Skip to main content
← Back to list
01Issue
BugOpenSwamp CLI
AssigneesNone

Relationships

#1326 Published extension scores dependency-trust as "missing" (0/2) while client `extension quality` earns it (2/2); no verdict exposed

Opened by magistr · 7/21/2026

Summary

The dependency-trust quality factor ("Dependencies pass trust gates") is scored inconsistently between the client CLI and the server-side registry, and when it fails the server exposes no verdict for authors to act on.

For @magistr/stripe-mpp@2026.07.21.2 (beta):

  • Client swamp extension quality stripe-mpp/manifest.yaml --json → dependency-trust earned (2/2), overall 14/14 (100%). It audits the two direct npm imports mppx@0.8.12 and stripe@22.4.0-beta.1; both pass (MIT, high weekly downloads, not deprecated, no OSV vuln).
  • Running the domain checker directly — checkDependencyTrust(...) from src/domain/extensions/extension_dependency_trust_checker.ts against those two specifiers — returns { errors: [], warnings: [], passed: true } (fresh, no cache).
  • Server / published page (https://swamp-club.com/extensions/@magistr/stripe-mpp?channel=beta) shows "Dependencies pass trust audit ×0/2", status "missing", dropping the published grade from A (100%) to B (85%).
  • swamp extension info @magistr/stripe-mpp --json reports "score": { "percentage": 85, "grade": "B" } and "dependencies": [] — the registry recorded zero dependencies for the extension.

Two distinct problems

  1. Client/server divergence. The server marks dependency-trust as missing/0 for deps that the client — and the shared checkDependencyTrust code — earn (2/2). The published grade is wrong (B instead of A). A locally-green extension publishes as trust-failing.
  2. No verdict surfaced. Neither the extension page nor swamp extension info --json states WHICH dependency failed or WHY (deprecated / OSV vuln / not-evaluated). The status "missing" (as opposed to "failed") suggests the server never computed or persisted a dependency-trust result rather than computed-and-failed. Authors have no way to diagnose or fix.

Steps to reproduce

  1. Publish @magistr/stripe-mpp 2026.07.21.2 to the beta channel. Its model source (extensions/models/stripe_mpp.ts) imports npm:mppx@0.8.12, npm:mppx@0.8.12/server, and npm:stripe@22.4.0-beta.1.
  2. Client: swamp extension quality stripe-mpp/manifest.yaml --json → dependency-trust earned (2/2), 100%, dependencyTrust.passed = true, two deps audited.
  3. Registry: open the extension page, or swamp extension info [@magistr](/u/magistr)/stripe-mpp --json → dependency-trust "missing" (0/2), grade B (85%), dependencies: [].

Leads for the maintainers

  • The registry stores dependencies: [] for this extension. The server-side dependency extraction appears not to have run or persisted at publish, so the trust factor is unevaluable → "missing" → 0/2 (and it silently downgrades the grade).
  • Worth checking as a contributing cause: the model source stripe_mpp.ts contains a raw NUL byte (an intentional SHA-256 idempotency-key domain separator, `${op}\x00${input}` at ~line 318). Because of the NUL, file(1) classifies the source as data and plain grep skips it as binary. The client extractor (extractDependencySpecifiers) uses Deno.readTextFile and reads it (NUL and all), so it finds mppx/stripe. If the server-side extractor reads the file with any binary/text detection (or a non-Deno path), it may skip the file and extract zero deps — matching the observed dependencies: []. (Hypothesis — flagging as a lead.)
  • Separately, a latent inconsistency in fetchNpmFacts (extension_dependency_trust_checker.ts): the deprecated / license / lastPublish facts are read from the latest dist-tag version's manifest, while OSV is queried on the pinned version. Not the cause here, but a correctness gap (a deprecated pinned version would be missed).

Asks

  1. Expose the server-side dependency-trust verdict — the audited deps plus errors/warnings, or an explicit "not evaluated / reason" — on the extension page and via swamp extension info --json, so authors can see what failed.
  2. Reconcile server scoring with the client checkDependencyTrust (same inputs, same fail-open-on-unreachable behavior). A "missing"/unevaluated factor should not silently score 0/2 and downgrade the grade as if the check had failed.

Environment

  • swamp CLI: 20260720.142822.0-sha.0caa5556
  • Extension: @magistr/stripe-mpp @ 2026.07.21.2 (beta channel)
  • Relevant source (main): src/domain/extensions/extension_dependency_trust_checker.ts (fail conditions = deprecated OR OSV HIGH/CRITICAL/UNKNOWN; everything else is a non-blocking warning), src/domain/extensions/extension_dependency_extractor.ts (audits direct npm:/jsr: imports parsed from the model source, zod excluded).
02Bog Flow
◉OPEN○TRIAGED○IN PROGRESS○SHIPPED

Open

7/21/2026, 6:53:22 PM

No activity in this phase yet.

03Sludge Pulse

Sign in to post a ripple.