Skip to main content
← Back to list
01Issue
BugClosedSwamp CLIPublic
Assigneesstack72

Relationships

#1822 swamp doctor extensions validates cached bundle instead of source on disk

Opened by stack72 · 8/25/2026

Reported as Defect 2 in issue #1817. When a model source file changes under .swamp/pulled-extensions/, swamp doctor extensions continues to validate the stale cached bundle in .swamp/bundles/ rather than the current source. This means doctor can report PASS for a broken source or FAIL for a fixed source, depending on cache state. The warning 'Using cached bundle — source may have changed but bundle could not be regenerated' is emitted but does not fail the check. Suggested fix: invalidate a bundle on source-hash change, or make the 'could not be regenerated' condition a failure rather than a warning. See issue #1817 for the full reproduction matrix.

02Bog Flow
OPENTRIAGEDIN PROGRESSCLOSED+ 1 MOREASSIGNED+ 2 MOREREVIEW

Closed

8/25/2026, 10:00:06 PM

No activity in this phase yet.

03Sludge Pulse
stack72 assigned stack728/25/2026, 9:32:55 PM
Editable. Press Enter to edit.

stack72 commented 8/25/2026, 10:00:06 PM

Closing as won't-fix. Pulled extensions are immutable registry artifacts — editing source files under .swamp/pulled-extensions/ is not a supported workflow and breaks the chain of trust.

The current behavior (using the cached bundle via trustPulledCache) is actually safe: the modified source code is ignored, and the original registry bundle is what gets validated and executed. This is the correct outcome — untrusted modifications should not be loaded.

Adding detection/enforcement would introduce complexity in the reconcile path for an unsupported scenario. If someone needs to modify an extension, the supported path is forking it as a local extension.

Sign in to post a ripple.