fix(core): guard /api/ext slug collisions in makeApp (closes #323)

[omridevk]

Mechanism

Both extension mounts key off the normalized slug — app.route('/api/ext/<slug>', …) and the rpc composite under ext.<slug> — but makeApp only asserted uniqueness of extension names. slug('Http Probe') === slug('http-probe') === 'http-probe', so two extensions whose names normalize to the same slug silently shared the HTTP prefix with hono first-wins semantics: the second extension's routes were unreachable, with no error at boot. The rpc side was already guarded by makeCompositeRpcRouter (#319), so the hole only showed when neither extension exposed an rpc router.

Fix

Replace the name-only check in makeApp with one slug-uniqueness assertion over the extension list, run before mounting. It covers the /api/ext mounts and the rpc composite alike, and reports both claimants:

extension slug collision: "http-probe" is claimed by both "Http Probe" and "http-probe"

Duplicate names still fail (identical names normalize to identical slugs), just with the slug message.

makeCompositeRpcRouter's guard is kept: it validates caller-supplied slug strings at the @conciv/extension package boundary (@conciv/harness-testkit mounts routers there with slugs that never pass through makeApp), so it is a different input at a different layer rather than a second copy of this check.

Tests

• packages/core/test/api/rpc-ws.it.test.ts: new test boots two router-less extensions (Http Probe / http-probe, each with a hono app) and asserts makeApp rejects naming the slug and both extensions. Fails on the pre-fix code (boot resolves normally).
• packages/core/test/api/extension-mount-isolation.it.test.ts: duplicate-name test now asserts the slug message.

Closes #323

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Applications now reject extensions whose normalized slugs conflict, including conflicts caused by different extension names.
  • Collision errors identify both conflicting extensions, improving diagnostics during startup.
  • Router-less extensions with conflicting normalized names are now correctly blocked before the application mounts them.
  • Extension mounting continues to support concurrent startup when no slug conflicts are present.
• Tests
  • Added coverage for normalized-name collisions and updated existing collision expectations.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d849921e-82af-43e4-8f78-0867b5d6a817

📥 Commits

Reviewing files that changed from the base of the PR and between 7a932a3 and 76ac374.

📒 Files selected for processing (1)

• packages/core/src/app.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/core/src/app.ts

---

📝 Walkthrough

Walkthrough

The application now validates normalized extension slug uniqueness before mounting. Collision errors identify both extension names. Tests cover exact-name collisions and router-less extensions with normalized-name collisions.

Changes

Extension slug validation

Layer / File(s)	Summary
Pre-mount slug collision guard packages/core/src/app.ts	The application derives extension slugs, rejects collisions with an error containing both extension names, and performs validation before concurrent mounting.
Collision behavior tests packages/core/test/api/extension-mount-isolation.it.test.ts, packages/core/test/api/rpc-ws.it.test.ts	Tests expect the detailed slug-collision error and cover router-less extensions whose names normalize to the same slug.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• conciv-dev/conciv#335: Both PRs modify extension RPC mounting and slug-collision validation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: guarding /api/ext slug collisions in makeApp.
Linked Issues check	✅ Passed	The changes extend makeApp validation to normalized slugs, protect HTTP routes, cover RPC mounts, and add the required collision test for #323.
Out of Scope Changes check	✅ Passed	The code and test changes directly support the linked issue and stated objectives; no unrelated changes are present.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/323-ext-slug-http-guard

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install failed. For unrecoverable errors, disable the tool in CodeRabbit configuration.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/core/src/app.ts`:
- Around line 356-358: Update the startup flow around openDb and
assertUniqueExtensionSlugs so extension construction and slug validation
complete before opening the database, or ensure every validation failure
disposes the already-created db client. Preserve successful mounting while
guaranteeing failed startup does not leak the database resource.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 31ebe9d1-9013-4c26-a070-bfba91be59e6

📥 Commits

Reviewing files that changed from the base of the PR and between c6aa92c and 7a932a3.

📒 Files selected for processing (3)

• packages/core/src/app.ts
• packages/core/test/api/extension-mount-isolation.it.test.ts
• packages/core/test/api/rpc-ws.it.test.ts

[Copilot]

Pull request overview

Adds normalized extension-slug collision detection before extensions mount.

Changes:

• Rejects duplicate normalized slugs with claimant details.
• Adds HTTP-route collision coverage and updates duplicate-name expectations.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
packages/core/src/app.ts	Adds slug uniqueness validation.
packages/core/test/api/rpc-ws.it.test.ts	Tests router-less slug collisions.
packages/core/test/api/extension-mount-isolation.it.test.ts	Updates duplicate-name error expectation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[omridevk]

Fixed in 76ac374: slug validation now runs before openDb, so a collision rejects before any resource is created.