{"record":{"id":"1bbf033d814ba933","repo":"zed-industries/zed","slug":"capability-for-npm-install-package-name-is-not-g","errorCode":null,"errorMessage":"capability for npm:install {package_name} is not granted by the extension host","messagePattern":"capability for npm:install (.+?) is not granted by the extension host","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/extension_host/src/capability_granter.rs","lineNumber":79,"sourceCode":"            );\n        }\n\n        Ok(())\n    }\n\n    pub fn grant_npm_install_package(&self, package_name: &str) -> Result<()> {\n        let is_allowed = self\n            .granted_capabilities\n            .iter()\n            .any(|capability| match capability {\n                ExtensionCapability::NpmInstallPackage(capability) => {\n                    capability.allows(package_name)\n                }\n                _ => false,\n            });\n\n        if !is_allowed {\n            bail!(\"capability for npm:install {package_name} is not granted by the extension host\",);\n        }\n\n        Ok(())\n    }\n}\n\n#[cfg(test)]\nmod tests {\n    use std::collections::BTreeMap;\n\n    use extension::{ProcessExecCapability, SchemaVersion};\n\n    use super::*;\n\n    fn extension_manifest() -> ExtensionManifest {\n        ExtensionManifest {\n            id: \"test\".into(),\n            name: \"Test\".to_string(),","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/zed-industries/zed/blob/f4178619acd0d47ea1f76a2025c42962c6d6638c/crates/extension_host/src/capability_granter.rs#L61-L97","documentation":"The host gates npm package installation for WASM extensions through CapabilityGranter::grant_npm_install_package. An `npm:install` capability in the manifest must allow the exact package name (the pattern may only be the exact name or `*`). When the requested package is not granted, it bails naming the package.","triggerScenarios":"Extension code calls the npm install guest function for a package that has no matching [[capabilities]] kind = \"npm:install\" entry — e.g. version-suffixed names, scoped packages (@scope/name) added later, or dynamically chosen packages.","commonSituations":"Language extensions that lazily install grammars/tools per language and the manifest only allowlists some of them; typos or name drift between the code's package string and the manifest entry; new optional dependency added without a capability entry.","solutions":["Add an [[capabilities]] kind = \"npm:install\" entry whose `package` exactly equals the name in the error message.","If the extension legitimately installs a fixed, known set of packages, list each one; only use package = \"*\" when every install is user-driven and trusted.","Rebuild and re-test the extension so the manifest is re-read."],"exampleFix":"# before\n[[capabilities]]\nkind = \"npm:install\"\npackage = \"tree-sitter-javascript\"\n\n# after: also grant the newly added package\n[[capabilities]]\nkind = \"npm:install\"\npackage = \"tree-sitter-javascript\"\n\n[[capabilities]]\nkind = \"npm:install\"\npackage = \"tree-sitter-typescript\"","handlingStrategy":"validation","validationCode":"fn npm_install_allowed(manifest: &ExtensionManifest, package_name: &str) -> bool {\n    manifest.capabilities.iter().any(|capability| match capability {\n        ExtensionCapability::NpmInstallPackage(capability) => capability.allows(package_name),\n        _ => false,\n    })\n}\n\n// before installing from extension code\nassert!(npm_install_allowed(&manifest, \"tree-sitter-typescript\"),\n    \"package lacks an npm:install capability\");","typeGuard":"fn is_npm_install_capable(capability: &ExtensionCapability) -> bool {\n    matches!(capability, ExtensionCapability::NpmInstallPackage(_))\n}","tryCatchPattern":null,"preventionTips":["Enumerate every package the extension can install and add one capability entry per exact name.","Avoid dynamic package names unless they are fully user-supplied and covered by package = \"*\" deliberately.","Unit-test the manifest against the set of packages referenced in code."],"tags":["security","capability","extension","npm","manifest"],"backgroundTag":"permission-denied-capability","analyzedSha":"f4178619acd0d47ea1f76a2025c42962c6d6638c","analyzedAt":"2026-08-20T19:29:52.058Z","contentChangedAt":"2026-08-20T19:29:52.058Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}