Skip to main content
← Back to list
01Issue
BugOpenSwamp CLI
AssigneesNone

Relationships

#1453 model validate: transport-reachable preflight sends unresolved vault CEL expression as credential

Opened by matt · 7/29/2026

Description

`swamp model validate ` runs a "Check: transport-reachable" preflight that makes a live connectivity call to the target service. For model types whose transport config references a secret via a vault CEL expression (`${{ vault.get('vault-name', 'KEY') }}`), this preflight sends the literal, unresolved expression string as the credential instead of resolving it first. This produces a false authentication failure on validate, even though the model is correctly configured and works when a method is actually run (`swamp model method run` resolves the same expression correctly).

Steps to Reproduce

  1. Create a vault and store a secret: ``` swamp vault create local_encryption homelab --json swamp vault put homelab MY_SECRET=[REDACTED-SECRET-1] --json ```
  2. Create a model whose transport config references the secret via CEL, e.g. with `@stateless/proxmox/qemu`: ```yaml globalArguments: name: my-proxmox transport: kind: api node: mynode apiUrl: https://pve.example.com tokenId: user@pam!tokenname tokenSecret: ${{ vault.get('homelab', 'MY_SECRET') }} skipTlsVerify: false ```
  3. Run `swamp model validate my-proxmox --json`. The `transport-reachable` check fails with an auth error (e.g. HTTP 401), even though the token/secret pair is valid.
  4. Run `swamp model method run my-proxmox nodeStatus --json` (or any method that calls out over the same transport). This succeeds (or fails with a different, legitimate error such as a permissions 403) — proving the vault expression resolves correctly at method-execution time, just not during `validate`'s preflight check.

Expected Behavior

`swamp model validate`'s transport-reachable check should resolve vault CEL expressions in `globalArguments` the same way `swamp model method run` does, before using those values in its live connectivity check.

Actual Behavior

The preflight check appears to use the raw, unresolved `${{ vault.get(...) }}` string as the credential, causing a spurious authentication failure and misleading the user into debugging a nonexistent credential/permissions problem.

Environment

  • Extension observed with: @stateless/proxmox 2026.06.12.1 (transport-reachable check is implemented per-extension, but the resolution gap appears to be in swamp's own validate/preflight execution path, not the extension code)
  • Vault type: local_encryption
  • Repo swamp version: 20260718.233837.0
02Bog Flow
◉OPEN○TRIAGED○IN PROGRESS○SHIPPED

Open

7/29/2026, 5:13:02 AM

No activity in this phase yet.

03Sludge Pulse

Sign in to post a ripple.