"extends" entry "${entry}" is not a valid spectral identifie

Error message

"extends" entry "${entry}" is not a valid spectral identifier, local path, or URL.

What it means

Error ""extends" entry "${entry}" is not a valid spectral identifier, local path, or URL." thrown in Kong/insomnia.

Source

Thrown at packages/insomnia/src/main/bundle-spectral-ruleset.ts:74

// Shallow-merges top-level keys from source into target.
// Object values (e.g. "rules") are merged one level deep with source taking precedence.
// Scalar values are overwritten by source.
function mergeInto(target: Ruleset, source: Ruleset): void {
  for (const key of Object.keys(source)) {
    const sourceVal = source[key];
    const targetVal = target[key];
    target[key] = isPlainObject(targetVal) && isPlainObject(sourceVal) ? { ...targetVal, ...sourceVal } : sourceVal;
  }
}

// Resolves an "extends" entry into a URL. When `base` is provided, relative paths are
// resolved against it — used when processing extends entries inside a remote ruleset.
function parseRemoteExtendsUrl(entry: string, base?: URL): URL {
  try {
    return new URL(entry, base);
  } catch {
    throw new Error(`"extends" entry "${entry}" is not a valid spectral identifier, local path, or URL.`);
  }
}

// Rejects URLs that could be used for SSRF attacks:
// - Must be https (no http, ftp, file, etc.)
// - Hostname must not be a known private/loopback address
// - DNS resolution must not yield a private/loopback address
async function assertSafeRemoteUrl(url: URL): Promise<void> {
  const hostname = url.hostname.toLowerCase();
  if (url.protocol !== 'https:') {
    throw new Error(`Remote "extends" URL ${url.href} must use https`);
  }
  if (!hostname || isPrivateOrLoopbackHost(hostname)) {
    throw new Error(`Remote "extends" URL targets a disallowed host: ${url.href}`);
  }
  // The literal hostname can still resolve to an internal address (e.g. *.localtest.me → 127.0.0.1).
  const records = await dns.lookup(hostname, { all: true });
  for (const { address } of records) {

View on GitHub (pinned to d9bb2b0142)

When it happens

Trigger: Thrown at packages/insomnia/src/main/bundle-spectral-ruleset.ts:74 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Kong/insomnia@d9bb2b0142 (2026-08-26). Data as JSON: /api/errors/a18e6b66154f435c. Report an issue: GitHub.