Skip to main content
← Back to list
01Issue
BugClosedSwamp CLIPublic
AssigneesNone

Relationships

#2244 VaultService.fromRepository ignores managedConfig vaultsDir across 15+ call sites

Opened by stack72 · 9/17/2026

Summary

VaultService.fromRepository(repoDir) defaults to join(repoDir, "vaults") for loading vault configs. Under managedConfig: true, vault configs live in the datastore config tier instead. This affects 15+ call sites beyond the two fixed in #2237.

Affected call sites

Category A: Vault libswamp operations

  • src/libswamp/vaults/list_keys.ts:61
  • src/libswamp/vaults/read_secret.ts:74
  • src/libswamp/vaults/put.ts:110
  • src/libswamp/vaults/delete.ts:87
  • src/libswamp/vaults/inspect.ts:81
  • src/libswamp/vaults/annotate.ts:102
  • src/libswamp/vaults/migrate.ts:104

Category B: Model/workflow execution

  • src/cli/commands/model_method_run.ts:341 — general model method run
  • src/cli/commands/access_helpers.ts:165 — access grant/group
  • src/domain/workflows/execution_service.ts:527 — workflow step vault access
  • src/domain/expressions/model_resolver.ts:535 — CEL expression vault access

Category C: Access token deps (masked by control-plane vault)

  • src/libswamp/access/token_create.ts:76
  • src/libswamp/access/token_rotate.ts:59
  • src/libswamp/access/run_deps.ts:79

Category D: Doctor

  • src/libswamp/models/doctor_vaults.ts:107

Root cause

VaultService.fromRepository accepts an optional vaultsDir but most callers don't pass it. The managed config path is computed in repo_context.ts and wired into RepositoryContext, but consumed only by YamlVaultConfigRepositoryVaultService factories are called separately with bare repoDir.

Suggested fix

Centralize vault dir resolution: add vaultsDir to the return type of requireInitializedRepoUnlocked/requireInitializedRepoReadOnly, or teach VaultService.fromRepository to resolve the managed config tier itself.

  • #2237: Fixed worker token create and worker token revoke specifically
02Bog Flow
OPENTRIAGEDIN PROGRESSCLOSED

Closed

9/17/2026, 4:19:18 PM

No activity in this phase yet.

03Sludge Pulse

Sign in to post a ripple.