can1357/oh-my-pi · error · Error

Invalid package name: ${name}

Error message

Invalid package name: ${name}

What it means

manager.ts's validatePackageName strips any version specifier and tests the base name against VALID_PACKAGE_NAME (npm-style scoped/unscoped names). This error is thrown when an install/uninstall spec's base name does not match that grammar — typically because the spec is a git URL, tarball, file path, or simply malformed. Git specs must go through validateGitSpec instead.

Source

Thrown at packages/coding-agent/src/extensibility/plugins/manager.ts:54

// =============================================================================

/** Valid npm package name pattern (scoped and unscoped, with optional version) */
const VALID_PACKAGE_NAME = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*(@[a-z0-9-._^~>=<]+)?$/i;

/** Characters that are never valid in any plugin install spec — git or npm. */
const SHELL_METACHARS = /[;&|`$(){}<>\\\n\r\t]/;

/**
 * Validate package name to prevent command injection. npm specs only — git
 * specs (`github:user/repo`, `https://github.com/...`, ...) MUST go through
 * {@link validateGitSpec} instead because they contain characters npm rejects
 * (`:`, `/`, `#`, `+`, `@` in non-version positions).
 */
function validatePackageName(name: string): void {
	// Remove version specifier for validation
	const baseName = extractPackageName(name);
	if (!VALID_PACKAGE_NAME.test(baseName)) {
		throw new Error(`Invalid package name: ${name}`);
	}
	// Extra safety: no shell metacharacters
	if (/[;&|`$(){}[\]<>\\]/.test(name)) {
		throw new Error(`Invalid characters in package name: ${name}`);
	}
}

/**
 * Validate a git install spec — accepts `:`, `/`, `#`, `+`, `.`, `-`, `_`,
 * `~`, `@` (which would all fail {@link validatePackageName}) but rejects
 * shell metacharacters so the spec stays safe when forwarded to bun install.
 * `Bun.spawn` does not invoke a shell, but defense-in-depth keeps things
 * obvious for future readers.
 */
function validateGitSpec(spec: string): void {
	if (SHELL_METACHARS.test(spec)) {
		throw new Error(`Invalid characters in plugin source: ${spec}`);
	}

View on GitHub (pinned to 9690622007)

Solutions

1. Use a plain npm package name (optionally with version), e.g. `my-plugin` or `my-plugin@^1.2.0`
2. For GitHub sources use the supported git spec syntax (`github:user/repo`) so validateGitSpec handles it instead
3. Strip whitespace and remove shell metacharacters; validate locally with the npm name rules (lowercase, `-._~`, single scope)
4. If installing from a local directory, use the link mechanism (linkPlugin) rather than install

Example fix

// before
await install("https://github.com/user/my-plugin");
// after
await install("github:user/my-plugin"); // git spec path
// or plain npm
await install("my-plugin");

const VALID = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*(@[a-z0-9-._^~>=<]+)?$/i;
if (!VALID.test(extractPackageName(spec)) || /[;&|`$(){}[\]<>\\]/.test(spec)) {
	throw new Error(`spec must be a plain npm name: ${spec}`);
}

function isNpmSpec(spec: string): boolean {
	const VALID = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*(@[a-z0-9-._^~>=<]+)?$/i;
	return VALID.test(extractPackageName(spec)) && !/[;&|`$(){}[\]<>\\]/.test(spec);
}

try {
	await manager.install(spec);
} catch (err) {
	if (err instanceof Error && err.message.startsWith("Invalid package name:")) {
		// route git/tarball/path specs through the git spec entrypoint instead
	}
	throw err;
}

When it happens

Trigger: install(name) or uninstall(name) called with a git spec (`github:user/repo`, `https://...`), a local path (`./plugin`, `/abs/path`), a malformed npm name (uppercase-with-invalid-chars outside the grammar, spaces, empty string), or a scoped name with invalid characters in scope or package part.

Common situations: Passing a GitHub URL to an npm-name-only entry point; Windows-style backslash paths; typos like `my plugin`; attempting to install a tarball or directory via the package-name API instead of the git/file source path.

Related errors

• Invalid package name: ${name}
• Invalid characters in package name: ${name}
• Invalid path: ${localPath} resolves outside working director
• package.json must have a valid name field
• Invalid package name in package.json: ${pkg.name}

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/6b51cb10c0945497. Report an issue: GitHub.