Activity

1. mnriem

   added

   bug-assess

   on Oct 17, 2026
2. github-actions commented on Oct 17, 2026

   

   github-actionsbot

   on Oct 17, 2026 – with GitHub Actions

   Contributor

   More actions

   Bug assessment — multi-integration-update: Valid · severity medium

   ---

   Bug Assessment: extension update removes non-default integration skills

   • Slug: multi-integration-update
   • Created: 2026-10-17T12:57:00Z
   • Source: issue [Bug]: extension update removes extension skills of non-default integrations #5002
   • Verdict: valid
   • Severity: medium

   Report (summarized)

   The reporter describes a project with Claude as the default integration and Codex installed as a second integration. After specify extension update git on Specify CLI 1.2.1, the extension skill files remain under .claude/skills/, but the corresponding .agents/skills/ files are deleted. The registry then records only the default integration's commands even though both integrations remain installed. Switching to Codex and back to Claude recreates the missing files. The report includes a successful reproduction and identifies _active_command_registration_scope() as the suspected restriction point.

   Symptom

   Updating an installed extension removes its previously generated skill mirrors for non-active integrations instead of refreshing them. Expected behavior is that all extension artifacts belonging to installed integrations remain available after an update; actual behavior leaves only the active/default integration's skills and can create a repository diff that deletes the other integration's files.

   Reproduction

   1. Initialize a project with Claude as the default integration and install Codex as a second integration.
   2. Add an extension such as git, confirming its skills exist under both .claude/skills/ and .agents/skills/.
   3. Upgrade both integrations, then run specify extension update git and confirm the update.
   4. Inspect both skill directories and the extension registry.
   5. Observe that the active/default integration is refreshed, while the non-default integration's skill directory is gone and its registry registration is not retained.

   The supplied report states this was reproduced with Specify 1.2.1, Python 3.12.7, and macOS arm64. The same behavior was observed while updating agent-context in the reporter's repository.

   Suspected Code Paths

   • src/specify_cli/extensions/_command_update_transaction.py:273-319 — update backup enumerates command artifacts from registered_commands; this registry structure is per-agent, so only agents recorded there are backed up.
   • src/specify_cli/extensions/_command_update_transaction.py:358-364 — the update reads the flat registered_skills list and backs up matching skill directories, but those backups are used for rollback, not to preserve mirrors across a successful replacement.
   • src/specify_cli/extensions/_command_update_transaction.py:551-554 — the update removes the old extension before installing the new archive, invoking normal extension artifact cleanup.
   • src/specify_cli/extensions/__init__.py:2226-2260 — _unregister_extension_skills() treats an omitted skills_dir as an unscoped cleanup and scans all configured agent skill directories.
   • src/specify_cli/extensions/__init__.py:1440-1480 — _active_command_registration_scope() resolves one active agent from init-options.json; it does not include other installed integrations in the registration scope.
   • src/specify_cli/extensions/__init__.py:1516-1577 — _register_commands_for_active_agent() passes only_agent=active_agent, so a fresh extension install during the update only registers command-backed artifacts for the active integration.
   • src/specify_cli/extensions/__init__.py:4054-4061 — the extension skill phase is explicitly guarded by if agent_name == active_agent, so the replacement install does not regenerate skills for inactive integrations.
   • tests/specify_cli/extensions/test_command_update_transaction.py:206-264 — existing coverage verifies rollback backup behavior for skill-shaped command files, but not successful updates with multiple installed integrations.
   • tests/specify_cli/extensions/test_command_update.py:652-735 — existing skill-update coverage focuses on restoring the active Claude skills after a failed update, not preserving an inactive integration after a successful update.

   Root Cause Hypothesis

   Confidence: high. A successful update is implemented as remove-then-install. The remove path invokes unscoped extension-skill cleanup, which can remove marker-owned skill mirrors in every configured agent directory. The subsequent install path intentionally registers only the active agent (only_agent=active_agent) and runs skill generation only when agent_name == active_agent. Therefore, any non-active mirror removed during step 7 is not recreated. The flat registered_skills metadata and per-agent registered_commands metadata do not provide a successful-update path that preserves or rehydrates inactive integration artifacts.

   Proposed Remediation

   Preferred: Make extension update preserve the complete set of artifacts that existed before replacement, including marker-owned skill mirrors for every installed integration. Before removal, capture each owned skill directory together with its owning/configured agent root (and all registered command artifacts). After installing the new extension, re-render or restore the replacement for every previously active integration, while keeping the normal active-integration behavior for ordinary extension add. Update registry metadata so all surviving per-agent command registrations and flat skill ownership remain accurate. The cleanup should remain ownership-verified and path-safe, and should not overwrite user-customized skills.

   A less invasive implementation could make the update path invoke the existing integration activation/rescaffold operation for each previously registered integration after the active install, but it must avoid changing the project's selected active integration and must handle integrations whose output directories are global or skills-mode specific.

   Files likely to change:

   • src/specify_cli/extensions/_command_update_transaction.py
   • src/specify_cli/extensions/__init__.py
   • tests/specify_cli/extensions/test_command_update.py
   • tests/specify_cli/extensions/test_command_update_transaction.py
   • Potentially integration-state/installer code if the fix reuses a multi-integration rescaffold helper.

   Tests to add or update:

   • Successful extension update with Claude active and Codex installed, asserting both skill trees exist afterward and the registry retains both integrations' registrations.
   • The same scenario with command-backed integrations and with skills-mode integrations, including a global-output integration such as Hermes where applicable.
   • A non-active integration with a user-customized or unrelated skill of the same name, asserting it is not overwritten or deleted.
   • Failure/rollback coverage asserting all pre-update integration artifacts and metadata are restored.
   • A single-active-integration update regression confirming existing behavior and registry cleanup remain unchanged.

   Risks & Considerations

   • Re-registering inactive integrations may alter generated file contents when the new extension changes commands; that is intended, but user-owned/customized files must continue to be protected by ownership markers.
   • Integration output roots can be project-local or home-scoped, so the fix must retain existing containment and symlink safety checks.
   • Registry metadata is currently asymmetric: commands are keyed by agent while registered_skills is flat. A fix should not silently orphan files or drop metadata needed by later removal.
   • Running additional integration registration during update may increase update time and can expose failures from an integration not selected as active; failures should be explicit and transactional rather than silently producing a partial update.

   Open Questions

   • [NEEDS CLARIFICATION: Should an update refresh every integration that has a currently existing, marker-owned mirror, or every integration listed in integration.json even if its artifacts were previously removed manually?]
   • [NEEDS CLARIFICATION: For integrations installed in command mode rather than skills mode, should update preserve only existing artifacts or also recreate missing artifacts for all installed integrations?]

   Generated by 🐛 Assess Bug from Labeled Issue for #5002 · copilot · gpt52codex · 3.03 AIC · ⌖ 0.604 AIC · ⊞ 22.3K · ◷
3. github-actions

   added

   severity-medium

   on Oct 17, 2026