fix: reject non-json artifact contributions

Assisted-by: GitHub Copilot (model: GPT-5.6 Sol, autonomous)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: nicolehaugen

src/specify_cli/artifacts/catalog.py

@@ -11,6 +11,7 @@
 
 from __future__ import annotations
 
+import json
 import re
 import shlex
 from collections.abc import Iterable
@@ -436,6 +437,10 @@ def get_contribution_info(self, lookup_id: str) -> dict[str, Any]:
             raise ContributionNotFoundError(lookup_id)
 
         contribution, manifest_path, source_path = resolved
+        try:
+            json.dumps(contribution)
+        except (TypeError, ValueError) as exc:
+            raise ArtifactResolutionError() from exc
         return {
             "id": lookup_id,
             "layer": layer,

tests/test_artifact_command.py

@@ -11,6 +11,7 @@
 import os
 import re
 import shutil
+from datetime import date
 from pathlib import Path
 
 import pytest
@@ -1073,6 +1074,67 @@ def test_lookup_json_rejects_unknown_contribution(
             "error": f"unknown contribution {lookup_id}"
         }
 
+    def test_lookup_json_rejects_non_json_manifest_value(
+        self, spec_kit_project: Path, monkeypatch: pytest.MonkeyPatch
+    ):
+        monkeypatch.chdir(spec_kit_project)
+        install_preset(
+            spec_kit_project,
+            "dated-contribution",
+            {
+                "templates": [
+                    {
+                        "type": "template",
+                        "name": "dated-contribution",
+                        "released": date(2026, 1, 1),
+                    }
+                ]
+            },
+        )
+
+        result = CliRunner().invoke(
+            app,
+            [
+                "artifact",
+                "lookup",
+                "preset:dated-contribution:template:dated-contribution",
+                "--json",
+            ],
+        )
+
+        assert result.exit_code == 1
+        assert result.stdout == ""
+        assert json.loads(result.stderr) == {
+            "error": "artifact resolution failed"
+        }
+
+    @pytest.mark.parametrize(
+        "lookup_id",
+        [
+            "invalid:source:command:name",
+            "extension:source:invalid:name",
+            "extension:source:hook:%FF:command",
+            "extension:source:hook:event:%ZZ",
+        ],
+    )
+    def test_lookup_json_rejects_malformed_lookup_id(
+        self,
+        spec_kit_project: Path,
+        monkeypatch: pytest.MonkeyPatch,
+        lookup_id: str,
+    ):
+        monkeypatch.chdir(spec_kit_project)
+
+        result = CliRunner().invoke(
+            app, ["artifact", "lookup", lookup_id, "--json"]
+        )
+
+        assert result.exit_code == 1
+        assert result.stdout == ""
+        assert json.loads(result.stderr) == {
+            "error": f"unknown contribution {lookup_id}"
+        }
+
     def test_lookup_requires_json_flag(
         self, spec_kit_project: Path, monkeypatch: pytest.MonkeyPatch
     ):