From bd348e0c3db0fa3134ea0afe78dcdaaba1523f02 Mon Sep 17 00:00:00 2001
From: Marco Allegretti <mightymarco4@gmail.com>
Date: Wed, 11 Mar 2026 18:33:05 +0100
Subject: [PATCH] feat(pack): validate capability strings in check subcommand

check_package() now rejects any capabilities not in the known set:
  fs:rw:app-data, fs:read:app-data,
  fs:rw:xdg-documents, fs:read:xdg-documents

This keeps the manifest in sync with what resolve_preopens() in
weft-appd actually maps; unknown strings would otherwise silently
produce no preopens at runtime.
---
 crates/weft-pack/src/main.rs | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/crates/weft-pack/src/main.rs b/crates/weft-pack/src/main.rs
index 9720f81..97467ef 100644
--- a/crates/weft-pack/src/main.rs
+++ b/crates/weft-pack/src/main.rs
@@ -188,6 +188,18 @@ fn check_package(dir: &Path) -> anyhow::Result<String> {
         if !ui_path.exists() {
             errors.push(format!("ui.entry '{}' not found", ui_path.display()));
         }
+
+        const KNOWN_CAPS: &[&str] = &[
+            "fs:rw:app-data",
+            "fs:read:app-data",
+            "fs:rw:xdg-documents",
+            "fs:read:xdg-documents",
+        ];
+        for cap in m.package.capabilities.iter().flatten() {
+            if !KNOWN_CAPS.contains(&cap.as_str()) {
+                errors.push(format!("unknown capability '{cap}'"));
+            }
+        }
     }
 
     if errors.is_empty() {