"TRIAL ENDED" modal shown to team plan user when toggling extension visibility

s14d ago

#3288

swamp repo upgrade does not remove the superseded skills it warns about

s14d ago

#3287

Extension safety scanner rejects .eval() method calls, blocking @swamp/stagecraft install

14d ago

#2476

swamp serve does not register webhook schemes from pulled extensions; boot fails with misleading 'already installed but failed to load'

s1mo ago

#2291

Subscription-end email wrongly says 'trial ended' after paid subscription

k1mo ago

#2234

Hot-reload serve.yaml webhook routes (like trigger overrides), not just at startup

s1mo ago

#2204

Add a static-token webhook scheme (constant-time header equality) for Telegram-style secret tokens

z1mo ago

#2026

writeCatalogExport takes 55-150s per workflow step — serializes entire catalog as pretty-printed JSON

s1mo ago

#2003

buildDeps should reuse repoContext.unifiedDataRepo instead of creating a standalone repo per step

s1mo ago

#1984

readResource returns stale cursor on serve scheduled workflow runs

s1mo ago

#1955

serve boot: sweepStaleRecords does a full modelMethodRun per stale lease (~12.5s each), serializing boot reconciliation — 4m28s to sweep nothing

s1mo ago

#1941

install.sh: 'stable' alias tarball and .sha256 are published non-atomically — checksum verification fails during every release window

s1mo ago

#1915

swamp extension quality resolves datastores: against the repo root but models: against the manifest dir — datastore extensions are unscorable in a monorepo

s1mo ago

#1866

`--server` list commands render the TUI picker into a non-TTY pipe

s2mo ago

#1759

`search` → `list` aliases are hand-rolled Command clones, not aliases: 10 of 11 have drifted from their parent's option set

s2mo ago

#1733

Website extension search ignores API relevance — exact name match "good-planning" ranks #10 (API ranks it #1)

k2mo ago

#1139

Lab: URLs inside list items aren't clickable (linkified) in rendered issue bodies/summaries

k2mo ago

#1600

swamp serve: data.query fails permanently with "UNIQUE constraint failed: catalog.*" — one duplicate catalog 5-tuple aborts every catalog rebuild

s2mo ago

#1555

extension search: channel-filtered results carry null version fields, and multiple --channel values collapse instead of unioning

s2mo ago

#1552

Workflow runs with wide dataArtifact fan-out (~400/run) OOM both workflow history get and swamp serve boot, crash-looping the scheduler; rollback doesn't help (state-triggered, not release-triggered)

s2mo ago

#1490

extension quality scorer misreads a template-literal import specifier in generated code as an unresolvable bare import, hard-erroring the whole extension as UNSCORABLE

k2mo ago

#1481

extension quality --json exits 1 with 'rubric factors missing' even when a full score was computed (unearned factor, not uncomputable)

s2mo ago

#1467

seadex-latent-bugs: latent product bugs pinned by the wave-2b test backfill

2mo ago

#1440

data delete removes data locally but push reports 'no changes' — next datastore sync restores everything

s3mo ago

#1420

No way to select which vault receives a sensitive-marked field's value

s3mo ago

#1427

workflow assert: a step whose CEL expression fails to evaluate is omitted from --junit output, so the XML reports a clean pass

3mo ago

#1414

worker daemon enable: relative/missing --cache-dir fails launchd EX_CONFIG while daemon status reports running

s3mo ago

#1419

swamp doctor extensions: nondeterministic BundleBuildFailed for local extensions on an unchanged tree

sBlocked2mo ago

#1392

Issue redactor corrupts reports: dotted code identifiers masked as hostnames, loopback and RFC 5737 documentation IPs masked, angle-bracket placeholders half-eaten

s3mo ago

#1396

data prune resolves auto-definitions at the local path, not the datastore path — deletes live models' data (verified: destroyed a working server token and an active grant)

s3mo ago

#1398

workflow/job-lifetime data is never reclaimed — expiry check requires an ownerDefinition.workflowId that step execution never sets

s3mo ago

#1399

runModel breadth limit (MAX_INVOCATION_BREADTH=100) is never enforced — tracking object is never written back to the caller context; verified 150/150 calls succeeded

s3mo ago

#1391

serve daemon enable is ungated — it reports success, then the account gate fires inside the detached daemon, which crash-loops invisibly

3mo ago

#1390

Purely local operations require a swamp-club account: local-token serve is gated while deprecated --auth-mode none is not, third-party OIDC is gated, and 'Local_Encryption' is paywalled by capitalization

3mo ago

#1389

A collective token stored in auth.json (rather than SWAMP_API_KEY) is permanently scope-less — resolution only runs for the env var, and scopes are never persisted for collective tokens

3mo ago

#1388

An empty stored apiKey counts as authenticated — saveIdentityCache writes apiKey:'' on a virgin machine, permanently satisfying the mandatory-account gate with no credential

3mo ago

#1387

Account/scope gates fire before argument, type and repo validation — 'swamp vault create env my-vault' (the command's own example, an invalid type) returns a paywall instead of 'Unknown vault type'

3mo ago

#1386

auth token create advertises a 'collective:write' scope that does not exist, and following its advice hits 'collective tokens cannot create other collective tokens'

3mo ago

#1385

requireScope does exact string matching — fine-grained scopes fail gates that demand the literal wildcard, and minted scopes are never validated or normalized

3mo ago

#1384

Collective-token scope cache never expires, is never refreshed by whoami, and cannot be cleared via the CLI — scope changes and revocations never take effect

3mo ago

#1382

Collective-token scope cache is keyed on a 12-char token prefix — only 2 chars distinguish org tokens, so a rotated token silently inherits another token's scopes

3mo ago

#1381

Misleading 'Your collective token lacks the X scope' when scope resolution failed — startup whoami errors are silently swallowed

s3mo ago

← Back to list

01Issue

BugClosedSwamp CLIPublic

AssigneesNone

Relationships

#1709 Datastore MongoDB driver leaks connections — 5960 accumulated over 8 days

Opened by magistr · 8/18/2026

Summary

The swamp datastore's MongoDB driver (nodejs v6.17.0 via Deno) accumulates connections over time without closing them. After 8 days of uptime, MongoDB showed ~5960 concurrent connections all from the same swamp client ([IP-1]), pushing memory to the 4g cgroup limit and causing Docker healthcheck failures.

Observed behavior

connectionCount in MongoDB logs climbed to ~5960 over 8 days
All connections originated from a single swamp client IP ([IP-1]) using the Deno nodejs MongoDB driver v6.17.0
Container memory reached 4041 MB / 4096 MB (4g mem_limit)
WiredTiger cache is configured at 2 GB (--wiredTigerCacheSizeGB 2), so the remaining ~2 GB was consumed by connection overhead
Docker healthcheck (mongosh --quiet --eval "db.adminCommand('ping').ok" with 10s timeout) started failing — the mongosh process couldn't complete within timeout under memory pressure
Manual db.runCommand({ping:1}) still succeeded (the database itself was responsive)
container_last_seen metric was current — cAdvisor saw the container as alive

Expected behavior

The driver should close idle connections and maintain a bounded connection pool. Connection count should stabilize at the pool size, not grow linearly with uptime.

Reproduction

Run any swamp repo with a MongoDB datastore for several days. Monitor connectionCount in MongoDB logs (visible in the "Connection accepted" log entries). The count will grow monotonically.

Environment

MongoDB: mongo:7 (v7.0.34), single-node replica set rs0 with keyFile auth
Driver: nodejs v6.17.0 via Deno v2.8.3
Container: 4g mem_limit, --wiredTigerCacheSizeGB 2
Swamp version: 20260814.234054.0-sha.7823c130

Workaround

Restart the MongoDB container periodically to clear leaked connections. Consider adding maxIncomingConnections to mongod config as a safety cap.

02Bog Flow

Closed

8/18/2026, 5:55:13 PM

No activity in this phase yet.

03Sludge Pulse

magistr commented 8/18/2026, 4:36:41 PM

Correction on root cause: the connection accumulation is not from idle connection leaks — it occurred under additional load. The swamp client was actively running model methods and workflows, and the driver opens new connections under load without properly returning them to the pool or closing them when done. The growth correlates with activity volume, not idle time.

stack72 commented 8/18/2026, 5:13:00 PM

@magistr I believe this needs to be opened https://github.com/keeb/swamp-mongodb-datastore

"TRIAL ENDED" modal shown to team plan user when toggling extension visibility

swamp repo upgrade does not remove the superseded skills it warns about

Extension safety scanner rejects .eval() method calls, blocking @swamp/stagecraft install

swamp serve does not register webhook schemes from pulled extensions; boot fails with misleading 'already installed but failed to load'

Subscription-end email wrongly says 'trial ended' after paid subscription

Hot-reload serve.yaml webhook routes (like trigger overrides), not just at startup

Add a static-token webhook scheme (constant-time header equality) for Telegram-style secret tokens

writeCatalogExport takes 55-150s per workflow step — serializes entire catalog as pretty-printed JSON

buildDeps should reuse repoContext.unifiedDataRepo instead of creating a standalone repo per step

readResource returns stale cursor on serve scheduled workflow runs

serve boot: sweepStaleRecords does a full modelMethodRun per stale lease (~12.5s each), serializing boot reconciliation — 4m28s to sweep nothing

install.sh: 'stable' alias tarball and .sha256 are published non-atomically — checksum verification fails during every release window

swamp extension quality resolves datastores: against the repo root but models: against the manifest dir — datastore extensions are unscorable in a monorepo

`--server` list commands render the TUI picker into a non-TTY pipe

`search` → `list` aliases are hand-rolled Command clones, not aliases: 10 of 11 have drifted from their parent's option set

Skip 50MB monolithic index rewrite on v2 shard-first path

Share single AwsS3Client instance across lock, sync, and verifier

Double shard assembly per command lifecycle (pull + push both read all shards)

pullChanged never records commitSeq for shard-first (v2) index

localHasAllRemoteEntries() permanently blocks sidecar update on partial caches

Datastore MongoDB driver leaks connections — 5960 accumulated over 8 days

Feed: detect and gracefully handle dead (404) post links (link rot)

/feed: per-post unread indicators and mark-as-read to track reading progress

Website extension search ignores API relevance — exact name match "good-planning" ranks #10 (API ranks it #1)

Lab: URLs inside list items aren't clickable (linkified) in rendered issue bodies/summaries

swamp serve: data.query fails permanently with "UNIQUE constraint failed: catalog.*" — one duplicate catalog 5-tuple aborts every catalog rebuild

extension search: channel-filtered results carry null version fields, and multiple --channel values collapse instead of unioning

Workflow runs with wide dataArtifact fan-out (~400/run) OOM both workflow history get and swamp serve boot, crash-looping the scheduler; rollback doesn't help (state-triggered, not release-triggered)

extension quality scorer misreads a template-literal import specifier in generated code as an unresolvable bare import, hard-erroring the whole extension as UNSCORABLE

extension quality --json exits 1 with 'rubric factors missing' even when a full score was computed (unearned factor, not uncomputable)

seadex-latent-bugs: latent product bugs pinned by the wave-2b test backfill

data delete removes data locally but push reports 'no changes' — next datastore sync restores everything

No way to select which vault receives a sensitive-marked field's value

workflow assert: a step whose CEL expression fails to evaluate is omitted from --junit output, so the XML reports a clean pass

worker daemon enable: relative/missing --cache-dir fails launchd EX_CONFIG while daemon status reports running

swamp doctor extensions: nondeterministic BundleBuildFailed for local extensions on an unchanged tree

Issue redactor corrupts reports: dotted code identifiers masked as hostnames, loopback and RFC 5737 documentation IPs masked, angle-bracket placeholders half-eaten

data prune resolves auto-definitions at the local path, not the datastore path — deletes live models' data (verified: destroyed a working server token and an active grant)

workflow/job-lifetime data is never reclaimed — expiry check requires an ownerDefinition.workflowId that step execution never sets

runModel breadth limit (MAX_INVOCATION_BREADTH=100) is never enforced — tracking object is never written back to the caller context; verified 150/150 calls succeeded

serve daemon enable is ungated — it reports success, then the account gate fires inside the detached daemon, which crash-loops invisibly

Purely local operations require a swamp-club account: local-token serve is gated while deprecated --auth-mode none is not, third-party OIDC is gated, and 'Local_Encryption' is paywalled by capitalization

A collective token stored in auth.json (rather than SWAMP_API_KEY) is permanently scope-less — resolution only runs for the env var, and scopes are never persisted for collective tokens

An empty stored apiKey counts as authenticated — saveIdentityCache writes apiKey:'' on a virgin machine, permanently satisfying the mandatory-account gate with no credential

Account/scope gates fire before argument, type and repo validation — 'swamp vault create env my-vault' (the command's own example, an invalid type) returns a paywall instead of 'Unknown vault type'

auth token create advertises a 'collective:write' scope that does not exist, and following its advice hits 'collective tokens cannot create other collective tokens'

requireScope does exact string matching — fine-grained scopes fail gates that demand the literal wildcard, and minted scopes are never validated or normalized

Collective-token scope cache never expires, is never refreshed by whoami, and cannot be cleared via the CLI — scope changes and revocations never take effect

Collective-token scope cache is keyed on a 12-char token prefix — only 2 chars distinguish org tokens, so a rotated token silently inherits another token's scopes

Misleading 'Your collective token lacks the X scope' when scope resolution failed — startup whoami errors are silently swallowed

Relationships

#1709 Datastore MongoDB driver leaks connections — 5960 accumulated over 8 days

Summary

Observed behavior

Expected behavior

Reproduction

Environment

Workaround

Closed