Lab #2519: dashboard System tab shows Port —, TLS disabled, Auth —, Scheduling disabled although serve.config reports them correctly

Problem

The dashboard's System tab shows wrong serve configuration:

Port        —
TLS         disabled
Auth Mode   —
Scheduling  disabled
Dashboard   enabled

The serve.config response for the same server, fetched over the dashboard's own WebSocket with an admin token, is correct:

{"config":{"port":9090,"host":"0.0.0.0","tls":{"enabled":true,"certFile":"/tls/tls.crt"},"authMode":"token","scheduling":{"enabled":true},"dashboard":{"enabled":true},"webhooks":[],"hotReload":true,"remoteOnly":true,"autoResume":true,"trustProxy":true,"verifyOnEnroll":true, ...}}

/health also reports scheduling.enabled: true, and the scheduler fires on time: run b3ff2168 at 05:00:00Z today, triggerSource: schedule.

Likely cause (INFERRED from the payload shape)

The values arrive nested under config, and the System view appears to read top-level fields. So every field falls back to its empty or default rendering, except Dashboard, which is true by construction.

Ask

Read the nested config object, and add a contract test that renders the System view from a real serve.config payload. remoteOnly, autoResume, hotReload and trustProxy are also worth showing, as they change how the server behaves.

Thanks @randybias for reporting this! We shipped: The dashboard System tab misreads the serve.config response in two ways: it reads fields from the top level while the server nests them under config, and it tests tls, scheduling and dashboard for truthiness while the server sends them as objects with an enabled field. Fix it in the dashboard by moving the payload-to-rows translation out of System.tsx into a small pure module that reads the real wire shape, render the rows from it, add the four behaviour-changing flags the issue asks for (Remote Only, Auto Resume, Hot Reload, Trust Proxy), and pin it with a contract test that builds its payload from the server's own redactServeOptions. The server's wire shape is unchanged.. The fix has been merged and a release is on its way. We appreciate your contribution to swamp.

swamp data get and data versions report Behavior not found for data whose behavior definition was deleted

Workflow-scoped data get reports the behavior id as modelName once the behavior definition is deleted

Terminal report renderer prints HTML entities in table cells: a ' in a header shows as &#39;

Slackwater: let customers build integrations that drive workflows securely and auditably

Container run inspection and isolation metadata for audited recovery tests

GCP codegen: generate media upload/download from Discovery mediaUpload and supportsMediaDownload

Docs: Claude audit hook covers PowerShell, swamp audit install --user, and doctor audit hook warnings

repo upgrade: drop stale Claude audit hooks when claude leaves the tool set

@swamp/video: small follow-ups from joining takes

swamp-lib: workflowRunStream drops a refusal and ends as if nothing went wrong

@swamp/video: rendering an edit list that keeps nothing fails with 'sumExpr needs at least one term'

@swamp/video: describe and chapters for a joined video

@swamp/video: splice a take into another at a point in edit.txt

swamp serve: apply config changes without failed requests (full reload, vault-backed webhook secrets, harmless restarts)

swamp-lib: workflowRun never settles when a run suspends at an approval gate

Cloudflare codegen: a oneOf/anyOf inside a multi-member allOf is dropped

stagecraft: low findings from the optional-inject verification (held-by attribution, dispatch timing, test helper)

stagecraft tracker: tidy up external relations (duplicate entries, id case, second lookup)

SWAMP_SERVER_TOKEN does not authenticate with --server, while --token and SWAMP_SERVER_TOKEN_FILE do

stagecraft validate: product-missing-on-path misses a required inject that one exit of its producing stage doesn't record

Cloudflare codegen: a self-referencing request body overflows the stack in normalizeProperty

Scheduled flaky-test detection is failing

Terminal title should be conversation summary

Docs: usage-telemetry reference should describe the telemetry stats empty state and the last-flush record

run doctor --fix --server cannot settle damaged runs left by a crashed serve after restart

@swamp/issue-lifecycle: collapse the verification_passed, post_attestation, link_pr sequence

@swamp/issue-lifecycle: one-call verification

audit: register legitimate non-swamp commands as approved bypasses

Docs: what serve instances must not share, flat AWS Secrets Manager names, and where OAuth values are stored

Let a serve:* collective key look up usernames, so a recreated swamp serve does not need oauth:manage at runtime

aws-sm vault: optional secret_prefix to scope secrets within an AWS account and region

swamp skill: add a workspace guide and routing-table entry

serve: a capability probe answered by a follower does not speak for the leader that handles the forwarded request

serve OAuth client reuse: remaining review findings from swamp-club#4264

Agents.md: consider not using H1 'Project' inside managed block

serve: the cron-fire dedup claim has no deadline, so a hung control plane stalls every scheduled fire

serve: define what swamp serve does when its OAuth client is deleted at swamp-club

Docs: schedule catch-up and missed-fire tracking for scheduled workflows

Work-item commands run from the wrong repo report the work item as not started

Docs: step concurrency caps only that step's forEach iterations, not its whole dependency level

Package everything on ops.swamp-club.com; stop direct server edits

Shorten swamp serve's token session re-check so revocation takes effect sooner

cfgmgmt firewall (ufw): an input for rule position (insert before/after)

agent-sessions: lockfile test helper silently depends on the captured @swamp/git key

agent-sessions: low-severity edge cases from the Codex importer reviews (#4158)

Team mode manual pages: swamp-serve and remote-execution for leader/follower, member checkouts, offline work, run control and known limits

Agent session record: four questions from the Codex importer (#4158)

@swamp/video: upload workflow to publish a take to YouTube (video, description, chapters, captions, thumbnail)

@swamp/video/brand: customizable outro card (next steps, headline, per-video CTA)

data prune through serve deletes data of an auto-definition whose declared type is invalid

serve: give the definition index a change signal (file watcher with a sync barrier) so a write to a definitions directory costs O(1), not a stat of every file in it

Warn when a grant with a methods list is a deny: it also refuses requests that name no method

serve reload reports 0 types reloaded when it replaced edited repo-local behaviors

@swamp/video/brand: cap each Chromium stderr line kept for errors

serve resolves realpath for thousands of files under .swamp/outputs/swamp/worker/set_status

Retention or GC for auto-definitions whose runs and data are gone

S3 and GCS: after a real commit by another writer, a serve stays off the pull fast path until it restarts

Licence header check only compares the first line of a file

CI: an accepted attestation approves the PR, and anything else fails the attestation job

artifacts.swamp-club.com unreachable in Spain during LaLiga matches (ISP blocking of Cloudflare IPs)

Supported binary file ingestion for remote members of swamp serve, without the bytes landing in run history

Worker queryData fails at the fixed 30 s RPC limit while it waits for a full catalog rebuild

Add expiring service-account token requests and authorization checks to RBAC

Reads other than findById still treat a lapsed temporary ban as active until the operative next signs in

verify-build upgrade gate silently skips models whose version is a constant

@swamp/agent-sessions: explore a decision model (TypeSafe Jev) for call labelling

agent-sessions: follow-ups from the 4211 reviews (repo resolution cache and edge cases)

agent-sessions: revisit the import's remaining review findings (redaction edge cases, import robustness)

Swamp Club collective GUI: show the swamp serve instances currently connected to a collective

A malformed --ca-cert file is reported as an unreadable OS certificate store

TLS hint blames a missing root CA and macOS for every invalid peer certificate failure

workflow cancel --server does not send SWAMP_SERVE_EXTRA_HEADERS

S3/GCS repairUnpushedFiles: the pull it asks for after a lost last-synced index does not stop it re-uploading copies a peer deleted

A resume runs settled work after the teardown gated on it has already run, and nothing tears that work down

serve (token mode): --admins accepts idp-group entries that can never match

deployment: getLogs method (deployment-aware pod log tailing)

model.output.search response phase takes 3.9s for 5,000 items with no attribution (redaction vs serialization vs send)

Skill/docs: document registry listing limits, static-extraction rules, and splitting large APIs by domain

Check registry listing limits in extension quality/push and suggest splitting into per-domain extensions

Over-limit contentMetadata publishes a blank extension page; archive fallback extracts nothing

Terminal report renderer prints HTML entities in table cells: a ' in a header shows as '