[kartsan03]

Description

ExtensionManifest only checks that a hook's command is truthy, so command: [speckit.test-ext.hello] or a mapping passes validation. specify extension add then fails in HookExecutor.register_hooks with TypeError: unhashable type: 'list'. By then the extension directory and the agent skill are already written, so the user gets a raw traceback and leftover files, with no registry entry.

Extension events already reject this: events/__init__.py requires a non-blank string command (validate_events()). This PR applies the same check to hooks, so the manifest fails with a ValidationError before anything is installed. EXTENSION-API-REFERENCE.md already documents the field as command: string.

Repro with the real CLI and the manifest from the issue:

specify init --here --integration claude --script sh --ignore-agent-tools
specify extension add --dev ../test-ext

	main (222a973)	This PR
exit code	1	1
output	traceback ending in TypeError: unhashable type: 'list'	Validation Error: Hook 'after_tasks' missing required 'command' string
left on disk	.specify/extensions/test-ext/, .claude/skills/speckit-test-ext-hello/SKILL.md	nothing

Refs #5080. This covers the reported case only. The issue also notes that the install rollback only cleans up for the generic agent; I left that alone because #4959 reworks the install transaction.

Testing

• Tested locally with uv run specify --help
• Ran existing tests with uv sync && uv run pytest
• Tested with a sample project (if applicable)

New tests:

• tests/test_extensions.py::TestExtensionManifest::test_hook_command_must_be_a_string: list, mapping, integer, boolean and blank commands, each as a single mapping and in a list of entries, are rejected.
• tests/specify_cli/extensions/test_command_add.py::TestExtensionAddCLI::test_add_dev_rejects_invalid_hook_command_before_writing_files[list|mapping]: extension add --dev exits 1 with no traceback, and leaves no extension directory, agent files or registry entry.

With extensions/__init__.py reverted to main, all 10 manifest cases fail (DID NOT RAISE), and both CLI cases fail on TypeError("unhashable type: 'list'") / 'dict'.

Full suite on Linux, Python 3.13: 13179 passed, 435 skipped (uv sync --extra test, then pytest -n 3, 6 min). Ruff 0.15.0 (ruff check src tests) passes. I haven't run it on Windows.

AI Disclosure

• I did not use AI assistance for this contribution
• I did use AI assistance (fill in the disclosure below)

AI disclosure: Codex CLI (model: gpt-6.1-sol, reasoning effort xhigh, autonomous, offline sandbox) reproduced the issue on main and wrote a first version of the fix and tests. Claude Code (model: claude-opus-5-5, autonomous) narrowed it to the command check, matched it to the existing events rule, reran the repro with the real CLI on main and the branch, ran the full suite and lint, and drafted this description. The commit carries Assisted-by: trailers for both.

[Copilot]

🟡 Changes recommended

An open review nit flags that (#17) points to an unrelated Gemini CLI issue rather than the relevant validate_events() check.

1 open issue

• Fix misleading issue reference in validation comment · New

What changed in this PR

This PR rejects malformed hook commands during extension manifest validation, preventing the installation crash and leftover files reported in #5080.

Changes:

• Require hook commands to be non-blank strings, matching event validation.
• Add parameterized manifest tests for invalid commands in both supported hook shapes.
• Add CLI regression tests verifying clean failure without installed files or registry entries.

The PR provides before-and-after regression results; tests were not rerun during this review.

File	Description
tests/​test_extensions.py	Tests rejection of non-string and blank hook commands.
tests/​specify_cli/​extensions/​test_command_add.py	Verifies invalid hooks fail before installation writes files.
src/​specify_cli/​extensions/​__init__.py	Validates hook command type and non-blank content.

_{Review effort: Max}

[mnriem]

Please address Copilot feedback

[kartsan03]

Fixed in b6d14f3. The comment now points to validate_events() in events/__init__.py instead of #17, and so does the PR description. It's a comment-only change. tests/test_extensions.py and tests/specify_cli/extensions/test_command_add.py pass, and Ruff 0.15.0 passes.

Drafted on behalf of @kartsan03 by Claude Code (model: claude-opus-5-5, autonomous).

[Copilot]

🟢 Approval recommended

No active review issues are reported for the change that rejects malformed extension hook commands before installation.

No open issues 🎉

1 resolved since last review

• Fix misleading issue reference in validation comment

_{Review effort: Max}

[mnriem]

Thank you!