Skip to content

fix: allow reserved collective members to push extensions #642

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stack72 merged 1 commit into from
Mar 7, 2026
Merged

fix: allow reserved collective members to push extensions #642

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions src/cli/commands/extension_push.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ import { requireInitializedRepo } from "../repo_context.ts";
import { resolveExtensionFiles } from "../resolve_extension_files.ts";
import { AuthRepository } from "../../infrastructure/persistence/auth_repository.ts";
import { UserError } from "../../domain/errors.ts";
import { ModelType } from "../../domain/models/model_type.ts";
import { analyzeExtensionSafety } from "../../domain/extensions/extension_safety_analyzer.ts";
import { checkExtensionQuality } from "../../domain/extensions/extension_quality_checker.ts";
import { bundleExtension } from "../../domain/models/bundle.ts";
Expand Down Expand Up @@ -124,6 +125,7 @@ export const extensionPushCommand = new Command()

// 4. Validate collective matches user's collectives (with username fallback)
const collectivePart = manifest.name.slice(1, manifest.name.indexOf("/"));
const isReserved = ModelType.isReservedCollective(manifest.name);
let collectives: string[] | undefined;
try {
const swampClubClient = new SwampClubClient(credentials.serverUrl);
Expand All @@ -133,6 +135,15 @@ export const extensionPushCommand = new Command()
ctx.logger
.debug`Could not fetch collectives from server, falling back to username check`;
}

// For reserved collectives, we MUST verify membership via the server
if (isReserved && !collectives) {
throw new UserError(
`Extension uses reserved collective "@${collectivePart}". ` +
`Could not verify membership — please check your network connection and try again.`,
);
}

const isAllowed = collectives
? collectives.includes(collectivePart)
: collectivePart === credentials.username;
Expand Down
4 changes: 0 additions & 4 deletions src/domain/extensions/extension_manifest.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,6 @@
import { z } from "zod";
import { parse as parseYaml } from "@std/yaml";
import { CalVer } from "../models/calver.ts";
import { ModelType } from "../models/model_type.ts";
import { UserError } from "../errors.ts";

/** Scoped name pattern: @collective/name */
Expand All @@ -34,9 +33,6 @@ const ExtensionManifestSchemaV1 = z.object({
message:
"Extension name must be scoped: @collective/name (lowercase, alphanumeric, hyphens, underscores)",
},
).refine(
(name) => !ModelType.isReservedCollective(name),
{ message: "Cannot use reserved collective (@swamp or @si)" },
),
version: z.string().refine(CalVer.isValid, {
message: "Version must be valid CalVer format: YYYY.MM.DD.MICRO",
Expand Down
18 changes: 6 additions & 12 deletions src/domain/extensions/extension_manifest_test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,34 +114,28 @@ models:
);
});

Deno.test("parseExtensionManifest rejects reserved collective @swamp", () => {
Deno.test("parseExtensionManifest accepts reserved collective @swamp", () => {
const yaml = `
manifestVersion: 1
name: "@swamp/myext"
version: "2026.02.26.1"
models:
- foo.ts
`;
const error = assertThrows(() => parseExtensionManifest(yaml));
assertStringIncludes(
(error as Error).message,
"reserved collective",
);
const manifest = parseExtensionManifest(yaml);
assertEquals(manifest.name, "@swamp/myext");
});

Deno.test("parseExtensionManifest rejects reserved collective @si", () => {
Deno.test("parseExtensionManifest accepts reserved collective @si", () => {
const yaml = `
manifestVersion: 1
name: "@si/myext"
version: "2026.02.26.1"
models:
- foo.ts
`;
const error = assertThrows(() => parseExtensionManifest(yaml));
assertStringIncludes(
(error as Error).message,
"reserved collective",
);
const manifest = parseExtensionManifest(yaml);
assertEquals(manifest.name, "@si/myext");
});

Deno.test("parseExtensionManifest rejects invalid CalVer version", () => {
Expand Down
Loading