audit: register legitimate non-swamp commands as approved bypasses

just now

#4393

model output logs shows the latest log version instead of the output's own artifact version

5h ago

#4392

Manual: Sensitive Method Arguments claims a literal value is refused, but a method run accepts it

1h ago

#4391

workflow run: show artifact attributes for runs through serve, and let a run leave out the "Data produced" box

5h ago

#4386

Docs: what serve instances must not share, flat AWS Secrets Manager names, and where OAuth values are stored

58m ago

#4385

Let a serve:* collective key look up usernames, so a recreated swamp serve does not need oauth:manage at runtime

4h ago

#4384

aws-sm vault: optional secret_prefix to scope secrets within an AWS account and region

7h ago

#4383

@swamp/cve http2shell, php-rce-2026-10 and tailworm: scan fails with 'Duplicate data instance name' (log and status share a name)

7h ago

#4381

swamp skill: add a workspace guide and routing-table entry

Enterprise21h ago

#4376

stagecraft tracker: relate tickets across trackers (another repo's tracker)

21h ago

#4373

serve: a capability probe answered by a follower does not speak for the leader that handles the forwarded request

23h ago

#4372

serve OAuth client reuse: remaining review findings from swamp-club#4264

23h ago

#4371

Agents.md: consider not using H1 'Project' inside managed block

1d ago

#4367

serve: the cron-fire dedup claim has no deadline, so a hung control plane stalls every scheduled fire

1d ago

#4365

serve: define what swamp serve does when its OAuth client is deleted at swamp-club

1d ago

#4360

Docs: schedule catch-up and missed-fire tracking for scheduled workflows

1d ago

#4359

Work-item commands run from the wrong repo report the work item as not started

1d ago

#4358

Docs: step concurrency caps only that step's forEach iterations, not its whole dependency level

1d ago

#4353

Package everything on ops.swamp-club.com; stop direct server edits

23h ago

#4347

workflow run: let a run skip the "Data produced" box, or make it show what each artifact holds

5h ago

#4342

Shorten swamp serve's token session re-check so revocation takes effect sooner

1d ago

#4336

@swamp/cve/emudhra: Ubuntu's pip vendored certifi reported as exposed although pip uses the OS store

1d ago

#4334

cfgmgmt firewall (ufw): an input for rule position (insert before/after)

Team1d ago

#4330

@swamp/video: informal demos — join multiple takes into one video, and a full-length background music bed

1d ago

#4329

agent-sessions: lockfile test helper silently depends on the captured @swamp/git key

1d ago

#4328

agent-sessions: low-severity edge cases from the Codex importer reviews (#4158)

1d ago

#4325

Team mode manual pages: swamp-serve and remote-execution for leader/follower, member checkouts, offline work, run control and known limits

2d ago

#4323

Agent session record: four questions from the Codex importer (#4158)

1d ago

#4318

@swamp/video: upload workflow to publish a take to YouTube (video, description, chapters, captions, thumbnail)

2d ago

#4315

@swamp/video/brand: customizable outro card (next steps, headline, per-video CTA)

2d ago

#4314

data prune through serve deletes data of an auto-definition whose declared type is invalid

2d ago

#4310

serve: give the definition index a change signal (file watcher with a sync barrier) so a write to a definitions directory costs O(1), not a stat of every file in it

2d ago

#4308

Warn when a grant with a methods list is a deny: it also refuses requests that name no method

2d ago

#4306

serve reload reports 0 types reloaded when it replaced edited repo-local behaviors

2d ago

#4305

@swamp/video/brand: cap each Chromium stderr line kept for errors

2d ago

#4301

serve resolves realpath for thousands of files under .swamp/outputs/swamp/worker/set_status

2d ago

#4299

Retention or GC for auto-definitions whose runs and data are gone

2d ago

#4293

S3 and GCS: after a real commit by another writer, a serve stays off the pull fast path until it restarts

2d ago

#4275

Licence header check only compares the first line of a file

2d ago

#4256

CI: an accepted attestation approves the PR, and anything else fails the attestation job

3d ago

#4238

artifacts.swamp-club.com unreachable in Spain during LaLiga matches (ISP blocking of Cloudflare IPs)

3d ago

#4233

Supported binary file ingestion for remote members of swamp serve, without the bytes landing in run history

3d ago

#4232

Worker queryData fails at the fixed 30 s RPC limit while it waits for a full catalog rebuild

3d ago

#4222

Add expiring service-account token requests and authorization checks to RBAC

Team4d ago

#4217

Reads other than findById still treat a lapsed temporary ban as active until the operative next signs in

4d ago

#4215

verify-build upgrade gate silently skips models whose version is a constant

4d ago

#4213

@swamp/agent-sessions: explore a decision model (TypeSafe Jev) for call labelling

1d ago

#4212

agent-sessions: follow-ups from the 4211 reviews (repo resolution cache and edge cases)

4d ago

#4210

agent-sessions: revisit the import's remaining review findings (redaction edge cases, import robustness)

4d ago

#4202

Swamp Club collective GUI: show the swamp serve instances currently connected to a collective

Enterprise4d ago

#4199

A malformed --ca-cert file is reported as an unreadable OS certificate store

5d ago

#4198

TLS hint blames a missing root CA and macOS for every invalid peer certificate failure

5d ago

#4196

workflow cancel --server does not send SWAMP_SERVE_EXTRA_HEADERS

5d ago

#4193

S3/GCS repairUnpushedFiles: the pull it asks for after a lost last-synced index does not stop it re-uploading copies a peer deleted

5d ago

#4190

swamp-uat private-registry tests leave npm/<port> dirs in the shared Deno cache

5d ago

#4186

A resume runs settled work after the teardown gated on it has already run, and nothing tears that work down

5d ago

#4165

serve (token mode): --admins accepts idp-group entries that can never match

5d ago

#4163

build-swamp-extension example: code-review isn't given the quality evidence, so the reviewer reports quality as missing

Team5d ago

#4161

deployment: getLogs method (deployment-aware pod log tailing)

5d ago

#4147

model.output.search response phase takes 3.9s for 5,000 items with no attribution (redaction vs serialization vs send)

5d ago

#4131

Skill/docs: document registry listing limits, static-extraction rules, and splitting large APIs by domain

s1d ago

#4130

Check registry listing limits in extension quality/push and suggest splitting into per-domain extensions

6d ago

#4129

Over-limit contentMetadata publishes a blank extension page; archive fallback extracts nothing

6d ago

#4127

swamp inbox: with a filter active, sitting on the last row pages through the whole inbox in the background

s1d ago

#4106

@swamp/video/hyprland: recording hotkeys, retake marker and phone-mirror window rules

6d ago

#4105

@swamp/video/obs: optional OBS recording with per-person hardware config for @swamp/video

6d ago

#4094

serve daemon enable: add Windows support (service or startup task)

6d ago

#4055

swamp skill docs: publishing.md contradicts itself on dynamic imports, overstates where git dependencies are listed, and never says consumers keep the publisher's bundle

7d ago

#4054

extension push: the dynamic import() refusal tells authors to run swamp extension fmt, and the archive-project-file fix names the kind directory push never filters

7d ago

#4053

extension push: file:, link:, workspace: and git package.json dependencies are left out of the unaudited list when the project also has a deno.json

7d ago

#4051

push (Apple Containers) makes an index whose platform manifest is unpullable on Forgejo

8d ago

#4050

Streak projector: incremental runs instead of a full scan every minute

8d ago

#4039

Registry: detect code from outside npm and JSR in a v2 archive itself, not only from the author's dependency-audit.json

8d ago

#4035

Scorecard: code past the analyzer's read caps, or unreadable, is skipped silently instead of counting as not audited

8d ago

#4009

Claude audit hook misses PowerShell tool calls and sessions started above the swamp repo

8d ago

#4008

access can-i: evaluate a local grants file without --server

3d ago

#3999

Support search and filters as URL query parameters on /extensions

2d ago

#3998

bundleExtension same-cache test can pass with a broken first-bundle gate under CPU load

8d ago

#3994

Five Mongo queues can hand the same row to two replicas

8d ago

#3992

Collective invite shows "This invitation has expired or has already been used" after a successful join via Google sign-in

8d ago

#3991

Move the Zod argument-field extractor into @swamp-club/extension-scoring so the CLI and registry read schemas alike

8d ago

#3988

serve: dispatch to an idle worker waits for its worker_busy write on the shared gateway transition tail

9d ago

#3987

serve: worker enrollment resolves and creates the worker definition inside the serialized gateway transition tail

9d ago

#3980

Rescore every extension's current version under rubric v5

9d ago

#3964

stagecraft studio ticket columns: round-5 review lows from #3828 (source watch cost, relationText lookup, cross-instance claim)

9d ago

#3963

A long-lived serve client for extensions, and a stable rate_limited error code

9d ago

#3957

Support creating 1Password vaults for new clients

9d ago

#3946

Generated state schemas require every child of nested objects, so normal resources warn on create/get

9d ago

#3930

Add LinkedIn as a login provider

10d ago

#3929

Showcase reward backfill can double-pay 5,000,000 points when replicas start together

10d ago

#3927

Skill propulsion rule is silent when no transition is satisfied because stage work is outstanding

Team11d ago

#3865

serve shutdown does not wait for worker status writes, and its listener accepts workers after the gateway is disposed

12d ago

#3855

stagecraft: rename work mode `method` to `behavior`, matching swamp's rename of models to behaviors

12d ago

#3843

auth token create --json fields key and signinToken are undocumented; no token-mode service setup page

12d ago

#3841

trigger.schedule is evaluated in the serve host's local time zone, with no zone field and no doc saying so

3d ago

#3833

telemetry stats says "No telemetry data found" right after successful sends; say the spool is empty because it flushed

12d ago

#3829

Docs: publish typed-secrets Phase 4.6 expression and delivery semantics

12d ago

#3825

Extension registry page: a supported way to include media (images) in the README

12d ago

#3705

Server-driven warning and info messages to CLI users, targeted by swamp version (exploration)

14d ago

#3703

Serve: delegate namespace-scoped extension pulls and reload without granting administrator access

14d ago

#3679

Preserve active worker execution across serve restarts and upgrades; reconnect and reattach dispatches

15d ago

#3663

vary/forEach object values with no key/name/id produce data names Windows refuses

15d ago

#3651

issue-lifecycle start drops issue comments: context.comments is always empty

15d ago

#3647

swamp core: a non-string sensitive value reads back as a JSON string

16d ago

#3641

Generated vault keys carry raw data-name and vary characters that strict vault providers reject

16d ago

#3603

Multi-model skill eval: gpt-5.4 and gemini jobs fail preflight every run (OpenAI credits exhausted, Google API key invalid)

s16d ago

#3600

local_source_failed drops the indexing error: a transient local extension failure leaves no cause (follow-up to 1672)

16d ago

#3580

Finer-grained method locking: a long-running method on one definition blocks unrelated objects managed by the same definition

Team18d ago

#3579

Surface (or warn about) values a model method returns besides dataHandles, with sensitive-field support

Team18d ago

#3578

workflow placement: run a workflow transparently on a specified host, local or via swamp workers (incl. nested child workflows)

Team18d ago

#3554

issue-lifecycle: pr_merged and ship report success and advance the phase when swamp-club is unreachable, writing nothing upstream

19d ago

#3514

swamp-extensions CI: Review Integrity explains a stalled or failed audit (streamed progress, timeout, did-not-finish comment)

16d ago

#3483

Workflow run cancellation on concurrency-key conflict

3d ago

#3480

Read non-string sensitive resource fields back with their type

21d ago

#3470

Run index repair-by-stat misses an in-place, same-size record rewrite that restores mtime within the same second as its entry: ctime is reported in whole seconds

21d ago

#3408

Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them

21d ago

#3401

A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through

22d ago

#3399

serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other

19d ago

#3361

S3-backed serve: a poll that pulls one file invalidates the whole data catalog, so the next query re-reads every version

8d ago

#3344

extensions_search index is never created if the first attempt fails, until the process restarts

22d ago

#3305

S3/GCS datastore sync: shared sync service lets one sync clear another's dirty marks and pull over unpushed files

23d ago

#3298

swamp-uat: the SIGTERM drain test does not check that the run succeeded

22d ago

#3297

stagecraft: a factory-wide read of work items waiting on a person (no studio, no per-item status loop)

23d ago

#3292

stagecraft: rebind a work item to another tracker (mirrored built-in tickets to Jira)

23d ago

#3280

s3-datastore: first push on a fresh cache prints 'Index merge failed' for a missing local .datastore-index.json

23d ago

#3229

stagecraft: studio state_test 'after its event stream reconnects' is timing-flaky under load

25d ago

#3208

Activity projector fails with ZooKeeper "Bad version" error on swamp.score_grants during keeper instability

26d ago

#3198

s3-datastore: model-scoped pullChanged lists and walks the whole namespace

27d ago

#3169

extension safety analyzer does not warn on node:child_process or cluster subprocess spawning

27d ago

#3133

Model types: decide whether names like @/@x/y or a+b/c should be legal (type grammar)

28d ago

#3103

seed:collective cannot produce a superseded personal trial or a returned trial, so the UAT cannot cover them

29d ago

#3073

serve HA: pull a token's definition on an auth miss so a peer accepts a new token at once

29d ago

#3065

extension push: accept attestation-backed adversarial-review evidence (lookup by extension and content hash), generated provenance, and carry the evidence to the registry at confirm (design: Lab #3023)

12d ago

#3060

Decide a stricter naming rule for workflow step and job names

29d ago

#3010

s3-datastore/serve: readResource without a version returns an older version; the latest marker is rewritten backwards

Team19d ago

#3004

Publish agent-facing projections of the manual: /llms.txt, .md pages, and llms-full.txt

Enterprise1mo ago

#3000

Let agent-runner drive more agent CLIs (Kilo Code and others)

1mo ago

#2993

Feedback: Swamp as an approval-gated control plane for a small fleet

3d ago

#2865

Tracking: test baseline required before the datastore refactor (commit-log design)

21d ago

#2754

serve: define and supply the collective and owner grant condition variables

1mo ago

#2749

No first-class workflow primitive for spawning a permission-scoped agent session

1mo ago

#2727

Decorative animations outside the Lab still repaint on the main thread

1mo ago

#2683

s3/gcs datastore: pullChanged overwrites dirty, unpushed cache files

1mo ago

#2623

Codegen/AWS: create-only required fields block list/get/delete in generated AWS models

1mo ago

#2618

End a collective's trial when it begins a paid subscription

1mo ago

#2592

s3-datastore: SWAMP_S3_REQUEST_TIMEOUT_MS does not appear to apply to ListObjectsV2 during pull

1mo ago

#2591

s3-datastore: S3Lock.acquire overshoots maxWaitMs by up to a full backoff interval

1mo ago

#2590

s3-datastore: a model-scoped pull still lists, walks and indexes the whole namespace

1mo ago

#2586

Run the web dashboard locally from the CLI without swamp serve

s1mo ago

#2560

extensions: cold-path catalog rebuild skips sources whose type is not a string literal, dropping them for one process lifetime

1mo ago

#2540

serve: rotate the external token-secrets key

1mo ago

#2499

Link each swamp-club panel to its manual page with a header DOCS link

1mo ago

#2495

managedConfig: extension lockfile writes lose updates, and auto-resolved installs never reach the shared lockfile

z1mo ago

#2487

Generated @swamp/aws StateSchemas mark conditional and create-only properties as required, producing schema warnings on every read

1mo ago

#2465

workflows: a nested workflow step should inherit the caller's placement when the child declares none

Team18d ago

#2461

Supported vault-write API for extension model methods (per-instance vault target)

Team1mo ago

#2418

serve: after lazy hydration, scoped poller pulls never take the fast path, and the login mint waits behind them on the sync gate

27d ago

#2416

datastore extensions: full pushes re-hash every pulled file on every run because index mtimes never match pulled copies

1mo ago

#2410

Extension catalog caches a datastore bundle with an empty type, so the repo fails with Unknown datastore type when addressed by its realpath

1mo ago

#2379

Let a method inside serve start a workflow run: context.runWorkflow

1mo ago

#2349

s3/gcs datastore: no safe recovery when _meta.json v2 lists a shard missing from the bucket

1mo ago

#2345

worker secret allowlist rejects caller-chosen vault references resolved at run time (method args carrying {vaultName, secretKey})

Team1mo ago

#2344

serve: default placement for steps that declare none (so one workflow runs both locally and via workers)

Team18d ago

#2339

s3-datastore: per-datastore AWS profile, so a serve audit store can use different credentials from the main datastore

Team1mo ago

#2329

s3/gcs-datastore: clean up data left behind by deletes that silently no-opped before the swamp-club#2249 fix

1mo ago

#2326

Expose Swamp as a REST/OpenAPI endpoint (for GPT Actions and other REST clients)

1mo ago

#2323

Promote CodeBuddy and WorkBuddy from custom-tool configs to first-class Swamp clients

1mo ago

#2299

s3-datastore: documented offline behaviour is unreachable — lock acquire fails closed before pull, while a mid-run outage exits 0 with the data stranded

Team1mo ago

← Back to list

01Issue

BugShippedExtensionsPublic

Assigneesstack72

Relationships

#2287 Make Compute Routes list usable without create-only global arguments

Opened by swamp_lord · 9/18/2026· Shipped 9/28/2026

The generated @swamp/gcp/compute/routes GlobalArgsSchema marks destRange, name, network, and priority as required. Those are create-only Route fields, so every routes.list invocation fails global-argument validation unless callers supply unrelated synthetic values.\n\nPlease split create-only fields from shared global arguments, or make them optional in the global schema and validate them in create. The list method should require only GCP credentials/project plus its list options (filter, maxResults, orderBy, returnPartialSuccess, pagination).\n\nThis blocks read-only VPC route inventory workflows. No credentials or project identifiers are included in this report.

Upstream repository: https://github.com/swamp-club/swamp-extensions

Environment

Extension: @swamp/gcp/compute@2026.09.11.1
swamp: 20260917.193606.0-sha.6bf7f212
OS: darwin (aarch64)
Deno: 2.9.7
Shell: /bin/zsh

02Bog Flow

Shipped

9/28/2026, 10:32:45 PM

Click a lifecycle step above to view its details.

03Sludge Pulse

stack72 assigned stack729/28/2026, 7:34:29 PM