v3 crash recovery's progress line breaks --json stderr: a failing command that recovered prints text before its JSON error (regression from #3363 / #3893)

3h ago

#3901

swamp-club.com/cve/tailworm states two things its sources do not say: finding 5's memory growth and no exploitation in the wild

3h ago

#3900

@swamp/cve/tailworm: after mitigate caps headscale, the rescan still tells you to set MemoryMax and Restart=always

4h ago

#3892

WS handshake drops the port from the Origin, so a --trusted-hosts entry with a port never matches (follow-up to #1840)

7h ago

#3887

A workflow step's method output is invisible to `data query` and `data list`, and the method summary's retrieval command returns an older run's data

9h ago

#3885

Skill propulsion rule is silent when no transition is satisfied because stage work is outstanding

10h ago

#3875

Docs: document workflow evaluation counts and subphase timings

1d ago

#3870

package.json mode: no loose-specifier warning for a range push ships as the exact installed version

1d ago

#3869

extension fmt (and any command) creates or rewrites deno.lock when the extension lives in the repo's loaded extensions/ dir

1d ago

#3865

serve shutdown does not wait for worker status writes, and its listener accepts workers after the gateway is disposed

1d ago

#3863

Registry rescore: secret-safe-docs passes a secret README line on versions whose stored metadata predates the sensitive flag (follow-up to #3783)

1d ago

#3855

stagecraft: rename work mode `method` to `behavior`, matching swamp's rename of models to behaviors

1d ago

#3846

invalid-acceptance refuses an apostrophe in a swamp-quality-ignore reason and leaves the finding unresolved

1d ago

#3845

extension quality --json reports percentage but not the grade that extension info and the registry show

1d ago

#3843

auth token create --json fields key and signinToken are undocumented; no token-mode service setup page

1d ago

#3841

trigger.schedule is evaluated in the serve host's local time zone, with no zone field and no doc saying so

1d ago

#3839

workflow validate/run say "Workflow not found" for a file that doctor workflows explains is misnamed

1d ago

#3833

telemetry stats says "No telemetry data found" right after successful sends; say the spool is empty because it flushed

1d ago

#3830

Homebrew tap README omits the brew trust step Homebrew 7 requires, so brew install swamp refuses the formula

1d ago

#3829

Docs: publish typed-secrets Phase 4.6 expression and delivery semantics

1d ago

#3825

Extension registry page: a supported way to include media (images) in the README

1d ago

#3816

CEL: data.latest(...).version is a double, but data.version() only accepts int, so "version - 1" fails at run time

1d ago

#3815

workflow resume --run refuses workflows with the same step name in two jobs, though validate and run accept them

1d ago

#3787

Update public OpenTelemetry manual for remote waterfalls and execution metrics (#3786)

2d ago

#3781

Share the extension quality rubric between the swamp CLI and swamp-club instead of mirroring it

2d ago

#3705

Server-driven warning and info messages to CLI users, targeted by swamp version (exploration)

3d ago

#3703

Serve: delegate namespace-scoped extension pulls and reload without granting administrator access

3d ago

#3702

workflow cancel --server ignores --ca-cert and SWAMP_CA_CERT

3d ago

#3679

Preserve active worker execution across serve restarts and upgrades; reconnect and reattach dispatches

4d ago

#3674

v3: chunk durability barrier costs a full drive-cache flush per command on macOS; use an ordering barrier

1d ago

#3663

vary/forEach object values with no key/name/id produce data names Windows refuses

4d ago

#3651

issue-lifecycle start drops issue comments: context.comments is always empty

5d ago

#3647

swamp core: a non-string sensitive value reads back as a JSON string

5d ago

#3641

Generated vault keys carry raw data-name and vary characters that strict vault providers reject

5d ago

#3639

bundleExtension 'bundles on different caches do not wait for each other' test fails under CPU load

5d ago

#3634

extension install and extension pull leave different bundles for the same extension version

5d ago

#3608

Registry drops contentMetadata.extensions (method grafts) at confirm-push

5d ago

#3603

Multi-model skill eval: gpt-5.4 and gemini jobs fail preflight every run (OpenAI credits exhausted, Google API key invalid)

s5d ago

#3600

local_source_failed drops the indexing error: a transient local extension failure leaves no cause (follow-up to 1672)

5d ago

#3580

Finer-grained method locking: a long-running method on one definition blocks unrelated objects managed by the same definition

Team7d ago

#3579

Surface (or warn about) values a model method returns besides dataHandles, with sensitive-field support

Team7d ago

#3578

workflow placement: run a workflow transparently on a specified host, local or via swamp workers (incl. nested child workflows)

Team7d ago

#3554

issue-lifecycle: pr_merged and ship report success and advance the phase when swamp-club is unreachable, writing nothing upstream

8d ago

#3523

auth login leaves auth.json apiKey empty and stores the key only in ~/.config/swamp/api-key, which the auth gate never reads

9d ago

#3514

swamp-extensions CI: Review Integrity explains a stalled or failed audit (streamed progress, timeout, did-not-finish comment)

5d ago

#3483

Workflow run cancellation on concurrency-key conflict

10d ago

#3480

Read non-string sensitive resource fields back with their type

10d ago

#3470

Run index repair-by-stat misses an in-place, same-size record rewrite that restores mtime within the same second as its entry: ctime is reported in whole seconds

10d ago

#3408

Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them

10d ago

#3401

A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through

11d ago

#3399

serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other

8d ago

#3383

extension pull: safety analysis scans the bundle the extension runs

11d ago

#3361

S3-backed serve: a poll that pulls one file invalidates the whole data catalog, so the next query re-reads every version

11d ago

#3349

swamp-extensions: CI check that every manifest declares license: and ships a LICENSE file

11d ago

#3344

extensions_search index is never created if the first attempt fails, until the process restarts

12d ago

#3305

S3/GCS datastore sync: shared sync service lets one sync clear another's dirty marks and pull over unpushed files

12d ago

#3298

swamp-uat: the SIGTERM drain test does not check that the run succeeded

12d ago

#3297

stagecraft: a factory-wide read of work items waiting on a person (no studio, no per-item status loop)

12d ago

#3292

stagecraft: rebind a work item to another tracker (mirrored built-in tickets to Jira)

12d ago

#3280

s3-datastore: first push on a fresh cache prints 'Index merge failed' for a missing local .datastore-index.json

12d ago

#3272

swamp-extensions: use explicit npm:/jsr: specifiers in root extensions/models

13d ago

#3229

stagecraft: studio state_test 'after its event stream reconnects' is timing-flaky under load

14d ago

#3208

Activity projector fails with ZooKeeper "Bad version" error on swamp.score_grants during keeper instability

15d ago

#3198

s3-datastore: model-scoped pullChanged lists and walks the whole namespace

16d ago

#3169

extension safety analyzer does not warn on node:child_process or cluster subprocess spawning

16d ago

#3153

extension push: a swamp-quality-ignore directive after a comment holding an apostrophe is silently ignored

17d ago

#3133

Model types: decide whether names like @/@x/y or a+b/c should be legal (type grammar)

17d ago

#3103

seed:collective cannot produce a superseded personal trial or a returned trial, so the UAT cannot cover them

18d ago

#3073

serve HA: pull a token's definition on an auth miss so a peer accepts a new token at once

18d ago

#3065

extension push: accept attestation-backed adversarial-review evidence (lookup by extension and content hash), generated provenance, and carry the evidence to the registry at confirm (design: Lab #3023)

1d ago

#3060

Decide a stricter naming rule for workflow step and job names

18d ago

#3010

s3-datastore/serve: readResource without a version returns an older version; the latest marker is rewritten backwards

Team8d ago

#3004

Publish agent-facing projections of the manual: /llms.txt, .md pages, and llms-full.txt

Enterprise21d ago

#3000

Let agent-runner drive more agent CLIs (Kilo Code and others)

22d ago

#2998

s3-datastore: every fast-path miss re-downloads every _index shard, so a busy serve pulls the whole index every poll (~230 GB/day S3 egress)

Team22d ago

#2993

Feedback: Swamp as an approval-gated control plane for a small fleet

19d ago

#2865

Tracking: test baseline required before the datastore refactor (commit-log design)

11d ago

#2754

serve: define and supply the collective and owner grant condition variables

24d ago

#2749

No first-class workflow primitive for spawning a permission-scoped agent session

25d ago

#2727

Decorative animations outside the Lab still repaint on the main thread

25d ago

#2683

s3/gcs datastore: pullChanged overwrites dirty, unpushed cache files

25d ago

#2623

Codegen/AWS: create-only required fields block list/get/delete in generated AWS models

26d ago

#2618

End a collective's trial when it begins a paid subscription

26d ago

#2592

s3-datastore: SWAMP_S3_REQUEST_TIMEOUT_MS does not appear to apply to ListObjectsV2 during pull

26d ago

#2591

s3-datastore: S3Lock.acquire overshoots maxWaitMs by up to a full backoff interval

26d ago

#2590

s3-datastore: a model-scoped pull still lists, walks and indexes the whole namespace

26d ago

#2586

Run the web dashboard locally from the CLI without swamp serve

s26d ago

#2560

extensions: cold-path catalog rebuild skips sources whose type is not a string literal, dropping them for one process lifetime

29d ago

#2540

serve: rotate the external token-secrets key

29d ago

#2499

Link each swamp-club panel to its manual page with a header DOCS link

1mo ago

#2495

managedConfig: extension lockfile writes lose updates, and auto-resolved installs never reach the shared lockfile

z24d ago

#2487

Generated @swamp/aws StateSchemas mark conditional and create-only properties as required, producing schema warnings on every read

1mo ago

#2465

workflows: a nested workflow step should inherit the caller's placement when the child declares none

Team7d ago

#2461

Supported vault-write API for extension model methods (per-instance vault target)

Team1mo ago

#2418

serve: after lazy hydration, scoped poller pulls never take the fast path, and the login mint waits behind them on the sync gate

16d ago

#2416

datastore extensions: full pushes re-hash every pulled file on every run because index mtimes never match pulled copies

1mo ago

#2410

Extension catalog caches a datastore bundle with an empty type, so the repo fails with Unknown datastore type when addressed by its realpath

1mo ago

#2379

Let a method inside serve start a workflow run: context.runWorkflow

1mo ago

#2349

s3/gcs datastore: no safe recovery when _meta.json v2 lists a shard missing from the bucket

1mo ago

#2345

worker secret allowlist rejects caller-chosen vault references resolved at run time (method args carrying {vaultName, secretKey})

Team25d ago

#2344

serve: default placement for steps that declare none (so one workflow runs both locally and via workers)

Team7d ago

#2339

s3-datastore: per-datastore AWS profile, so a serve audit store can use different credentials from the main datastore

Team1mo ago

#2329

s3/gcs-datastore: clean up data left behind by deletes that silently no-opped before the swamp-club#2249 fix

1mo ago

#2326

Expose Swamp as a REST/OpenAPI endpoint (for GPT Actions and other REST clients)

1mo ago

#2323

Promote CodeBuddy and WorkBuddy from custom-tool configs to first-class Swamp clients

1mo ago

#2299

s3-datastore: documented offline behaviour is unreachable — lock acquire fails closed before pull, while a mid-run outage exits 0 with the data stranded

Team1mo ago

← Back to list

01Issue

FeatureShippedExtensionsPublic

Assigneesstack72

Relationships

#1908 Add safe per-work-item workspace preparation

Opened by funsaized · 8/30/2026· Shipped 9/28/2026

Provide an official idempotent method that fetches an exact base ref, creates or safely reuses one verified Git worktree and branch per work item, refuses unrelated or overlapping paths, preserves expected dirty rework state, and returns subjectRoot, branch, and baseCommit.

Upstream repository: https://github.com/swamp-club/swamp-extensions

Environment

Extension: @swamp/git@2026.08.25.1
swamp: 20260828.231706.0-sha.ca29674e
OS: darwin (aarch64)
Deno: 2.8.3
Shell: /bin/zsh

02Bog Flow

Shipped

9/28/2026, 9:49:46 PM

Click a lifecycle step above to view its details.

03Sludge Pulse

stack72 assigned stack729/28/2026, 7:35:08 PM

stack72 commented 9/28/2026, 9:49:49 PM

Thanks @funsaized for reporting this! We shipped: Add ensure_worktree and verify_worktree to @swamp/git and fix remove_worktree path comparison. ensure_worktree fetches an exact base ref race-free, creates or safely reuses one verified worktree and branch per work item inside an optional bounded root, refuses unrelated or overlapping paths, preserves in-progress rework, and returns subjectRoot, branch, and baseCommit. verify_worktree is a read-only fail-closed check of an existing worktree against expected branch, base lineage, root, and remote.. The fix has been merged and a release is on its way. We appreciate your contribution to swamp.