[Bug]: 0.4.2 removed "extension" command from specify

Bug Description

extension add fails with no command found:

specify extension add verify-tasks
Usage: specify [OPTIONS] COMMAND [ARGS]...
Try 'specify --help' for help.                   
Error │ No such command 'extension'. Did you mean 'version'

Help does not list "extension" in version 0.4.2

specify --help
GitHub Spec Kit - Spec-Driven Development Toolkit                                                                       
 Usage: specify [OPTIONS] COMMAND [ARGS]...                                                                                                                                                    
 Setup tool for Specify spec-driven development projects                                                                                                                                       
 Options 
│ --help          Show this message and exit.                                                                                                                                                 
 Commands 
│ init     Initialize a new Specify project from the latest template.
│ check    Check that all required tools are installed.
│ version  Display version and system information.

Steps to Reproduce

Run specify extension add <extension>
Run specify --help
Run specify extension --help

Expected Behavior

Extensions are installed or the command is available.

Actual Behavior

Command not found.

Specify CLI Version

0.4.2

AI Agent

Not applicable

Operating System

Ubuntu 24.04

Python Version

Python 3.12.3

Error Logs

Additional Context

No response

I am unable to reproduce the issue

specify extension add verify-tasks
Error: 'verify-tasks' is available in the 'community' catalog but installation is not allowed from that catalog.

To enable installation, add 'verify-tasks' to an approved catalog (install_allowed: true) in .specify/extension-catalogs.yml.

i have just reproduced:

michalbachorik@Michals-MacBook-Pro xxxx % uv tool install specify-cli --force
Resolved 20 packages in 338ms
Prepared 2 packages in 142ms
Installed 20 packages in 21ms

annotated-doc==0.0.4
anyio==4.13.0
certifi==2026.2.25
click==8.3.1
h11==0.16.0
httpcore==1.0.9
httpx==0.28.1
idna==3.11
markdown-it-py==4.0.0
mdurl==0.1.2
platformdirs==4.9.4
pygments==2.19.2
readchar==4.2.1
rich==14.3.3
shellingham==1.5.4
socksio==1.0.0
specify-cli==1.0.0
truststore==0.10.4
typer==0.24.1
typing-extensions==4.15.0
Installed 1 executable: specify
michalbachorik@Michals-MacBook-Pro xxxxx % specify extension add --dev ../../bugfixes/yyyyyyyyyyy
Usage: specify [OPTIONS] COMMAND [ARGS]...
Try 'specify --help' for help.
╭─ Error ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ No such command 'extension'. Did you mean 'version'?

Looking into it

Doc bug.

Caused by install from PyPi which has stale package.

What happened

The upgrade instruction in the error message was incomplete/wrong. It said:
uv tool install specify-cli --force

But the correct command, per spec-kit's own README, is:
uv tool install specify-cli --force --from git+https://github.com/github/spec-kit.git@vX.Y.Z

Without --from git+https://github.com/github/spec-kit.git, uv fetched specify-cli from PyPI — where there is a completely unrelated package also called specify-cli (versions 0.0.20, 0.0.22, 1.0.0) with no author, no homepage, no project URLs. It's a different project
that squatted the same PyPI name.

That PyPI package is a minimal stub with only init, check, version — no extension command.

The real spec-kit specify-cli is only distributed from GitHub, not PyPI.

Fix

Reinstall the real spec-kit CLI:

uv tool install specify-cli --force --from git+https://github.com/github/spec-kit.git@v0.4.3

This will restore the extension command and give you the proper 0.4.3 version. The manual installation I did earlier will still work once the CLI is back to spec-kit's version.

I verified that everything works once installed latest from github.

@mbachorik

@mbachorik What do you think should we update docs?

@mnriem

@mnriem any idea where packages in PyPI are coming from? one possibility is to fix the packages. if we do not have it undee control, then fix to doc is the way to go - it's really not clear what's happening (i reproduced by 'accident' only, needed to test something quickly and did not want to use my local modified speckit). less experienced users my get very confused.

IMO install from github release is reliable and should be recommended .

PR? ;)

@ChristianPresley

@ChristianPresley I hope you push on and try the verify-tasks extension, please let us know if it meets your need.

@mbachorik

@mbachorik No idea so we will have to make sure our docs make it clear that one CANNOT use PyPi. Want to take on a PR for that?

@mbachorik No idea so we will have to make sure our docs make it clear that one CANNOT use PyPi. Want to take on a PR for that?

i'll bundle it with the other fix. looking at it now.

docs: warn about unofficial PyPI packages and recommend version verif…

fix: unofficial PyPI warning (#1982) and legacy extension command nam…

fix: include --from git+... in upgrade hint to avoid PyPI squat packa…

@ChristianPresley

Bug assessment — pypi-squat-extension-missing: Valid · severity medium

Bug Assessment: PyPI Squat Package Causes Missing `extension` Command

Slug: pypi-squat-extension-missing
Created: 2026-06-17T22:27:00Z
Source: issue [Bug]: 0.4.2 removed "extension" command from specify #1982
Verdict: valid
Severity: medium

Report (summarized)

Reported by @ChristianPresley on 2026-03-26 against v0.4.2. Running specify extension add verify-tasks produced:

Error │ No such command 'extension'. Did you mean 'version'?

specify --help only listed init, check, version — the entire extension subcommand group was absent.

Symptom

The extension subcommand was entirely absent from the CLI. Expected: specify extension add <name> should install an extension from the catalog. Actual: Click reported no such command, as though extension management had been stripped from the binary.

Reproduction

Run uv tool install specify-cli --force (without `--from (github.com/redacted)
Run specify extension add verify-tasks
Observe: No such command 'extension'
Run specify --help — only init, check, version are listed

Root cause confirmed by contributor @mbachorik: step 1 installs the unrelated PyPI squatter package specify-cli (versions 0.0.20, 0.0.22, 1.0.0 — no author, no homepage), which is a minimal stub missing extension, preset, self, and all other spec-kit commands.

Suspected Code Paths

The trigger was an incomplete upgrade hint in an older CLI error message. The now-fixed constant in the current codebase is:

src/specify_cli/extensions.py:55 — REINSTALL_COMMAND = "uv tool install specify-cli --force --from (github.com/redacted) (fixed; includes --from`)
src/specify_cli/_version.py:968,1002,1177,1189,1203 — all self upgrade guidance strings (fixed; each includes --from {_manual_source_spec(...)})

One stale example remains in a non-user-facing doc:

extensions/RFC-EXTENSION-SYSTEM.md:1342 — code snippet showing f"Upgrade spec-kit with: uv tool install specify-cli --force" (bare, missing --from; RFC design document only, not live code)

The live implementation in extensions.py uses REINSTALL_COMMAND (correct), so the RFC stale example does not affect runtime behavior.

Root Cause Hypothesis

Confidence: high. In v0.4.2, one or more CLI error-message paths emitted uv tool install specify-cli --force without --from (github.com/redacted) A user following this hint would install the PyPI squatter (specify-cli 1.0.0) — a stub with only init, check, and version— silently replacing the real spec-kit CLI. The squatter has noextension` subcommand, producing the observed error.

Proposed Remediation

Status: substantially fixed in released versions.

Two separate PRs addressed this:

v0.7.1 (PR fix: unofficial PyPI warning (#1982) and legacy extension command name auto-correction (#2017) #2027): Added the [!IMPORTANT] PyPI warning to docs/installation.md and related documentation. The README installation instructions already use the full `--from (redacted) form.
PR fix: include --from git+... in upgrade hint to avoid PyPI squat package #2411: Fixed all uv tool install specify-cli --force hints in CLI error messages and specify self upgrade/self check output to include --from {git-ref}.

Remaining (low-priority) items:

Preferred: Update extensions/RFC-EXTENSION-SYSTEM.md:1342 to replace:

f"Upgrade spec-kit with: uv tool install specify-cli --force"

with:

f"Upgrade spec-kit with: uv tool install specify-cli --force --from (github.com/redacted)

This is a design document — no runtime impact — but keeps docs consistent and avoids confusing future contributors.

Alternatives:

Add a runtime fingerprint check in specify version or specify check that warns when the installed version matches known PyPI squatter version strings (0.0.20, 0.0.22, 1.0.0). Trade-off: fragile; the squatter could publish new versions. Low value since users running the squatter wouldn't have extension available to trigger this check anyway.

Files likely to change:

extensions/RFC-EXTENSION-SYSTEM.md (stale upgrade hint in design doc)

Tests to add or update:

The existing upgrade guidance tests in tests/test_self_upgrade_guidance.py and tests/test_self_upgrade_execution.py already assert that all uv tool install hints include --from. These cover the fixed paths.
No new tests required for the RFC doc fix.

Risks & Considerations

User impact (v0.4.2 users): Any user still on v0.4.2 who follows a bare uv tool install specify-cli --force hint will still experience this. Upgrading to v0.7.1+ resolves it.
PyPI squatter: The unrelated specify-cli package on PyPI remains published. There is no action spec-kit can take to remove it. The documentation warning is the appropriate mitigation.
No data loss or security risk: The squatter is an inert stub; no user data is affected.
Regression risk: None — the RFC doc change is documentation only.

Open Questions

None. Root cause, reproduction, and fix are all confirmed by contributors in the thread.

Generated by 🐛 Assess Bug from Labeled Issue for issue #1982 · 658.2 AIC · ⌖ 13.9 AIC · ⊞ 31.2K · ◷

Please upgrade to the latest version using the mechanism described in the release notes

fix: unofficial PyPI warning (github#1982) and legacy extension comma…

fix: include --from git+... in upgrade hint to avoid PyPI squat packa…

Navigation Menu

Repository navigation

[Bug]: 0.4.2 removed "extension" command from specify #1982

Bug Description

Steps to Reproduce

Expected Behavior

Actual Behavior

Specify CLI Version

AI Agent

Operating System

Python Version

Error Logs

Additional Context

Bug Assessment: PyPI Squat Package Causes Missing `extension` Command

Report (summarized)

Symptom

Reproduction

Suspected Code Paths

Root Cause Hypothesis

Proposed Remediation

Risks & Considerations

Open Questions

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Bug]: 0.4.2 removed "extension" command from specify #1982

Description

Bug Description

Steps to Reproduce

Expected Behavior

Actual Behavior

Specify CLI Version

AI Agent

Operating System

Python Version

Error Logs

Additional Context

Activity

mnriem commented on Mar 26, 2026

mbachorik commented on Mar 26, 2026

mbachorik commented on Mar 26, 2026

mnriem commented on Mar 27, 2026

mbachorik commented on Mar 27, 2026

mnriem commented on Mar 27, 2026

davesharpe13 commented on Mar 28, 2026

mnriem commented on Mar 30, 2026

mbachorik commented on Mar 30, 2026

github-actions commented on Jun 17, 2026

Bug Assessment: PyPI Squat Package Causes Missing extension Command

Report (summarized)

Symptom

Reproduction

Suspected Code Paths

Root Cause Hypothesis

Proposed Remediation

Risks & Considerations

Open Questions

mnriem commented on Jun 18, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Bug Assessment: PyPI Squat Package Causes Missing `extension` Command