Skip to main content
← back to extensions

Cve Fleet

@svendowideit/cve-fleetv2026.10.26.3beta· MIT· 1d agoBEHAVIORSWORKFLOWSACCEPTED WARNINGS
01README

Fleet-wide discovery, scanning and one-page reporting for the @swamp/cve/* extension family. WHAT IT DOES

Discovers every @swamp/cve/* extension in the registry, pulls new ones, updates installed ones, and classifies each as a host scanner, lockfile scanner or research pipeline. It then builds a target list from connected swamp workers, the local serve host and probed/reporting fleet hosts, scans locally where possible and over SSH for the rest, and collates every result into one self-contained HTML page plus markdown and JSON summaries. The page lists the concrete action to take on each host, links every scanner extension and CVE/advisory, and marks what is new, solved or changed since the previous run. Prefer it over a hand-maintained list of scanners and hosts: new scanners are picked up automatically and unreachable hosts are reported instead of being silently treated as clean.

INSTALL

swamp extension pull @svendowideit/cve-fleet

DEPENDENCIES

None at install time. At run time it uses the swamp CLI to pull/update extensions, and the @swamp/cve extensions it discovers. SSH fallback scans use the @swamp/cve scanners' own SSH support; credentials can be reused from an @swamp/ssh model.

RUN

# Run the whole daily pipeline through the site workflow.
swamp workflow run @figy/cve-daily

# Discover, pull and classify the current @swamp/cve scanners only.
swamp model @svendowideit/cve-fleet method run cve-fleet sync

# Build the worker/serve/SSH target list.
swamp model @svendowideit/cve-fleet method run cve-fleet inventory

CONFIGURE

Optional global arguments: registryQuery (default @swamp/cve), autoPull (true), autoUpdate (true), reloadServe (true), outputDir (~/.local/share/cve-report), retentionDays (7), fleetModel (fleet), sshModel (pi-ssh), includeSilent (false), extraHosts ([]), and lockfiles ([deno.lock, package-lock.json]).

UPGRADE

# Update the extension code, then re-run sync/inventory (the bundled
# upgrade workflow is idempotent).
swamp extension update @svendowideit/cve-fleet
swamp workflow run @svendowideit/cve-fleet-upgrade

WHAT IT INSTALLS

Nothing on the host. It writes a catalog, target list, plan and summary as swamp resources, and writes index.html, report.md, summary.json and history files into outputDir. It does not install services or cron jobs.

02Behaviors1
@svendowideit/cve-fleetv2026.10.26.3cve_fleet.ts

Global Arguments

ArgumentTypeDescription
registryQuery?stringRegistry query used to discover CVE extensions
autoPull?booleanPull newly discovered extensions
autoUpdate?booleanUpdate installed extensions to the latest version
reloadServe?booleanReload the running serve after pulling or updating extensions
outputDir?stringDirectory for index.html, report.md and summary.json
retentionDays?numberDays of HTML history to keep
fleetModel?stringName of the @svendowideit/fleet-inventory model
sshModel?stringName of the @swamp/ssh model whose transport and host list are reused
sshUser?stringSSH user override when the ssh model cannot be read
sshKey?stringSSH identity file override when the ssh model cannot be read
includeSilent?booleanInclude silent/unprobed fleet hosts in the SSH fallback list
extraHosts?arrayExtra host names or user@host entries to scan over SSH
lockfiles?arrayLockfile paths (relative to the repo) for lockfile scanners
fn sync()
Discover, pull, update and classify every @swamp/cve extension
fn inventory()
Build the worker/serve/SSH target list from swamp data and fleet inventory
fn plan()
Build local, SSH, lockfile and research fan-out items from the catalog and targets
fn collate(runId: string)
Collate a workflow run's CVE results into one self-contained HTML report
ArgumentTypeDescription
runIdstringWorkflow run id whose scanner data should be collated

Resources

catalog(infinite)— Discovered @swamp/cve extensions and their runner mode
targets(infinite)— Worker, serve, and SSH fallback scan targets
plan(infinite)— Executable fan-out items for the scan workflow
summary(infinite)— Collated CVE results and report paths
03Workflows1
@svendowideit/cve-fleet-upgrade03607b7d-2071-4ba8-a13d-2a5ea0bdceed

Idempotent upgrade/repair for @svendowideit/cve-fleet and the scanners it manages. Re-reads the registry, pulls new @swamp/cve extensions, updates installed ones, reloads the serve, rebuilds the target list, and asserts that a catalog was produced. Installing the extension itself is `swamp extension update @svendowideit/cve-fleet`; this workflow is the reconcile/verify half.

upgradeSync the scanner catalog, rebuild targets, verify.
1.sync— Pull new scanners, update installed ones, reload serve.
2.inventory— Rebuild the worker/serve/SSH target list.
3.verify— Fail unless sync produced a non-empty catalog.
04Previous Versions2
2026.10.26.2MIT
2026.10.26.1MIT
05Stats
A
93 / 100
Downloads
4
Archive size
43.0 KB
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit1/2partial
    • @std/assert--jsr:@std/assert@1 is a range; audited 1.0.19, the version the registry resolved
    1 dependency found
    • jsr:@std/assert@1 -- audited 1.0.19
  • Docs keep secrets in a vault1/1earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License2/2earned
  • Verified public repository2/2earned
Repository
https://github.com/svendowideit/swamp-extensions

07Platforms