github/spec-kit PR #3497 — Cross-extension env-var routing fix — PR #3497
github/spec-kit · pull request #3497 ·
Transcript
PlainEnglish
Let's walk through pull request 3497 for spec-kit — a fix for cross-extension environment variable leakage. This one touches the config layer where extensions read their settings from environment variables.
PlainEnglish
Here's what we're pursuing. The main goal is preventing longer-prefix extensions from absorbing environment variables meant for their siblings. We'll source the sibling list from the extension registry rather than scanning the filesystem, and make sure everything degrades gracefully if that registry is missing or corrupted. And critically, we won't change behavior for single-extension setups — backward compatibility matters here.
PlainEnglish
The problem comes down to prefix collisions. When you have two extensions installed — say, git and git-hooks — an environment variable like SPECKIT_GIT_HOOKS_URL is intended for git-hooks. But because SPECKIT_GIT_ is also a valid prefix for the git extension, the old logic would parse that variable into both extensions' configs. That meant config intended for one extension would leak into another, flipping hook execution conditions on the wrong extension.
Architecture
Two files are touched. The first is extensions slash dunder init, where the core config-read logic lives. The second is the test suite, which adds seven new test cases covering the collision scenario and edge cases.
Architecture
First change is a new helper method, underscore sibling underscore extension underscore ids. It queries the extension registry to get the list of co-installed extensions, filtering out the current extension. If the registry is missing or corrupted, the method catches OS Error and Unicode Error and returns an empty list — so we degrade gracefully to the old behavior rather than crashing.
Architecture
The second change is in get env config, where environment variables are parsed. We build a list of sibling-claimed prefixes by normalizing each sibling ID and appending an underscore. That trailing underscore is crucial — it prevents false positives, so a sibling called hook doesn't accidentally consume keys meant for hooks. Then for each environment variable, we extract the remainder after the extension prefix and skip it if any sibling prefix matches.
Architecture
The test suite covers five key scenarios. The main test confirms that SPECKIT_GIT_HOOKS_URL is correctly routed to git-hooks and excluded from git's config when both are installed. Backward compatibility is verified — single-extension setups still absorb nested keys as before. The boundary check test proves that a sibling with a shorter ID doesn't accidentally consume unrelated keys. And two resilience tests ensure that a missing or non-UTF-8 registry degrades gracefully. Finally, the registry-based approach means config-only leftovers from remove with keep config true are correctly ignored.
PlainEnglish
After this PR lands, environment variables for longer-prefix co-installed extensions are correctly routed to the intended extension instead of leaking into shorter-prefix siblings. The fix only kicks in when a collision sibling is actually installed — single-extension behavior is unchanged, preserving backward compatibility. Fresh projects and test harnesses without a registry degrade gracefully to the pre-fix behavior.
PlainEnglish
That's pull request 3497 — a focused config-layer fix that prevents environment variable collisions between extensions with overlapping ID prefixes. The new sibling detection helper lives at line 2740 of extensions dunder init, and the filtering logic starts at line 2789. Seven new tests cover the collision scenario and edge cases. The agent found no issues — error paths are handled, boundary conditions are respected, and backward compatibility is preserved.
How this was made
Lenzon read github/spec-kit at pull request #3497 and generated this walkthrough automatically. The narration above is the transcript of what it says.
Explain a pull request from your own repo
Point Lenzon at a repo or a pull request and get a narrated walkthrough like this one.
Try it