EXTENSIONS

Speak text aloud on macOS using the built-in `say` voice synthesizer. One focused method: synthesize text to audio and play it through the speakers, with optional voice and speech-rate control. Zero external dependencies — uses only the native macOS `say` and `afplay` binaries.

Read-only client for MySQL and Aurora MySQL. Checks connectivity, runs

Repository hygiene checks for swamp repos — hardcoded absolute home paths in model/workflow sources (test fixtures and the Linuxbrew prefix exempted), pulled extensions whose source files are missing, generated .swamp artifacts not covered by .gitignore, and workflow wiring drift: scripts missing an exec bit/shebang, declared schedules with no live registration, and dead step dependencies that skip silently or dereference the outputs of a failed step. Writes a combined markdown report plus per-check structured resources.

Run AI coding agents (Claude, Codex) with structured output for CI

Observe Route53 hosted zones, record sets, and detect orphaned DNS records

Choose which model each kind of work uses, and fall back to the next model

SOPS + age vault for swamp: one encrypted file per secret.

Run AI coding agents headless from swamp workflows and record what each run

Upload local files into Google Drive (My Drive), under a named folder.

A tiny dedup ledger for swamp pipelines: remember which ids have already

Finds and mitigates hosts exposed to Tailworm, the security assessment of

Inspect, create and convert X.509 material with the local `openssl` CLI.

Install, run and inspect a local mitmproxy (HTTP/HTTPS intercepting proxy)

Drive a 44x11 LED name badge (USB 0416:5020, WCH CH583 "LSLED" / Badge

Swamp vault backed by a running KeePassXC, reached through its Browser

One hourly HTML status page for a mixed Debian-family fleet: it audits pending

Run pixiecore as a managed container, auto-configured to serve netboot.xyz to any host that netboots on the LAN.

Finds and fixes Brotli decoders exposed to **CVE-2026-111497**

Finds and fixes Linux, macOS and Windows hosts and Linux containers that

Finds and patches PHP installs exposed to the critical PHP remote code

Set up an Ubuntu host to run KVM/QEMU virtual machines with libvirt, the way the kvm-training deck does it, with the check/apply pattern @adam/cfgmgmt uses: host (the QEMU, libvirt and virtinst packages, and the user added to libvirt and kvm), pool (directory storage pools), network (nat, bridge, macvtap or routed), vm (Ubuntu Server guests from the release's cloud image, checked against SHA256SUMS and configured by cloud-init, with their address from qemu-guest-agent, and snapshots) and uplink, which says which of those can work on the host and why: Wi-Fi can't be bridged, a host that is itself a VM needs its hypervisor's help, and Docker can block bridged traffic. Every type runs on the host itself, as a swamp worker step, or over SSH with cfgmgmt's nodeHost arguments; workflows for both are included.

Install and run Deno commands. Manages Deno binary downloads with

File-backed configuration store for PR sweep repository pairs (upstream + fork), with enabled/disabled flags, a markdown summary, and methods to add, remove, toggle, and update pairs. The companion to the @maphew/pr-sweep workflow.

Sweep open pull requests a fork contributes to an upstream GitHub repo. Composable steps — list, review (one agent per batch), sync, verdicts, summary — so an orchestrator (Ceph, a foreman agent, a workflow, or you) plans the work and delegates it, while `sweep` remains as the one-call convenience. Queryable per-PR and run-summary resources; the sweeper prompt ships as a bundled asset.