Skip to content

[Bug]: integration: mapping without an id makes a bundle silently integration-agnostic #5091

Closed

Description

@hnipps

Bug Description

BundleManifest.from_dict rejects a non-mapping integration value because otherwise the bundle would be left "wrongly integration-agnostic" (comment at src/specify_cli/bundles/manifest.py:127-130). A mapping with a missing, empty or misspelt id (for example {name: claude} or {}) still falls through to integration = None (manifest.py:132), and specify bundle validate reports the manifest as valid.

Steps to Reproduce

From the root of a fresh clone after uv sync, save the script below as repro.py and run uv run python -I repro.py.

import os, subprocess, tempfile
from pathlib import Path

work = Path(tempfile.mkdtemp())
base = ('schema_version: "1.0"\n'
        'bundle: {id: demo, name: D, version: "1.0.0", role: dev, description: d, author: a, license: MIT}\n'
        'requires: {speckit_version: ">=0.1.0"}\n')
env = {"PATH": os.environ["PATH"], "HOME": str(work), "COLUMNS": "200"}
for integration in ("claude", "{name: claude}", "{}"):
    bundle = work / f"b{len(list(work.iterdir()))}"; bundle.mkdir()
    (bundle / "bundle.yml").write_text(base + f"integration: {integration}\n")
    run = subprocess.run(["specify", "bundle", "validate", "--path", str(bundle), "--offline"],
                         capture_output=True, text=True, env=env)
    last = [l for l in (run.stdout + run.stderr).splitlines() if l.strip()][-1]
    print(f"integration: {integration:<16} -> exit {run.returncode}: {last}")

Expected Behavior

integration: {name: claude} and integration: {} should be reported as invalid, in the same way as integration: claude. The guard at manifest.py:127-130 was written to stop a declared integration from being dropped silently.

Actual Behavior

integration: claude           -> exit 1: Error: 'integration' must be a mapping when present.
integration: {name: claude}   -> exit 0: ✓ demo is well-formed and valid.
integration: {}               -> exit 0: ✓ demo is well-formed and valid.

Specify CLI Version

1.2.4.dev0 (main at 27d14e2)

AI Agent

Not applicable

Operating System

Linux 6.18 (Ubuntu container)

Python Version

Python 3.12.3

Additional Context

None.

Also reproduced on macOS (Darwin 25.6, arm64) with Python 3.14.4 and uv run python -I repro.py against 27d14e2; the output matches the above.

AI Disclosure

Found and reproduced with Claude Code (model: Claude Opus 4.8), run autonomously under human supervision. The human reporter re-ran every reproduction above before filing.

Activity

  1. added
    triage-can-waitVerdict: valid and in-scope but deprioritized; held behind the evidence gate
    on Oct 23, 2026
  2. mirzasnowy commented on Oct 28, 2026

    @mirzasnowy
    Contributor

    Hi, I'd like to take this one. Plan: in BundleManifest.from_dict, reject an integration mapping that lacks a non-empty id (same guard style as the existing non-mapping rejection), so validate reports it invalid instead of silently dropping the declared integration. Adding regression tests for the rejected shapes plus the accepted/absent cases.

  3. added a commit that references this issue on Oct 28, 2026
    b1cca72
  4. added a commit that references this issue on Oct 28, 2026
    b0edc22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    triage-can-waitVerdict: valid and in-scope but deprioritized; held behind the evidence gate

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions