[mnriem]

Description

Require the entire extension ID to match the documented lowercase alphanumeric-and-hyphen format. Replacing the anchored re.match with re.fullmatch prevents a trailing newline from being accepted.

Expand invalid-ID coverage to include trailing and embedded newlines, surrounding whitespace, empty IDs, and traversal-shaped input. Valid extension IDs retain their existing behavior.

Testing

• Tested locally with uv run specify --help
• Ran existing tests with uv sync && uv run pytest
• Tested with a sample project (if applicable)

Used the documented worktree-local interpreter rather than bare uv run pytest:

• uv sync --extra test --quiet — passed.
• uv run specify --help — passed.
• .venv/bin/python -m pytest tests/test_extensions.py -q — passed, 493 tests.
• LC_ALL=en_US.UTF-8 .venv/bin/python -m pytest tests -q — passed, 13,668 passed, 130 skipped, 63 warnings.
• git diff --check — passed.

Sample-project and agent slash-command testing are not applicable: this change only tightens extension manifest ID validation.

AI Disclosure

• I did not use AI assistance for this contribution
• I did use AI assistance (fill in the disclosure below)

AI disclosure: GitHub Copilot using GPT-6.1 Sol, with default reasoning settings and autonomous execution under user direction, assessed the validation issue, generated the fix and tests, ran validation, and prepared the commit and pull request. The assessment also used Copilot's security-review subagent with its runtime-default model; that model identity was not reported.

[Copilot]

🟡 Changes recommended

A critical active finding remains: an anchored .match() path can allow a catalog ID ending in a newline to reach the suggested command, undermining the shell-safety guarantee.

1 open issue

• Use full-match validation for untrusted extension IDs · New

What changed in this PR

This PR tightens extension ID validation to require the entire value to match the documented lowercase alphanumeric-and-hyphen format.

Changes:

• Replaces anchored matching with full-string validation.
• Adds invalid-ID coverage for newlines, whitespace, empty values, and traversal-shaped inputs.
• Preserves validation of existing valid IDs.

A critical issue remains unresolved: catalog IDs processed by _commands._command_safe_id can still accept trailing newlines and appear unsafely in suggested commands. The full-match invariant should be enforced there as well, with coverage for that path.

File	Summary
tests/​test_extensions.py	Adds parameterized coverage for malformed extension IDs, including newline and whitespace handling.
src/​specify_cli/​extensions/​__init__.py	Enforces full-string validation for extension IDs loaded from manifests.

_{Review effort: Lite (auto)}

[mnriem]

Updated in commit 11d90af: the shared command-safe ID helper now requires a full-string match, so catalog IDs ending in a newline are replaced with the existing placeholder in suggested commands. Added regression coverage for extension add and search, including install-enabled and discovery-only catalogs and unchanged valid-ID suggestions. The new newline cases failed before the fix; all 764 tests in the extension command/domain and preset-add suites pass afterward. Posted on behalf of @mnriem by GitHub Copilot using GPT-6.1 Sol, default reasoning settings, autonomous mode; AI generated the fix, tests, validation, and this summary.

[Copilot]

🟢 Approval recommended

The reviewed changes address malformed extension IDs and unsafe command suggestions with targeted regression coverage, and no active review issues remain.

1 open issue

• Use full-match validation for untrusted extension IDs

_{Review effort: Lite (auto)}

[Copilot]

🟢 Approval recommended

No active review issues were identified, though the reported test results were not independently rerun.

1 open issue

• Use full-match validation for untrusted extension IDs

_{Review effort: Balanced (auto)}

[Copilot]

🟢 Approval recommended

No active review issues are blocking the extension ID validation changes.

No open issues 🎉

1 resolved since last review

• Use full-match validation for untrusted extension IDs

_{Review effort: Balanced (auto)}