EXTENSIONS

Read-only Uptime Kuma monitor history for triage: the last N heartbeats of one monitor -- status, time, message, ping -- plus a summary of the current status, since when, and how many times it changed in the window. Kuma has no REST endpoint for heartbeat history, and its socket.io API needs the instance's only kind of login, an administrator, so any credential that can read history can also delete monitors and read notifier secrets. This model instead reads kuma.db over SSH with the host's python3, opening the database mode=ro with PRAGMA query_only=ON so SQLite itself refuses any write, and selects named columns from the monitor and heartbeat tables only: never notifier settings, credentials, monitor URLs or hostnames, or heartbeat response bodies. Monitors are found by id or by name (exact, else a unique case-insensitive substring; ambiguity is an error listing the candidates). It needs no Kuma login, never enters the container, never copies the database off the host, and has no write method.

A read-only container listing of a Docker host over SSH, narrow enough to hand to an unattended triage agent. It answers the first question an alert usually raises -- what is running on that host, and which container holds that port -- with name, image, state, status, published ports and creation time per container. It runs `docker ps` with an explicit, per-field `--format` template and rebuilds each row from those fields alone, so no environment variable and no label value ever leaves the host: `docker inspect` returns every container's environment, which is where compose files keep database passwords and API tokens, and `docker ps --format '{{json .}}'` includes the Labels field. The type has exactly one method and no free-form command or format argument, so a model instance exposes no write verb at all. Host key checking stays on by default.

Read the last lines of a log chosen by NAME from an allowlist fixed in the model definition, with secret values redacted. Built for an alert-triage agent that has no shell: an alert names a log, the cause is usually one line near its end, and the alternatives are a human tailing it for the agent or a general file-read tool that can read anything. The caller passes a name, never a path; the name-to-path map lives in the definition, where only its owner can change it. A name is matched with Object.hasOwn and a name that is not name-shaped is never echoed, because `--input name=@file` would otherwise turn a refusal into a read. The configured path must be absolute, normalised, a regular file, not a symlink and equal to its own realpath, and the opened file's device and inode must match the lstat taken before the open, so a symlink swapped in between is refused rather than followed. Output is capped at 200 lines. Redaction drops values and keeps names (`password=[REDACTED]`) across key=value, JSON, YAML, CLI flags, URL userinfo, Authorization headers and bare token shapes, and fails closed: a line mentioning a password manager CLI or a private key is withheld whole, a line still credential-shaped after redaction is withheld whole, and an error in redaction fails the method. Both methods are read-only.

GitHub issue lifecycle tracker for swamp. Drives issues from open through

Investigate why any swamp model or workflow is failing, without knowing anything about the domain it automates. Every method and workflow run leaves a @swamp/method-summary or @swamp/workflow-summary report behind as versioned model data, written on failure as well as success — so the full history of a target is already on disk with nothing extra instrumented. `investigate` resolves a target by name at call time, walks that history back to the boundary where it stopped working, and classifies the error into auth / unreachable / timeout / tls / rate_limit / not_found / config, each with a concrete next step. The distinction it exists to make is auth vs unreachable: a remote answering 403 is healthy and rejecting your credential (go to the vault), while a remote that never answers is a network problem (go to the host) — the two read almost identically in a notification and lead opposite ways. Unrecognised errors are reported as `unknown` verbatim rather than filed under a plausible-looking category. A run that failed without recording any error text is reported as `unrecorded`, never as `none`. `recent` answers the question an alert with no name leaves open -- what just broke? -- by listing every model and workflow that failed within a window -- still failing first, then those that have since recovered, with when -- each with its instance name and model type and classified the same way. Both methods tell the caller's mistakes apart from the fleet's failures: `recent` flags the investigator's own failed runs (selfInflicted) and a failure fixed by an immediate retry of the same method (quickRetry), reports each target's definition path, and lists scheduled workflows with no recorded run at all (a schedule that never fires leaves no failure anywhere else); `investigate` reports a target with no runs as never_run -- failing when it is scheduled to run here -- suggests the closest names for one that matches nothing, and separates a rejected call argument (caller_args) from a definition problem (config). A failed workflow step is reported with the error its own run recorded, and an expression that failed to evaluate classifies as config. `resolve` maps free alert text to the model and workflow names it most likely means -- token overlap with names, types, tags and descriptions, top matches with score -- for an alert that does not name its target. Read-only: every method reads what previous runs recorded and never invokes the failing target.

Bounded batch triage for `@swamp/typesafe-ai`. Adds one method,

Narrow, typed Swamp Club Lab issue intake and approved-ripple adapter.

CloudWatch alarm investigation and triage model.

Datadog Security Signals — signal search, triage, and archiving

Cross-provider, approval-gated triage policy, workflows, prompts, and factory definition.

Sweep an owner's repositories for open Dependabot pull requests and split the review queue from the abandoned-repo noise

Read Claude Code's own session transcripts as swamp data.

Workflow-scope report that renders a one-look snapshot of the