EXTENSIONS

Read the last lines of a log chosen by NAME from an allowlist fixed in the model definition, with secret values redacted. Built for an alert-triage agent that has no shell: an alert names a log, the cause is usually one line near its end, and the alternatives are a human tailing it for the agent or a general file-read tool that can read anything. The caller passes a name, never a path; the name-to-path map lives in the definition, where only its owner can change it. A name is matched with Object.hasOwn and a name that is not name-shaped is never echoed, because `--input name=@file` would otherwise turn a refusal into a read. The configured path must be absolute, normalised, a regular file, not a symlink and equal to its own realpath, and the opened file's device and inode must match the lstat taken before the open, so a symlink swapped in between is refused rather than followed. Output is capped at 200 lines. Redaction drops values and keeps names (`password=[REDACTED]`) across key=value, JSON, YAML, CLI flags, URL userinfo, Authorization headers and bare token shapes, and fails closed: a line mentioning a password manager CLI or a private key is withheld whole, a line still credential-shaped after redaction is withheld whole, and an error in redaction fails the method. Both methods are read-only.

A transport-neutral, secret-redacting notification outbox for swamp workflows that enqueues deduplicated notification records and drains them through a caller-supplied transport, performing no transport I/O itself.

A deterministic published-surface hygiene gate — a CLASSIFIER, not an LLM eval. It answers "does this artifact contain a forbidden identifier?" with rule-based recognizers (private-range IPv4 full-quad, *.ts.net) plus a fleet-aware DENYLIST (owned hostnames / FQDNs / people, matched case-sensitively on word boundaries) and any custom recognizers an instance adds. The flagship `scan` is a HARD GATE: it walks files/dirs and/or inline text and THROWS on a hit by default, so it can back a publish-workflow step, a git pre-push hook, or a Claude Code PreToolUse hook; pass failOnHit=false for an advisory report. `redact` remaps detected identifiers to the swamp-blessed documentation placeholders (RFC 5737 IPs, RFC 2606 example.com). The denylist is the private part — an instance typically derives it via a CEL view over @stateless/inventory, so it grows with the fleet model and is never hand-maintained; the generic recognizers carry no fleet knowledge, so a community checkout with no denylist still runs them. This is the enforced version of the published-surface-hygiene check swamp-club Lab 508 shipped only as advisory.