archive:
for file_path in files:
# Confinement: every packaged file must live under bundle_dir.
ensure_within(bundle_dir, file_path)
arcname = file_path.relative_to(bundle_dir).as_posix()
# Fixed timestamp so identical inputs yield a byte-for-byte
# identical artifact (reproducible builds).
info = zipfile.ZipInfo(filename=arcname, date_time=_FIXED_TIMESTAMP)
info.compress_type = zipfile.ZIP_DEFLATED
# Reproducible, normalized permissions: preserve executability so
# bundled scripts (e.g. extension hook scripts) stay runnable after
# extraction, but collapse to two canonical modes (0755 when any
# execute bit is set on the source, otherwise 0644) so identical
# inputs yield a byte-for-byte identical artifact.
mode = 0o755 if file_path.stat().st_mode & 0o111 else 0o644
info.external_attr = mode << 16
archive.writestr(info, file_path.read_bytes())
return BuildResult(artifact_path=artifact_path, file_count=len(files))
def _is_within(parent: Path, child: Path) -> bool:
try:
child.relative_to(parent)
return True
except ValueError:
return False
def _collect_files(
bundle_dir: Path,
skip: Path,
skip_dir: Path | None = None,
artifact_re: re.Pattern[str] | None = None,
) -> list[Path]:
collected: list[Path] = []
# followlinks=False so a symlinked directory is never descended into,
# which would otherwise pull in out-of-tree files and then fail at
# ensure_within(). Symlinked dirs are pruned from traversal explicitly.
for root, dirnames, filenames in os.walk(bundle_dir, followlinks=False):
root_path = Path(root)
# Prune directories we must not descend into (in-place edit of dirnames).
dirnames[:] = [
d
for d in dirnames
if d not in EXCLUDE_NAMES and not (root_path / d).is_symlink()
]
if skip_dir is not None and _is_within(skip_dir, root_path):
dirnames[:] = []
continue
for name in filenames:
path = root_path / name
if path == skip:
continue
if name in EXCLUDE_NAMES:
continue
if artifact_re is not None and artifact_re.match(name):
# A prior build artifact for this bundle — never re-package it.
continue
if path.is_symlink():
# Skip symlinked files to avoid escaping the bundle directory.
continue
collected.append(path)
return sorted(collected)

345
src/specify_cli/bundler/services/primitives.py Normal file
View File

@@ -0,0 +1,345 @@
"""Bridge from bundler component kinds to existing primitive managers.
The bundler does not own install logic; it routes each component to the
existing Spec Kit primitive machinery so a bundle install behaves exactly as a
sequence of ``specify <primitive> add`` calls would (Principle I: never
reimplement or fake primitive behaviour).
Routing strategy per kind:
* **presets** / **extensions** — wired through their reusable managers
(``install_from_directory`` / ``install_from_zip``). Bundled assets shipped
with Spec Kit install fully offline; catalog assets are fetched only when
network access is permitted.
* **workflows** / **steps** — their install/remove orchestration lives in the
CLI command layer rather than a reusable service method, so the bundler
delegates to those existing command callables in-process (with the project
root as the working directory) instead of duplicating their download and
validation logic.
"""
from __future__ import annotations
import contextlib
import os
from pathlib import Path
from typing import Protocol
from .. import BundlerError
from ..models.manifest import ComponentRef
DEFAULT_PRIORITY = 10
def _assert_pinned_version(
kind: str, component_id: str, pinned: str | None, advertised: object
) -> None:
"""Refuse to install when the catalog version differs from the manifest pin.
Bundle manifests pin component versions for reproducibility; installing
whatever the active catalog currently serves would silently violate the
pin. When the catalog advertises no version we cannot enforce the pin, so
installation proceeds (the catalog, not the bundler, owns that gap).
"""
if not pinned or advertised is None:
return
actual = str(advertised).strip()
if not actual:
return
from ..lib.versioning import parse_version
try:
matches = parse_version(actual) == parse_version(pinned)
except BundlerError:
matches = actual == str(pinned).strip()
if not matches:
raise BundlerError(
f"{kind} '{component_id}' is pinned to version {pinned} in the bundle "
f"manifest, but the active catalog serves {actual}. Update the bundle's "
"pinned version or the catalog before installing."
)
class _KindManager(Protocol):
def is_installed(self, component: ComponentRef) -> bool: ...
def install(self, component: ComponentRef) -> None: ...
def remove(self, component: ComponentRef) -> None: ...
def primitive_manager(
kind: str, project_root: Path, *, allow_network: bool = True
) -> _KindManager:
if kind == "presets":
return _PresetKindManager(project_root, allow_network)
if kind == "extensions":
return _ExtensionKindManager(project_root, allow_network)
if kind == "workflows":
return _WorkflowKindManager(project_root, allow_network)
if kind == "steps":
return _StepKindManager(project_root, allow_network)
raise BundlerError(f"Unknown component kind '{kind}'.")
@contextlib.contextmanager
def _chdir(path: Path):
"""Temporarily switch the working directory.
The delegated workflow/step command callables resolve the project via
``Path.cwd()``; this makes that resolution land on *path*.
"""
previous = Path.cwd()
os.chdir(path)
try:
yield
finally:
os.chdir(previous)
def _delegate_command(action: str, label: str, call) -> None:
"""Run a delegated CLI command callable, translating its exit into errors."""
import typer
try:
call()
except typer.Exit as exc: # raised by the delegated command on failure
code = getattr(exc, "exit_code", 0) or 0
if code != 0:
raise BundlerError(f"Failed to {action} {label}.") from exc
except SystemExit as exc: # pragma: no cover - defensive
if exc.code not in (0, None):
raise BundlerError(f"Failed to {action} {label}.") from exc
class _PresetKindManager:
def __init__(self, project_root: Path, allow_network: bool) -> None:
from ...presets import PresetManager
self._root = project_root
self._allow_network = allow_network
self._manager = PresetManager(project_root)
def is_installed(self, component: ComponentRef) -> bool:
try:
return self._manager.get_pack(component.id) is not None
except Exception: # noqa: BLE001
return False
def install(self, component: ComponentRef) -> None:
from ... import get_speckit_version
from ..._assets import _locate_bundled_preset
speckit_version = get_speckit_version()
priority = DEFAULT_PRIORITY if component.priority is None else component.priority
bundled = _locate_bundled_preset(component.id)
if bundled is not None:
self._manager.install_from_directory(bundled, speckit_version, priority)
return
if not self._allow_network:
raise BundlerError(
f"Preset '{component.id}' is not bundled and network access is "
f"disabled; re-run without --offline or install it first with "
f"'specify preset add {component.id}'."
)
from ...presets import PresetCatalog
catalog = PresetCatalog(self._root)
info = catalog.get_pack_info(component.id)
if not info:
raise BundlerError(f"Preset '{component.id}' not found in any catalog.")
if not info.get("_install_allowed", True):
raise BundlerError(
f"Preset '{component.id}' is from a discovery-only catalog; "
"installation is not allowed."
)
_assert_pinned_version(
"Preset", component.id, component.version, info.get("version")
)
zip_path = catalog.download_pack(component.id)
try:
self._manager.install_from_zip(zip_path, speckit_version, priority)
finally:
with contextlib.suppress(Exception):
if zip_path.exists():
zip_path.unlink()
def remove(self, component: ComponentRef) -> None:
try:
self._manager.remove(component.id)
except Exception as exc: # noqa: BLE001
raise BundlerError(
f"Failed to remove preset '{component.id}': {exc}"
) from exc
class _ExtensionKindManager:
def __init__(self, project_root: Path, allow_network: bool) -> None:
from ...extensions import ExtensionManager
self._root = project_root
self._allow_network = allow_network
self._manager = ExtensionManager(project_root)
def is_installed(self, component: ComponentRef) -> bool:
try:
return self._manager.registry.is_installed(component.id)
except Exception: # noqa: BLE001
return False
def install(self, component: ComponentRef) -> None:
from ... import get_speckit_version
from ..._assets import _locate_bundled_extension
speckit_version = get_speckit_version()
priority = DEFAULT_PRIORITY if component.priority is None else component.priority
bundled = _locate_bundled_extension(component.id)
if bundled is not None:
self._manager.install_from_directory(
bundled, speckit_version, priority=priority
)
return
if not self._allow_network:
raise BundlerError(
f"Extension '{component.id}' is not bundled and network access is "
f"disabled; re-run without --offline or install it first with "
f"'specify extension add {component.id}'."
)
from ...extensions import ExtensionCatalog
catalog = ExtensionCatalog(self._root)
info = catalog.get_extension_info(component.id)
if not info:
raise BundlerError(
f"Extension '{component.id}' not found in any catalog."
)
if not info.get("_install_allowed", True):
raise BundlerError(
f"Extension '{component.id}' is from a discovery-only catalog; "
"installation is not allowed."
)
_assert_pinned_version(
"Extension", component.id, component.version, info.get("version")
)
zip_path = catalog.download_extension(component.id)
try:
self._manager.install_from_zip(
zip_path, speckit_version, priority=priority
)
finally:
with contextlib.suppress(Exception):
if zip_path.exists():
zip_path.unlink()
def remove(self, component: ComponentRef) -> None:
try:
self._manager.remove(component.id)
except Exception as exc: # noqa: BLE001
raise BundlerError(
f"Failed to remove extension '{component.id}': {exc}"
) from exc
class _WorkflowKindManager:
def __init__(self, project_root: Path, allow_network: bool) -> None:
from ...workflows.catalog import WorkflowRegistry
self._root = project_root
self._allow_network = allow_network
self._registry = WorkflowRegistry(project_root)
def is_installed(self, component: ComponentRef) -> bool:
try:
return self._registry.is_installed(component.id)
except Exception: # noqa: BLE001
return False
def install(self, component: ComponentRef) -> None:
if not self._allow_network and not self._is_bundled(component.id):
raise BundlerError(
f"Workflow '{component.id}' installs from a catalog and network "
f"access is disabled; re-run without --offline or install it first "
f"with 'specify workflow add {component.id}'."
)
self._assert_pinned_version(component)
from ... import workflow_add
with _chdir(self._root):
_delegate_command(
"install", f"workflow '{component.id}'",
lambda: workflow_add(component.id),
)
def _assert_pinned_version(self, component: ComponentRef) -> None:
if not component.version:
return
try:
from ...workflows.catalog import WorkflowCatalog
info = WorkflowCatalog(self._root).get_workflow_info(component.id)
except Exception: # noqa: BLE001 - catalog unreachable: cannot enforce
return
if info:
_assert_pinned_version(
"Workflow", component.id, component.version, info.get("version")
)
@staticmethod
def _is_bundled(workflow_id: str) -> bool:
# A workflow that ships with Spec Kit installs fully offline.
from ..._assets import _locate_bundled_workflow
return _locate_bundled_workflow(workflow_id) is not None
def remove(self, component: ComponentRef) -> None:
from ... import workflow_remove
with _chdir(self._root):
_delegate_command(
"remove", f"workflow '{component.id}'",
lambda: workflow_remove(component.id),
)
class _StepKindManager:
def __init__(self, project_root: Path, allow_network: bool) -> None:
from ...workflows.catalog import StepRegistry
self._root = project_root
self._allow_network = allow_network
self._registry = StepRegistry(project_root)
def is_installed(self, component: ComponentRef) -> bool:
try:
return self._registry.is_installed(component.id)
except Exception: # noqa: BLE001
return False
def install(self, component: ComponentRef) -> None:
if not self._allow_network:
raise BundlerError(
f"Step '{component.id}' installs from a catalog and network access "
f"is disabled; re-run without --offline or install it first with "
f"'specify workflow step add {component.id}'."
)
from ... import workflow_step_add
with _chdir(self._root):
_delegate_command(
"install", f"step '{component.id}'",
lambda: workflow_step_add(component.id),
)
def remove(self, component: ComponentRef) -> None:
from ... import workflow_step_remove
with _chdir(self._root):
_delegate_command(
"remove", f"step '{component.id}'",
lambda: workflow_step_remove(component.id),
)

114
src/specify_cli/bundler/services/references.py Normal file
View File

@@ -0,0 +1,114 @@
"""Resolve bundle component references against real, available components.
Used by ``specify bundle validate`` (FR-005 / SC-007) to confirm that every
declared component points at something installable. Resolution is offline-first:
a reference resolves when the component is bundled with Spec Kit or already
installed in the project; catalog sources are consulted only when network access
is permitted. Offline runs that cannot confirm a reference downgrade to a
warning rather than a false failure, while definitively-unknown references
always error.
"""
from __future__ import annotations
from pathlib import Path
from ..models.manifest import ComponentRef
def _resolved_locally(root: Path, component: ComponentRef) -> bool:
kind = component.kind
try:
if kind == "presets":
from ..._assets import _locate_bundled_preset
from ...presets import PresetManager
if _locate_bundled_preset(component.id) is not None:
return True
return PresetManager(root).get_pack(component.id) is not None
if kind == "extensions":
from ..._assets import _locate_bundled_extension
from ...extensions import ExtensionManager
if _locate_bundled_extension(component.id) is not None:
return True
return ExtensionManager(root).registry.is_installed(component.id)
if kind == "workflows":
from ..._assets import _locate_bundled_workflow
from ...workflows.catalog import WorkflowRegistry
if _locate_bundled_workflow(component.id) is not None:
return True
return WorkflowRegistry(root).is_installed(component.id)
if kind == "steps":
from ...workflows.catalog import StepRegistry
return StepRegistry(root).is_installed(component.id)
except Exception: # noqa: BLE001 - resolution is best-effort
return False
return False
def _resolved_in_catalog(root: Path, component: ComponentRef) -> bool | None:
"""Return True/False if a catalog could be consulted, or None on failure."""
kind = component.kind
try:
if kind == "presets":
from ...presets import PresetCatalog
return PresetCatalog(root).get_pack_info(component.id) is not None
if kind == "extensions":
from ...extensions import ExtensionCatalog
return ExtensionCatalog(root).get_extension_info(component.id) is not None
if kind == "workflows":
from ...workflows.catalog import WorkflowCatalog
return WorkflowCatalog(root).get_workflow_info(component.id) is not None
if kind == "steps":
from ...workflows.catalog import StepCatalog
return StepCatalog(root).get_step_info(component.id) is not None
except Exception: # noqa: BLE001 - catalog may be unreachable/misconfigured
return None
return None
def make_reference_checker(
project_root: Path,
*,
allow_network: bool,
warnings: list[str],
):
"""Build a ``ReferenceChecker`` for :func:`validate_manifest`.
Returns an error string for a reference that is definitively unresolvable,
``None`` otherwise. Unverifiable references (offline, or an unreachable
catalog) append a note to *warnings* and pass.
"""
def check(component: ComponentRef) -> str | None:
if _resolved_locally(project_root, component):
return None
if allow_network:
in_catalog = _resolved_in_catalog(project_root, component)
if in_catalog is True:
return None
if in_catalog is False:
return (
f"{component.kind[:-1]} '{component.id}' is not bundled, "
"installed, or present in any active catalog."
)
warnings.append(
f"Could not verify {component.kind[:-1]} '{component.id}' "
"(catalog unreachable); reference left unchecked."
)
return None
warnings.append(
f"Could not verify {component.kind[:-1]} '{component.id}' offline "
"(not bundled or installed); re-run validate online to check catalogs."
)
return None
return check

122
src/specify_cli/bundler/services/resolver.py Normal file
View File

@@ -0,0 +1,122 @@
"""Resolver: expand a bundle manifest into a concrete, ordered install plan.
The plan the resolver produces is the single source of truth shared by
``info`` (preview) and ``install`` (execution) so the two never diverge
(SC-002 transparency). Resolution also enforces the SpecKit version gate
(FR-016) and the integration-compatibility check (FR-019).
"""
from __future__ import annotations
from dataclasses import dataclass, field
from pathlib import Path
from .. import BundlerError
from ..lib.versioning import satisfies
from ..models.manifest import BundleManifest, ComponentRef
@dataclass
class InstallPlan:
bundle_id: str
version: str
role: str
effective_integration: str | None
components: list[ComponentRef] = field(default_factory=list)
warnings: list[str] = field(default_factory=list)
@property
def component_count(self) -> int:
return len(self.components)
def grouped(self) -> dict[str, list[ComponentRef]]:
groups: dict[str, list[ComponentRef]] = {
"extensions": [],
"presets": [],
"steps": [],
"workflows": [],
}
for component in self.components:
groups.setdefault(component.kind, []).append(component)
return groups
def resolve_install_plan(
manifest: BundleManifest,
*,
speckit_version: str,
active_integration: str | None,
integration_explicit: bool = False,
enforce_version: bool = True,
) -> InstallPlan:
"""Expand *manifest* into an :class:`InstallPlan`, enforcing gates.
Raises :class:`BundlerError` when a hard gate fails (version gate,
integration clash). Soft issues are collected in ``plan.warnings``.
*integration_explicit* signals that ``active_integration`` came from an
explicit ``--integration`` override rather than project auto-detection. When
a bundle pins an integration but the project's active integration cannot be
determined (``active_integration is None``) and the caller did not supply an
explicit override, resolution fails instead of silently adopting the
bundle's required integration (FR-019 guard).
"""
structural = manifest.structural_errors()
if structural:
raise BundlerError(
"Cannot resolve an invalid manifest:\n - " + "\n - ".join(structural)
)
# FR-016: SpecKit version gate — refuse incompatible installs.
if enforce_version and manifest.requires.speckit_version:
if not satisfies(speckit_version, manifest.requires.speckit_version):
raise BundlerError(
f"Bundle '{manifest.bundle.id}' requires Spec Kit "
f"{manifest.requires.speckit_version}, but this project uses "
f"{speckit_version}. Update Spec Kit or choose a compatible bundle."
)
# FR-019: integration-compatibility — a bundle that pins a different
# integration than the project's active one halts (no silent change).
effective_integration = active_integration
if manifest.integration is not None:
required = manifest.integration.id
if active_integration and required != active_integration:
raise BundlerError(
f"Bundle '{manifest.bundle.id}' targets integration '{required}', "
f"but this project's active integration is '{active_integration}'. "
"Installing it would conflict; aborting with no changes."
)
if active_integration is None and not integration_explicit:
raise BundlerError(
f"Bundle '{manifest.bundle.id}' targets integration '{required}', "
"but this project's active integration could not be determined "
"(missing or unreadable .specify/integration.json). Re-run with "
"'--integration' to confirm the target, or repair the project "
"before installing."
)
effective_integration = required
warnings: list[str] = []
if manifest.requires.tools:
warnings.append(
"Requires external tools: " + ", ".join(manifest.requires.tools)
)
if manifest.requires.mcp:
warnings.append("Requires MCP servers: " + ", ".join(manifest.requires.mcp))
return InstallPlan(
bundle_id=manifest.bundle.id,
version=manifest.bundle.version,
role=manifest.bundle.role,
effective_integration=effective_integration,
components=list(manifest.components),
warnings=warnings,
)
def load_manifest_from_dir(bundle_dir: Path) -> BundleManifest:
"""Load ``bundle.yml`` from a bundle directory."""
manifest_path = Path(bundle_dir) / "bundle.yml"
if not manifest_path.exists():
raise BundlerError(f"No bundle.yml found in '{bundle_dir}'.")
return BundleManifest.from_file(manifest_path)

60
src/specify_cli/bundler/services/validator.py Normal file
View File

@@ -0,0 +1,60 @@
"""Validator: structural + reference validation for a bundle manifest.
``specify bundle validate`` reports whether a manifest is well-formed and all
component references are resolvable. Structural checks come from the manifest
model; reference resolution is optional (requires a resolver callback) so the
command can run fully offline against pinned/local references.
"""
from __future__ import annotations
from dataclasses import dataclass, field
from typing import Callable
from .. import BundlerError
from ..lib.versioning import parse_constraint
from ..models.manifest import BundleManifest, ComponentRef
# A reference checker returns None when resolvable, or an error string.
ReferenceChecker = Callable[[ComponentRef], str | None]
@dataclass
class ValidationReport:
errors: list[str] = field(default_factory=list)
warnings: list[str] = field(default_factory=list)
@property
def ok(self) -> bool:
return not self.errors
def merge(self, other: "ValidationReport") -> None:
self.errors.extend(other.errors)
self.warnings.extend(other.warnings)
def validate_manifest(
manifest: BundleManifest,
reference_checker: ReferenceChecker | None = None,
) -> ValidationReport:
report = ValidationReport()
report.errors.extend(manifest.structural_errors())
if manifest.requires.speckit_version:
try:
parse_constraint(manifest.requires.speckit_version)
except BundlerError as exc:
report.errors.append(
f"requires.speckit_version '{manifest.requires.speckit_version}' "
f"is not a valid constraint: {exc}"
)
if reference_checker is not None:
for component in manifest.components:
problem = reference_checker(component)
if problem:
report.errors.append(
f"Unresolved reference {component.label()}: {problem}"
)
return report

834
src/specify_cli/commands/bundle/__init__.py Normal file
View File

@@ -0,0 +1,834 @@
"""``specify bundle`` command group — discover, install, author Spec Kit bundles.
This module is the CLI/UX layer only (Principle I: thin commands over services).
Each command resolves a project, builds a catalog stack, delegates to a bundler
service, and renders Rich output. ``--json`` emits machine-readable data on
stdout; human logs go to stderr/console.
"""
from __future__ import annotations
import json as _json
import re
from pathlib import Path
import typer
from ..._console import console
from ...bundler import BundlerError
from ...bundler.lib.project import (
active_integration,
find_project_root,
require_project_root,
)
from ...bundler.models.records import load_records
bundle_app = typer.Typer(
name="bundle",
help="Discover, install, and author Spec Kit bundles",
add_completion=False,
)
bundle_catalog_app = typer.Typer(
name="catalog",
help="Manage bundle catalog sources",
add_completion=False,
)
bundle_app.add_typer(bundle_catalog_app, name="catalog")
# ===== helpers =====
def _fail(message: str) -> None:
"""Print an actionable error to stderr and exit non-zero."""
console.print(f"[red]Error:[/red] {message}", style=None)
raise typer.Exit(code=1)
def _user_config_dir() -> Path:
# User-scope Spec Kit config lives under ~/.specify (same convention as
# auth.json, extension/preset catalogs). Passing this through to the source
# stack is what makes the documented project > user > built-in precedence
# reachable from the CLI.
return Path.home() / ".specify"
def _build_stack(project_root: Path, *, offline: bool):
from ...bundler.services.adapters import make_catalog_fetcher
from ...bundler.services.catalog_stack import CatalogStack
fetcher = make_catalog_fetcher(allow_network=not offline)
return CatalogStack.load(project_root, fetcher, user_config_dir=_user_config_dir())
def _speckit_version() -> str:
from ..._assets import get_speckit_version
return get_speckit_version()
def _trust_level(verified: bool) -> str:
"""Trust framing for a catalog entry (FR-010): org-curated vs community."""
return "verified" if verified else "community"
def _trust_badge(verified: bool) -> str:
return (
"[green]✔ verified[/green]"
if verified
else "[yellow]community[/yellow]"
)
def _default_script_type() -> str:
"""OS-appropriate default script flavor (FR-013)."""
import os
return "ps" if os.name == "nt" else "sh"
def _run_init(integration: str, *, script_type: str, offline: bool = False) -> None:
"""Idempotently scaffold a Spec Kit project here via the existing ``init`` machinery.
Reuses the real ``specify init`` command callback in-process (Principle I)
with ``--here --force`` so it is non-interactive and merges into the current
directory.
"""
from ... import app
init_cb = next(
c.callback
for c in app.registered_commands
if c.callback and c.callback.__name__ == "init"
)
try:
init_cb(
project_name=None,
script_type=script_type,
ignore_agent_tools=True,
here=True,
force=True,
skip_tls=False,
debug=False,
github_token=None,
offline=offline,
preset=None,
integration=integration,
integration_options=None,
)
except typer.Exit as exc:
if exc.exit_code:
raise BundlerError(
f"Failed to initialize a Spec Kit project (integration '{integration}')."
) from exc
def _resolve_init_integration(override: str | None, manifest) -> str:
"""Precedence (FR-013): explicit override → bundle-declared → default."""
from ..._agent_config import DEFAULT_INIT_INTEGRATION
if override:
return override
if manifest is not None and manifest.integration is not None:
return manifest.integration.id
return DEFAULT_INIT_INTEGRATION
# ===== Consume =====
@bundle_app.command("search")
def bundle_search(
query: str = typer.Argument("", help="Optional text query"),
offline: bool = typer.Option(False, "--offline", help="Do not access the network"),
as_json: bool = typer.Option(False, "--json", help="Emit JSON to stdout"),
) -> None:
"""List matching bundles across the active catalog stack."""
try:
project_root = find_project_root() or Path.cwd()
stack = _build_stack(project_root, offline=offline)
results = stack.search(query)
except BundlerError as exc:
_fail(str(exc))
return
if as_json:
payload = [
{
"id": r.entry.id,
"name": r.entry.name,
"role": r.entry.role,
"version": r.entry.version,
"description": r.entry.description,
"source": r.source.id,
"install_policy": r.source.install_policy.value,
"verified": r.entry.verified,
"trust": _trust_level(r.entry.verified),
}
for r in results
]
print(_json.dumps(payload, indent=2))
return
if not results:
console.print("[yellow]No matching bundles found.[/yellow]")
return
console.print("\n[bold cyan]Bundles:[/bold cyan]\n")
for r in results:
policy = (
"[dim](discovery-only)[/dim]"
if not r.source.install_allowed
else ""
)
console.print(
f" [bold]{r.entry.id}[/bold] v{r.entry.version} — {r.entry.name} "
f"[dim]({r.entry.role})[/dim] {_trust_badge(r.entry.verified)} {policy}"
)
console.print(f" {r.entry.description}")
console.print(f" [dim]source: {r.source.id}[/dim]")
@bundle_app.command("info")
def bundle_info(
bundle_id: str = typer.Argument(..., help="Bundle id to inspect"),
offline: bool = typer.Option(False, "--offline", help="Do not access the network"),
as_json: bool = typer.Option(False, "--json", help="Emit JSON to stdout"),
) -> None:
"""Show full metadata and the fully expanded component set (== what install adds)."""
try:
project_root = find_project_root() or Path.cwd()
stack = _build_stack(project_root, offline=offline)
resolved = stack.resolve(bundle_id)
# `info` must show the fully expanded component set that `install` would
# apply (contracts/cli-commands.md). Expansion happens regardless of
# install policy — discovery-only bundles stay inspectable; only
# `install` is refused. But if the manifest itself can't be resolved
# (e.g. --offline against an https:// download_url, or a download
# failure), fail loudly and exit non-zero rather than silently
# degrading to catalog `provides` counts, so users never mistake an
# unverifiable bundle for a known/installable one.
manifest = _download_manifest(resolved, offline=offline)
except BundlerError as exc:
_fail(str(exc))
return
overlaps = _bundle_overlaps(project_root, manifest, offline=offline)
components = _manifest_component_view(manifest)
entry = resolved.entry
if as_json:
payload = {
"id": entry.id,
"name": entry.name,
"version": entry.version,
"role": entry.role,
"description": entry.description,
"author": entry.author,
"license": entry.license,
"source": resolved.source.id,
"install_policy": resolved.source.install_policy.value,
"provides": entry.provides,
"requires": {"speckit_version": entry.requires_speckit_version},
"verified": entry.verified,
"trust": _trust_level(entry.verified),
"integration": (manifest.integration.id if manifest and manifest.integration else None),
"components": components,
"overlaps": overlaps,
}
print(_json.dumps(payload, indent=2))
return
console.print(f"\n[bold cyan]{entry.id}[/bold cyan] v{entry.version} — {entry.name}")
console.print(f" Role: {entry.role}")
console.print(f" {entry.description}")
console.print(f" Author: {entry.author} License: {entry.license}")
console.print(f" Source: {resolved.source.id} ({resolved.source.install_policy.value})")
console.print(f" Trust: {_trust_badge(entry.verified)}")
if entry.requires_speckit_version:
console.print(f" Requires Spec Kit: {entry.requires_speckit_version}")
if manifest and manifest.integration:
console.print(f" Integration: {manifest.integration.id}")
if components:
console.print("\n [bold]Components[/bold] (added on install):")
for kind in ("extensions", "presets", "steps", "workflows"):
items = [c for c in components if c["kind"] == kind]
if not items:
continue
console.print(f" [bold]{kind}:[/bold]")
for item in items:
console.print(f" - {_format_component(item)}")
else:
console.print("\n [bold]Provides:[/bold]")
for kind in ("extensions", "presets", "steps", "workflows"):
count = entry.provides.get(kind, 0)
if count:
console.print(f" {kind}: {count}")
if overlaps:
console.print("\n [yellow]Overlaps with already-installed bundles:[/yellow]")
for overlap in overlaps:
console.print(f" [yellow]-[/yellow] {overlap}")
if not resolved.install_allowed:
console.print(
"\n [yellow]This source is discovery-only; the bundle cannot be "
"installed from here.[/yellow]"
)
@bundle_app.command("list")
def bundle_list(
as_json: bool = typer.Option(False, "--json", help="Emit JSON to stdout"),
) -> None:
"""List bundles currently installed in the project with versions."""
try:
project_root = require_project_root()
records = load_records(project_root)
except BundlerError as exc:
_fail(str(exc))
return
if as_json:
print(_json.dumps([r.to_dict() for r in records], indent=2))
return
if not records:
console.print("[yellow]No bundles installed.[/yellow]")
console.print("\nInstall one with: [cyan]specify bundle install <id>[/cyan]")
return
console.print("\n[bold cyan]Installed bundles:[/bold cyan]\n")
for record in records:
console.print(
f" [bold]{record.bundle_id}[/bold] v{record.version} "
f"[dim]({len(record.contributed_components)} components, "
f"installed {record.installed_at})[/dim]"
)
@bundle_app.command("install")
def bundle_install(
bundle_id: str = typer.Argument(
...,
help="Bundle id (from the catalog stack) or a local path to a .zip "
"artifact, bundle directory, or bundle.yml",
),
integration: str = typer.Option(None, "--integration", help="Override integration"),
offline: bool = typer.Option(False, "--offline", help="Do not access the network"),
) -> None:
"""Install a bundle's full component set through each primitive's machinery.
``bundle_id`` may be a catalog bundle id, or a local path to a built
artifact (``.zip``), a bundle directory, or a ``bundle.yml`` file. Local
sources install directly without consulting the catalog stack.
"""
try:
from ...bundler.lib.project import find_project_root
from ...bundler.services.adapters import DefaultPrimitiveInstaller
from ...bundler.services.installer import install_bundle
from ...bundler.services.resolver import resolve_install_plan
project_root = find_project_root()
local_manifest = _local_manifest_source(bundle_id)
if local_manifest is not None:
manifest = local_manifest
else:
stack = _build_stack(project_root or Path.cwd(), offline=offline)
resolved = stack.resolve(bundle_id)
if not resolved.install_allowed:
raise BundlerError(
f"Bundle '{bundle_id}' resolves only from a discovery-only source "
f"('{resolved.source.id}'); it cannot be installed from there."
)
manifest = _download_manifest(resolved, offline=offline)
if project_root is None:
init_integration = _resolve_init_integration(integration, manifest)
console.print(
f"[cyan]No Spec Kit project here; initializing with integration "
f"'{init_integration}'…[/cyan]"
)
_run_init(init_integration, script_type=_default_script_type(), offline=offline)
project_root = require_project_root()
for overlap in _bundle_overlaps(project_root, manifest, offline=offline):
console.print(f"[yellow]![/yellow] {overlap}")
# For an already-initialized project, the project's recorded active
# integration is authoritative — an explicit --integration must not be
# able to bypass the FR-019 integration-clash guard. The override only
# selects the integration at init time (handled above) or confirms the
# target when the active integration cannot be determined.
detected = active_integration(project_root)
plan = resolve_install_plan(
manifest,
speckit_version=_speckit_version(),
active_integration=detected if detected is not None else integration,
integration_explicit=bool(integration) and detected is None,
)
for warning in plan.warnings:
console.print(f"[yellow]![/yellow] {warning}")
result = install_bundle(
project_root,
plan,
DefaultPrimitiveInstaller(allow_network=not offline),
manifest=manifest,
)
except BundlerError as exc:
_fail(str(exc))
return
console.print(
f"[green]✓[/green] Installed '{result.bundle_id}' "
f"({len(result.installed)} added, {len(result.skipped)} already present)."
)
@bundle_app.command("update")
def bundle_update(
bundle_id: str = typer.Argument(None, help="Bundle id, or omit with --all"),
all_bundles: bool = typer.Option(False, "--all", help="Update every installed bundle"),
integration: str = typer.Option(None, "--integration", help="Override integration"),
offline: bool = typer.Option(False, "--offline", help="Do not access the network"),
) -> None:
"""Re-resolve and refresh a bundle's components via each primitive's update path."""
try:
project_root = require_project_root()
records = load_records(project_root)
if not all_bundles and not bundle_id:
raise BundlerError("Specify a bundle id or use --all.")
targets = (
[r.bundle_id for r in records]
if all_bundles
else [bundle_id]
)
if not targets:
console.print("[yellow]No installed bundles to update.[/yellow]")
return
stack = _build_stack(project_root, offline=offline)
from ...bundler.services.adapters import DefaultPrimitiveInstaller
from ...bundler.services.installer import install_bundle
from ...bundler.services.resolver import resolve_install_plan
installer = DefaultPrimitiveInstaller(allow_network=not offline)
for target in targets:
if not any(r.bundle_id == target for r in records):
raise BundlerError(f"Bundle '{target}' is not installed.")
resolved = stack.resolve(target)
if not resolved.install_allowed:
raise BundlerError(
f"Bundle '{target}' resolves only from a discovery-only source "
f"('{resolved.source.id}'); it cannot be updated from there. "
"Update requires an install-allowed source (FR-025)."
)
manifest = _download_manifest(resolved, offline=offline)
detected = active_integration(project_root)
plan = resolve_install_plan(
manifest,
speckit_version=_speckit_version(),
active_integration=detected if detected is not None else integration,
integration_explicit=bool(integration) and detected is None,
)
install_bundle(project_root, plan, installer, manifest=manifest, refresh=True)
console.print(f"[green]✓[/green] Updated '{target}' to v{plan.version}.")
except BundlerError as exc:
_fail(str(exc))
return
@bundle_app.command("remove")
def bundle_remove(
bundle_id: str = typer.Argument(..., help="Installed bundle id to remove"),
) -> None:
"""Uninstall only the components this bundle contributed (no collateral removals)."""
try:
project_root = require_project_root()
from ...bundler.services.adapters import DefaultPrimitiveInstaller
from ...bundler.services.installer import remove_bundle
result = remove_bundle(project_root, bundle_id, DefaultPrimitiveInstaller())
except BundlerError as exc:
_fail(str(exc))
return
console.print(
f"[green]✓[/green] Removed '{result.bundle_id}' "
f"({len(result.uninstalled)} uninstalled, {len(result.skipped)} kept for other bundles)."
)
# ===== Author =====
@bundle_app.command("validate")
def bundle_validate(
path: Path = typer.Option(
None, "--path", help="Bundle directory or bundle.yml (default: cwd)"
),
offline: bool = typer.Option(
False,
"--offline",
help="Do not access catalogs; verify references against bundled/installed only",
),
) -> None:
"""Report whether the manifest is well-formed and references resolve."""
try:
manifest_path = _resolve_manifest_path(path)
from ...bundler.lib.project import find_project_root
from ...bundler.models.manifest import BundleManifest
from ...bundler.services.references import make_reference_checker
from ...bundler.services.validator import validate_manifest
manifest = BundleManifest.from_file(manifest_path)
ref_root = find_project_root(manifest_path.parent) or Path.cwd()
ref_warnings: list[str] = []
checker = make_reference_checker(
ref_root, allow_network=not offline, warnings=ref_warnings
)
report = validate_manifest(manifest, reference_checker=checker)
report.warnings.extend(ref_warnings)
except BundlerError as exc:
_fail(str(exc))
return
for warning in report.warnings:
console.print(f"[yellow]![/yellow] {warning}")
if not report.ok:
console.print("[red]Manifest is invalid:[/red]")
for error in report.errors:
console.print(f" [red]-[/red] {error}")
raise typer.Exit(code=1)
console.print(f"[green]✓[/green] {manifest.bundle.id} is well-formed and valid.")
@bundle_app.command("build")
def bundle_build(
path: Path = typer.Option(
None, "--path", help="Bundle directory (default: cwd)"
),
output: Path = typer.Option(None, "--output", help="Output directory for the artifact"),
) -> None:
"""Produce a single versioned distributable artifact (.zip)."""
try:
bundle_dir = (path or Path.cwd()).resolve()
if bundle_dir.is_file():
bundle_dir = bundle_dir.parent
from ...bundler.services.packager import build_bundle
result = build_bundle(bundle_dir, output_dir=output)
except BundlerError as exc:
_fail(str(exc))
return
console.print(
f"[green]✓[/green] Built {result.artifact_path.name} "
f"({result.file_count} files) → {result.artifact_path}"
)
@bundle_app.command("init")
def bundle_init(
bundle: str = typer.Argument(None, help="Optional bundle to install after init"),
integration: str = typer.Option(None, "--integration", help="Integration override"),
offline: bool = typer.Option(False, "--offline", help="Do not access the network"),
) -> None:
"""Ensure the project is initialized (idempotent), then optionally install a bundle."""
from ...bundler.lib.project import find_project_root
try:
project_root = find_project_root()
if project_root is None:
init_integration = _resolve_init_integration(integration, None)
console.print(
f"[cyan]Initializing a Spec Kit project with integration "
f"'{init_integration}'…[/cyan]"
)
_run_init(init_integration, script_type=_default_script_type(), offline=offline)
project_root = require_project_root()
except BundlerError as exc:
_fail(str(exc))
return
console.print(f"[green]✓[/green] Spec Kit project ready at {project_root}.")
if bundle:
bundle_install(bundle, integration=integration, offline=offline)
# ===== Catalog management =====
@bundle_catalog_app.command("list")
def catalog_list() -> None:
"""Print the active, priority-ordered catalog stack with scope and policy."""
try:
project_root = require_project_root()
from ...bundler.models.catalog import Scope, load_source_stack
sources = load_source_stack(project_root, user_config_dir=_user_config_dir())
except BundlerError as exc:
_fail(str(exc))
return
console.print("\n[bold cyan]Catalog stack[/bold cyan] (highest precedence first):\n")
only_builtin = all(s.scope == Scope.BUILTIN for s in sources)
for source in sources:
console.print(
f" [bold]{source.id}[/bold] priority={source.priority} "
f"policy={source.install_policy.value} scope={source.scope.value}"
)
console.print(f" [dim]{source.url}[/dim]")
if only_builtin:
console.print("\n[dim]Using the built-in default stack.[/dim]")
@bundle_catalog_app.command("add")
def catalog_add(
url: str = typer.Argument(..., help="Catalog URL"),
policy: str = typer.Option(
"install-allowed", "--policy", help="install-allowed | discovery-only"
),
priority: int = typer.Option(10, "--priority", help="Source priority (lower = higher)"),
source_id: str = typer.Option(None, "--id", help="Explicit source id"),
) -> None:
"""Register a project-scoped catalog source and persist it."""
try:
project_root = require_project_root()
from ...bundler.commands_impl.catalog_config import add_source
source = add_source(project_root, url, policy=policy, priority=priority, source_id=source_id)
except BundlerError as exc:
_fail(str(exc))
return
console.print(
f"[green]✓[/green] Added catalog '{source.id}' "
f"(priority {source.priority}, {source.install_policy.value})."
)
@bundle_catalog_app.command("remove")
def catalog_remove(
id_or_url: str = typer.Argument(..., help="Source id or url to remove"),
) -> None:
"""Remove a project-scoped catalog source (built-in defaults can't be deleted)."""
try:
project_root = require_project_root()
from ...bundler.commands_impl.catalog_config import remove_source
removed = remove_source(project_root, id_or_url)
except BundlerError as exc:
_fail(str(exc))
return
console.print(f"[green]✓[/green] Removed catalog source '{removed}'.")
# ===== internal helpers =====
def _manifest_component_view(manifest) -> list[dict]:
"""Flatten a manifest's components to JSON-friendly dicts (id, version, ...)."""
if manifest is None:
return []
view: list[dict] = []
for component in manifest.components:
item = {
"kind": component.kind,
"id": component.id,
"version": component.version,
}
if component.priority is not None:
item["priority"] = component.priority
if component.strategy is not None:
item["strategy"] = component.strategy
view.append(item)
return view
def _format_component(item: dict) -> str:
label = f"{item['id']} v{item['version']}" if item.get("version") else item["id"]
extras = []
if item.get("priority") is not None:
extras.append(f"priority={item['priority']}")
if item.get("strategy") is not None:
extras.append(f"strategy={item['strategy']}")
if extras:
label += f" ({', '.join(extras)})"
return label
def _bundle_overlaps(project_root: Path, manifest, *, offline: bool) -> list[str]:
"""Return informational overlaps between *manifest* and installed bundles."""
if manifest is None:
return []
try:
from ...bundler.services.conflict import detect_conflicts
report = detect_conflicts(
manifest,
active_integration(project_root),
load_records(project_root),
)
return list(report.overlaps)
except BundlerError:
return []
def _local_manifest_source(arg: str):
"""Return a :class:`BundleManifest` if *arg* points at a local bundle.
Supports a built ``.zip`` artifact, a bundle directory, or a ``bundle.yml``
file. Returns ``None`` when *arg* is not an existing path, so callers fall
back to catalog-stack resolution by bundle id.
"""
from ...bundler.models.manifest import BundleManifest
candidate = Path(arg).expanduser()
if not candidate.exists():
return None
if candidate.is_dir():
manifest_path = candidate / "bundle.yml"
if not manifest_path.exists():
raise BundlerError(f"No bundle.yml found in '{candidate}'.")
return BundleManifest.from_file(manifest_path)
if candidate.suffix == ".zip":
import io
import zipfile
import yaml as _yaml
with zipfile.ZipFile(candidate) as archive:
try:
raw = archive.read("bundle.yml")
except KeyError as exc:
raise BundlerError(
f"Artifact '{candidate}' does not contain a bundle.yml."
) from exc
data = _yaml.safe_load(io.BytesIO(raw))
return BundleManifest.from_dict(data)
if candidate.name == "bundle.yml" or candidate.suffix in (".yml", ".yaml"):
return BundleManifest.from_file(candidate)
raise BundlerError(
f"'{candidate}' is not a recognised bundle source (.zip artifact, bundle "
"directory, or bundle.yml)."
)
def _resolve_manifest_path(path: Path | None) -> Path:
target = (path or Path.cwd()).resolve()
if target.is_dir():
target = target / "bundle.yml"
if not target.exists():
raise BundlerError(f"No bundle.yml found at '{target}'.")
return target
def _download_manifest(resolved, *, offline: bool):
"""Resolve a bundle's manifest from its catalog ``download_url``.
Local/``file://`` URLs always work offline and may point at a ``.zip``
artifact, a bundle directory, or a ``bundle.yml`` (handled by
:func:`_local_manifest_source`). Remote ``https://`` URLs are fetched with
the shared authenticated, redirect-validated HTTP client, and only when not
``--offline``.
"""
from urllib.parse import urlparse
url = resolved.entry.download_url
if not url:
raise BundlerError(
f"Catalog entry '{resolved.entry.id}' has no download_url; cannot resolve "
"its manifest."
)
parsed = urlparse(url)
scheme = parsed.scheme.lower()
# On Windows an absolute path like ``C:\bundle.yml`` parses with a
# single-letter ``scheme``; treat it as a local file, not a URL scheme.
if scheme in ("", "file") or re.match(r"^[A-Za-z]:[\\/]", url):
local = Path(parsed.path if scheme == "file" else url)
manifest = _local_manifest_source(str(local))
if manifest is None:
raise BundlerError(f"Bundle manifest not found: {local}")
return manifest
if scheme in ("http", "https"):
if offline:
raise BundlerError(
f"Network access disabled; cannot download bundle '{resolved.entry.id}' "
f"from {url}."
)
return _download_remote_manifest(resolved.entry.id, url)
raise BundlerError(
f"Unsupported download_url scheme for bundle '{resolved.entry.id}': {url}"
)
def _require_https(label: str, url: str) -> None:
from urllib.parse import urlparse
parsed = urlparse(url)
is_localhost = parsed.hostname in ("localhost", "127.0.0.1", "::1")
if parsed.scheme != "https" and not (parsed.scheme == "http" and is_localhost):
raise BundlerError(
f"Refusing to download {label} over non-HTTPS URL: {url}"
)
if not parsed.hostname:
raise BundlerError(f"Refusing to download {label} from URL with no host: {url}")
def _download_remote_manifest(entry_id: str, url: str):
"""Fetch a remote bundle artifact over HTTPS and extract its manifest."""
import io
import tempfile
from ...authentication.http import open_url
def _validate_redirect(old_url: str, new_url: str) -> None:
_require_https(f"bundle '{entry_id}'", new_url)
_require_https(f"bundle '{entry_id}'", url)
try:
with open_url(url, timeout=30, redirect_validator=_validate_redirect) as resp:
_require_https(f"bundle '{entry_id}'", resp.geturl())
raw = resp.read()
except BundlerError:
raise
except Exception as exc: # noqa: BLE001
raise BundlerError(f"Failed to download bundle '{entry_id}' from {url}: {exc}") from exc
# A .zip artifact is written to a temp file and parsed via the local-source
# path (which extracts bundle.yml); any other payload is treated as YAML.
if url.lower().endswith(".zip"):
with tempfile.TemporaryDirectory() as tmp:
artifact = Path(tmp) / "bundle.zip"
artifact.write_bytes(raw)
manifest = _local_manifest_source(str(artifact))
if manifest is None:
raise BundlerError(
f"Downloaded artifact for bundle '{entry_id}' is not a valid bundle."
)
return manifest
import yaml as _yaml
from ...bundler.models.manifest import BundleManifest
data = _yaml.safe_load(io.BytesIO(raw))
return BundleManifest.from_dict(data)
def register(app: typer.Typer) -> None:
"""Attach the bundle command group to the root Typer app."""
app.add_typer(bundle_app, name="bundle")