fix(presets): fail closed on invalid catalog sources

Preserve unavailable-source fallback while surfacing malformed catalog JSON and payloads through lookup and CLI commands, so lower-priority installation cannot bypass discovery-only policy.

Assisted-by: GitHub Copilot (model: GPT-6 Sol, autonomous)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: mnriem

docs/reference/presets.md

@@ -216,6 +216,9 @@ Duplicate JSON keys are rejected before parsing can discard a release record.
 Historical `requires.extensions` entries follow the preset manifest format:
 extension IDs or mappings with an `id`, optional version constraint, and
 optional boolean `required` flag.
+An invalid catalog payload fails resolution rather than allowing an entry
+from a lower-priority catalog to bypass its installation policy. Unreachable
+catalogs can still be skipped so other configured sources remain available.
 
 ```json
 {

src/specify_cli/presets/_catalog.py

@@ -23,20 +23,29 @@
 from ._manifest import PresetError, PresetValidationError
 
 
+class PresetCatalogValidationError(PresetError):
+    """A catalog supplied invalid content rather than being unreachable."""
+
+
 def _decode_catalog_json(raw: str | bytes, url: str) -> Any:
     """Reject duplicate keys before JSON parsing discards conflicting records."""
 
     def unique_object(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
         result: dict[str, Any] = {}
         for key, value in pairs:
             if key in result:
-                raise PresetError(
+                raise PresetCatalogValidationError(
                     f"Invalid preset catalog format from {url}: duplicate JSON key '{key}'."
                 )
             result[key] = value
         return result
 
-    return json.loads(raw, object_pairs_hook=unique_object)
+    try:
+        return json.loads(raw, object_pairs_hook=unique_object)
+    except json.JSONDecodeError as exc:
+        raise PresetCatalogValidationError(
+            f"Invalid preset catalog format from {url}: invalid JSON ({exc})"
+        ) from exc
 
 
 @dataclass
@@ -190,17 +199,17 @@ def _validate_catalog_payload(self, catalog_data: Any, url: str) -> None:
             PresetError: If the payload's shape is invalid.
         """
         if not isinstance(catalog_data, dict):
-            raise PresetError(
+            raise PresetCatalogValidationError(
                 f"Invalid preset catalog format from {url}: "
                 "expected a JSON object"
             )
         if (
             "schema_version" not in catalog_data
             or "presets" not in catalog_data
         ):
-            raise PresetError(f"Invalid preset catalog format from {url}")
+            raise PresetCatalogValidationError(f"Invalid preset catalog format from {url}")
         if not isinstance(catalog_data.get("presets"), dict):
-            raise PresetError(
+            raise PresetCatalogValidationError(
                 f"Invalid preset catalog format from {url}: "
                 "'presets' must be a JSON object"
             )
@@ -545,6 +554,8 @@ def _get_merged_packs(self, force_refresh: bool = False) -> Dict[str, Dict[str,
                         continue
                     pack_data_with_catalog = {**pack_data, "_catalog_name": entry.name, "_install_allowed": entry.install_allowed}
                     merged[pack_id] = pack_data_with_catalog
+            except PresetCatalogValidationError:
+                raise
             except PresetError:
                 continue
 
@@ -713,6 +724,8 @@ def search(
         """
         try:
             packs = self._get_merged_packs()
+        except PresetCatalogValidationError:
+            raise
         except PresetError:
             return []
 
@@ -771,6 +784,8 @@ def get_pack_info(
         """
         try:
             packs = self._get_merged_packs()
+        except PresetCatalogValidationError:
+            raise
         except PresetError:
             return None
 

src/specify_cli/presets/command_info.py

@@ -6,6 +6,7 @@
 from rich.markup import escape as _escape_markup
 
 from .._console import console
+from ._catalog import PresetCatalogValidationError
 from ._catalog_versions import available_versions
 from ._commands import preset_app
 
@@ -86,6 +87,9 @@ def preset_info(
     catalog = PresetCatalog(project_root)
     try:
         pack_info = catalog.get_pack_info(preset_id)
+    except PresetCatalogValidationError as exc:
+        console.print(f"[red]Error:[/red] {_escape_markup(str(exc))}")
+        raise typer.Exit(1) from exc
     except PresetError:
         pack_info = None
 

tests/specify_cli/presets/test_catalog_versions.py

@@ -318,6 +318,81 @@ def fetch(source, _refresh):
         assert catalog.get_pack_info("sample", "1.0.0") is None
 
 
+@pytest.mark.parametrize(
+    "bad_payload, error",
+    [
+        (_duplicate_release_json, "duplicate JSON key"),
+        (lambda: b'{"schema_version": "1.0", "presets": []}', "Invalid preset catalog format"),
+        (lambda: b'{"schema_version":', "invalid JSON"),
+    ],
+)
+def test_invalid_discovery_catalog_cannot_delegate_install(
+    project_dir, bad_payload, error
+):
+    high_url = "https://example.com/discovery.json"
+    low_url = "https://example.com/trusted.json"
+    sources = [
+        PresetCatalogEntry(high_url, "discovery", 1, False),
+        PresetCatalogEntry(low_url, "trusted", 2, True),
+    ]
+    old_bytes = _archive()
+    lower = json.dumps({
+        "schema_version": "1.0",
+        "presets": {"sample": _entry(old_bytes)},
+    }).encode()
+    opened: list[str] = []
+
+    def open_url(_self, url, **_kwargs):
+        opened.append(url)
+        data = {
+            high_url: bad_payload(),
+            low_url: lower,
+            OLD_URL: old_bytes,
+        }
+        return _response(data[url], url)
+
+    with (
+        patch.object(PresetCatalog, "get_active_catalogs", return_value=sources),
+        patch.object(PresetCatalog, "_open_url", open_url),
+        patch.object(Path, "cwd", return_value=project_dir),
+        patch("specify_cli.get_speckit_version", return_value="1.0.0"),
+    ):
+        with pytest.raises(PresetError, match=error):
+            PresetCatalog(project_dir).get_pack_info("sample", "1.0.0")
+        result = CliRunner().invoke(
+            app, ["preset", "add", "sample", "--version", "1.0.0"]
+        )
+        info = CliRunner().invoke(app, ["preset", "info", "sample"])
+        search = CliRunner().invoke(app, ["preset", "search", "sample"])
+    assert result.exit_code == 1, result.output
+    assert error in result.output
+    assert info.exit_code == 1 and error in info.output
+    assert search.exit_code == 1 and error in search.output
+    assert OLD_URL not in opened
+    assert PresetManager(project_dir).get_pack("sample") is None
+
+
+def test_unreachable_high_priority_catalog_still_uses_lower_source(project_dir):
+    catalog = PresetCatalog(project_dir)
+    sources = [
+        PresetCatalogEntry("https://example.com/unavailable.json", "high", 1, False),
+        PresetCatalogEntry("https://example.com/trusted.json", "low", 2, True),
+    ]
+
+    def fetch(source, _refresh):
+        if source.name == "high":
+            raise PresetError("Failed to fetch preset catalog: offline")
+        return {"presets": {"sample": _entry()}}
+
+    with (
+        patch.object(catalog, "get_active_catalogs", return_value=sources),
+        patch.object(catalog, "_fetch_single_catalog", side_effect=fetch),
+    ):
+        selected = catalog.get_pack_info("sample", "1.0.0")
+    assert selected["_catalog_name"] == "low"
+    assert selected["_install_allowed"] is True
+
+
 def test_discovery_only_winner_does_not_delegate_exact_release(project_dir):
     catalog = PresetCatalog(project_dir)
     sources = [