[Bug]: Bundle pins can become unresolvable after component catalog updates

Look at the bundle resolver code, likely in a module handling extension or component resolution. The bug is that the resolver looks up by ID only, not by ID and pinned version. Find where catalog entries are fetched and version checks are performed. Start by reproducing the scenario with a test bundle and catalog. 'Done' means the resolver correctly attempts to retrieve the pinned version from its original URL even if a newer version is advertised.

Bug Description

Bundle 0.4.12 pins an extension to 0.4.12. Because component catalogs contain only the currently advertised release, updating the extension’s catalog entry to 0.5.1 replaces the version and download URL used by bundle resolution. The resolver looks up the extension by ID—not by ID and pinned version—so the unchanged bundle now resolves to the 0.5.1 entry. The subsequent version check rejects that selection. It never attempts to retrieve 0.4.12, even when that release remains available.

Steps to Reproduce

This scenario is derived from source inspection; runtime reproduction is still needed.

1. Prepare a bundle that pins an extension or preset to version 0.4.12.

2. Make that version available through an install-enabled component catalog.

3. Update the catalog entry to advertise version 0.5.1, leaving the 0.4.12 release artifact available at its original URL.

4. In a fresh initialized project with no affected components installed, configure that component catalog.

5. Install the original bundle using specify bundle install <path-to-bundle.yml>.

6. Observe that component resolution rejects the version mismatch before attempting to retrieve the pinned release.

Expected Behavior

The bundle retrieves and installs its pinned component version when that release remains available, regardless of whether a newer version is advertised.

If the pinned version cannot be retrieved, installation reports that clearly without silently substituting another version.

Actual Behavior

The inspected resolver compares the bundle’s pin against the selected catalog entry’s version and raises an error when they differ. It does not attempt to locate the older pinned release.

Specify CLI Version

1.0.10

AI Agent

GitHub Copilot

Operating System

To be recorded during runtime reproduction.

Python Version

To be recorded during runtime reproduction.

Error Logs

No runtime logs captured. The inspected extension resolver produces the following error for the example above:

Extension 'specassay-check' is pinned to version 0.4.12 in the bundle manifest, but the resolved version is 0.5.1. Update the bundle's pinned version or the source before installing.

Additional Context

Observed during #4703

AI Disclosure

GitHub Copilot using GPT-6 Astra (gpt-6-astra), human-supervised, assisted with source inspection, related-issue research, and drafting this report.