Extension scoring audits v2 archives exact-only and charges unaudited code, in the package and the CLI alike

s7m ago

#3869

extension fmt (and any command) creates or rewrites deno.lock when the extension lives in the repo's loaded extensions/ dir

s1h ago

#4015

extension quality: a collective-attested private repository scores provisional, and --json omits ifProvisionalEarned

1h ago

#3970

Extension push ships the canonical form: every npm:/jsr: import pinned exact, and a v2 dependency-audit.json

s2h ago

#4010

judgeRunRecord lets a forged record settle a waiting approval gate to skipped without an approve

3h ago

#3983

Extension dependencies: the shared import scan reads Babel syntax, not tokens (follow-up to #3969)

s3h ago

#3272

swamp-extensions: use explicit npm:/jsr: specifiers in root extensions/models

s4h ago

#3998

bundleExtension same-cache test can pass with a broken first-bundle gate under CPU load

4h ago

#3639

bundleExtension 'bundles on different caches do not wait for each other' test fails under CPU load

s4h ago

#3383

extension pull: safety analysis scans the bundle the extension runs

s15h ago

#3979

Extension scoring queue: two replicas can claim the same pending event

s16h ago

#3995

Registry: bump @swamp-club/extension-scoring to the version carrying #3983 (and #3845) before the v5 rescore

s1h ago

#3994

Five Mongo queues can hand the same row to two replicas

9h ago

#3863

Registry rescore: secret-safe-docs passes a secret README line on versions whose stored metadata predates the sensitive flag (follow-up to #3783)

s17h ago

#3977

Score extensions with @swamp-club/extension-scoring (rubric v5) instead of the registry's own copy

s19h ago

#3991

Move the Zod argument-field extractor into @swamp-club/extension-scoring so the CLI and registry read schemas alike

19h ago

#3969

Extension dependencies: one resolver for push, quality and fmt (no behaviour change)

s19h ago

#3989

Docs: extension quality scores with the registry formula and reports grade (swamp-club#3845)

s2h ago

#3980

Rescore every extension's current version under rubric v5

21h ago

#3153

extension push: a swamp-quality-ignore directive after a comment holding an apostrophe is silently ignored

21h ago

#3781

Share the extension quality rubric between the swamp CLI and swamp-club instead of mirroring it

s22h ago

#3974

Manual: the supported extension dependency categories, the canonical form and the lock rule, rewritten once against the final design

2h ago

#3973

Registry audits v2 extension archives as written, and a range costs the loose point only without a valid lock

s8m ago

#3972

Extension consumers keep the publisher's bundle: pull, update and auto-resolve stop rebuilding (direction A for #3634)

sjust now

#3971

Extension push: inputs that open up (workspace root lock, ancestor config refused by name, JSR dist-tags) and the skill docs rewritten once

s19m ago

#3828

stagecraft studio: show a factory's open tickets that have no work item yet on the Board

s1d ago

#3964

stagecraft studio ticket columns: round-5 review lows from #3828 (source watch cost, relationText lookup, cross-instance claim)

1d ago

#3963

A long-lived serve client for extensions, and a stable rate_limited error code

1d ago

#3725

Docs: dependency trust across push, quality, fmt and the registry — Deno-config resolution, read-only lock, package.json mode, the archive's audit record (merges #3728)

s1d ago

#3793

extension push (package.json mode): two installed copies under one declared range are audited once, so the second shipped version goes unaudited

s1d ago

#3772

cve/emudhra page: Windows and macOS support, and shared CVE layer fixes (follow-up to #3710 and #3766)

s2d ago

#3775

@swamp/cve/php-rce-2026-10: match RHEL fixes for the PHP RCEs

s2d ago

#3776

@swamp/cve/dirtyfrag: report and README print the old swamp model command spelling

3d ago

#3870

package.json mode: no loose-specifier warning for a range push ships as the exact installed version

3d ago

#3826

method run masks a sensitive array from --input element by element, exposing its shape (regression from #3752)

s3d ago

#3783

Registry scorecard: score secret-safe-docs (rubric v4) and keep sensitive on extracted arguments

s3d ago

#3778

Registry dependency audit: audit the locked version push records in the archive, not the registry's newest match for a range specifier (swamp-club half of #3662)

s3d ago

#3855

stagecraft: rename work mode `method` to `behavior`, matching swamp's rename of models to behaviors

3d ago

#3662

extension push: record each dependency's audited (locked) version in the archive, so the registry audits what ships (swamp half; registry half #3778)

s4d ago

#3796

main fails type check: query_view_test.ts passes a namespace string where expressionQueryView now takes a NamespaceReader (semantic conflict between #3790 and #3785)

s4d ago

#3795

forEachNameWithoutSecrets property test fails intermittently: an empty-string secret and an overlapping recorded value give different names

4d ago

#3782

extension push finds no local modules when a folder above the repo is named node_modules

4d ago

#3630

extension push (package.json mode): audit dependencies resolved through package.json, and leave the author's node_modules/ unchanged (merges #3632)

s4d ago

#3764

Local verification docs still tell agents to put ANTHROPIC_API_KEY in verify.env for reviews

s5d ago

#3770

@swamp/cve/php-rce-2026-10 follow-ups: dry-run heading, command spelling, Debian 12 fix, podman image scan

s5d ago

#3612

extension push resolves the Deno config and import map the way Deno does: deno.jsonc, importMap file references and scopes

s5d ago

#3717

extension fmt --check writes deno.lock in deno.json mode, which push and quality then bundle against with --frozen

s5d ago

#3720

@swamp/cve/dirtyfrag: scan logs are never saved (file writer handle dropped, data name collides with the status resource)

5d ago

#3715

audit_deps.ts skips cve/ extensions, so their deno.lock files are never dependency-audited

s5d ago

#3719

@swamp/cve/dirtyfrag README shows --input targetHost/sshUser/sshKey/dockerContainer, which the CLI rejects

5d ago

#3716

@swamp/cve/dirtyfrag mitigate uses interactive sudo, so it can hang on a password prompt or fail mid-run

s5d ago

#3718

extension quality names the wrong cause: a bundle failure prints no reason, the not-audited row always blames an outage, and symbols-docs blames JSDoc when deno doc failed

s5d ago

#3728

Docs: extension fmt never writes deno.lock and warns on a stale one (swamp-club#3717)

3d ago

#3631

Docs: extension dependency trust pages — import-map auditing, bare-import rewrite and scoring, and the clarified warning/error plan

6d ago

#3682

Registry scorecard: a loose specifier costs one of the two dependency-trust points and a yanked one costs both, matching the CLI (#3354)

s6d ago

#3705

Server-driven warning and info messages to CLI users, targeted by swamp version (exploration)

6d ago

#3702

workflow cancel --server ignores --ca-cert and SWAMP_CA_CERT

6d ago

#3354

Dependency trust scoring (CLI): yanked and loose specifiers cost one of the two dependency-trust points (no new push errors)

s6d ago

#3669

extension quality crashes with deno doc --json failed when a package.json-mode archive ships a bare import

s6d ago

#3689

Docs: extension publishing reference quotes stale bare-specifiers and quality messages

6d ago

#3677

extension push: the yanked-dependency warning names a version to move to, and dependency warnings appear in the Unresolved warnings summary

s6d ago

#3688

Scorecard: copy the updated jsr-yanked wording from dependency_audit_vectors.json

6d ago

#3687

Docs: extension publishing reference should describe the yanked-version suggestion and dependency findings in Unresolved warnings

6d ago

#3601

eval-skill-triggers ignores evals/promptfoo/package-lock.json, so promptfoo's transitive deps are not locked

s6d ago

#3367

codegen: AWS models emit CloudFormation patterns JavaScript cannot compile, so @swamp/aws/chime, glue and transfer fail to import

6d ago

#3640

v3 outbox killed-writer test times out waiting for the kill point under CPU load

6d ago

#3673

On Windows, v3 outbox tests time out on a writer lock held by a dead fake pid

s6d ago

#3637

extension push: rewrite bare imports in the shipped source to their import-map specifiers

s7d ago

#3672

Flaky: probeStartServer 'a closed port is dead' gets unknown under the parallel test run

7d ago

#3638

workflow run --detach integration test fails under load: the run finishes before the test attaches

s7d ago

#3676

extension push: a deno.json scopes entry can make push ship and audit a different version than the extension resolves

7d ago

#3667

Skill trigger evals run through claude -p so verify-skills works on a subscription login

s7d ago

#3655

On Windows, extension pull and rm report paths with mixed separators

s7d ago

#3659

Windows CI: data_writer vary-suffix test writes a data name with a double quote, which #3568 refuses on Windows

s7d ago

#3664

Docs: bare imports mapped by deno.json are rewritten on push and scored

7d ago

#3663

vary/forEach object values with no key/name/id produce data names Windows refuses

7d ago

#3654

Since #3569: Datastore UAT's extension install row and 17 Windows extension unit tests fail on every release

s7d ago

#3611

extension push: dependencies named only through a deno.json import map are never audited

s7d ago

#3613

extension push rewrites the author's deno.lock when bundling

s7d ago

#3648

codegen/vercel: union (oneOf) read responses produce id-only ResourceSchemas

s7d ago

#3610

Docs: manual pages for push auditing the dependency version that ships (deprecated pin, loose specifier, JSR checks)

s7d ago

#3647

swamp core: a non-string sensitive value reads back as a JSON string

7d ago

#3634

extension install and extension pull leave different bundles for the same extension version

7d ago

#3632

extension push writes node_modules/.deno/ into the author's package.json project when bundling

5d ago

#3629

registry scorecard reports dependency trust passed for versions with bare imports it cannot audit

7d ago

#2564

swamp-club: unknown collective API token returns 422 instead of the documented 404

s7d ago

#3353

Registry scorecard: audit the dependency version that ships, and JSR dependencies

s7d ago

#3621

swamp update on Windows leaves no complete swamp.exe during a cross-volume copy, and keeps the zip until it finishes

s7d ago

#3618

install.ps1 keeps the release zip until exit and deletes the old swamp.exe before copying the new one

s7d ago

#3352

extension push: audit the dependency versions the bundle actually ships (pinned facts, deno info resolution, JSR existence)

s8d ago

#3616

Dev server (Vite) sends HTML pages with content-encoding: gzip over a body that isn't gzip

8d ago

#3515

swamp install.sh: holds three copies of the binary at once (~913 MB peak); delete the archive and move instead of copy

s8d ago

#3516

swamp multi-model-eval: install promptfoo without optional dependencies to save ~900 MB of disk

s8d ago

#3603

Multi-model skill eval: gpt-5.4 and gemini jobs fail preflight every run (OpenAI credits exhausted, Google API key invalid)

s8d ago

#3600

local_source_failed drops the indexing error: a transient local extension failure leaves no cause (follow-up to 1672)

8d ago

#3415

Docs: dependency trust reports unaudited dependencies (follows #3350)

s8d ago

#3463

auth whoami: log mode labels collectives Free and shows trial expired for a superseded trial

s8d ago

#3174

swamp-extensions CI: Review Integrity audit stalls silently on a large trust-root change until Forgejo kills the job

s8d ago

#3536

extension quality and push report source paths through the repo's resolved symlink: quality's entry.file climbs to / and back

z10d ago

#3313

extension pull: answering y to a dependency's overwrite prompt silently skips that dependency

z10d ago

#3311

extension push --private: trust the registry's privateExtensions verdict instead of deciding from plan/trial

s11d ago

#3500

A bare deno check fails with ~2,000 errors in packages/dashboard; make the dashboard type-check under Deno

s11d ago

#3514

swamp-extensions CI: Review Integrity explains a stalled or failed audit (streamed progress, timeout, did-not-finish comment)

7d ago

#2583

verify-reviews: adversarial review path guard is a hand-kept list, so new extensions silently skip it

s11d ago

#3503

whoami reports a superseded trial as expired, and a Personal License does not end the trial for private extensions

s11d ago

#3497

Flaky: v3 restore test 'serve's retake after another checkout wrote restores into its open store' fails under full-suite load

11d ago

#3498

Manual: extension quality --json status field should say a check that would block a push

s12d ago

#3464

extension quality --json reports status "failed" when a rubric factor is missing, though the exit code is 0

s12d ago

#3495

Docs: manifest reference still describes the removed indexer symlinks directory for workflow resolution

7d ago

#3385

bundle freshness ignores local modules outside the kind directory

z12d ago

#3486

Docs: extension trust manual should describe OSV version resolution and the no-matching-version not-audited case

7d ago

#3342

Docs: private extension entitlement messages and whoami --json privateExtensions (follows swamp-club#3311)

7d ago

#3351

Registry scorecard: dependency lookups that failed are not audited

s12d ago

#3422

CI adversarial review gate keeps blocking on a stale CHANGES_REQUESTED review when the new review's heading is formatted differently

12d ago

#3425

CI review gates read stale reviews when a passing review falls back to bold headings after Bash #-line denials

s12d ago

#3350

extension push: report dependencies whose lookup failed as not audited

s13d ago

#3438

Docs: manual quotes model wording that swamp-club#3437 changes to behavior

13d ago

#3326

Registry: validate, record and score the declared license (optional; remove the swamp-club license setting)

s13d ago

#3132

serve check-config: decide how to report restricted-model-types entries that cannot match

s13d ago

#3324

extension manifest: optional SPDX license: field, scored in quality and the rubric (field and LICENSE file, one point each)

s13d ago

#3376

extension push: archive source copy drops local modules imported from outside the model's directory

s13d ago

#3397

Registry: undo hiding of unlicensed extensions; remove the no-license banner and badge (license is optional; keep the licensed=true opt-in filter)

s13d ago

#3284

Remote worker keeps running stale code for an edited repo-local extension model

s13d ago

#2528

Workflow evaluation rejects another templating system's ${{ }} text, so the #2491 pass-through never reaches workflow steps

z13d ago

#3394

Flaky: AccessDataPoller 'a grant created by a real method run through A stays staged on A and reaches B'

13d ago

#3370

Registry scorer: a deno doc failure discards the whole scorecard, including the LICENSE and README facts (12 public extensions unscored)

s13d ago

#3392

Registry scorecard: dependency licenses follow the CLI's SPDX rules

7d ago

#3391

extension push: read dependency licenses with the shared SPDX parser (OR, AND, WITH)

s7d ago

#3325

swamp-extensions: declare license: in every @swamp manifest and in codegen output

s13d ago

#3323

Registry: hide extensions with no license from browsing (show-unlicensed toggle for 60 days; search API default unchanged)

s14d ago

#3348

Flaky: start_server_test 'two agent opens at once open only one window' opens 3 windows under parallel load

s14d ago

#3349

swamp-extensions: CI check that every manifest declares license: and ships a LICENSE file

19h ago

#3274

stagecraft: let users build their own tracker as a separate extension (open tracker kinds, published adapter contract and conformance suite)

s14d ago

#3343

datastore_v3_read_model_test: two swamp-club#3337 tests fail on Linux (Expected function to reject)

s14d ago

#3344

extensions_search index is never created if the first attempt fails, until the process restarts

14d ago

#3341

Registry search: a channel filter and a signed-in member's visibility overwrite each other's $or

14d ago

#3303

extensions rail facet counts ignore the query, channel and selected facets

s14d ago

#3318

A forEach's iterations run in name order, not list order (operate-10 before operate-2)

s14d ago

#3328

Docs: declaring an extension license, and why unlicensed extensions are hidden

13d ago

#3327

Extension licenses, day 60: remove the show-unlicensed toggle and settle what counts as licensed

13d ago

#3312

Docs: extension pull before/after summary, published vs followed channel, and publishedChannel in the lockfile and list

13d ago

#3297

stagecraft: a factory-wide read of work items waiting on a person (no studio, no per-item status loop)

15d ago

#3196

swamp model validate checks globalArguments without applying the model's upgrades chain

s15d ago

#3292

stagecraft: rebind a work item to another tracker (mirrored built-in tickets to Jira)

15d ago

#3291

stagecraft: example tracker extension and the writing-a-tracker guide (#3274 step 3)

15d ago

#3290

stagecraft: open the set of trackers to any bound adapter (#3274 step 2)

15d ago

#3289

stagecraft: publish and claim as workflows over a tracker method contract (#3274 step 1)

15d ago

#3030

digitalocean codegen: app-platform and database spec secret fields are not marked sensitive

z15d ago

#3114

swamp-extensions: replace bare import specifiers with npm:/jsr: specifiers in first-party extensions

s15d ago

#3190

stagecraft: let a method or workflow stage's target use {{name}} placeholders from run data

s15d ago

#3201

check_upgrades.ts skips models in nested extensions/models/ directories (e.g. stagecraft's engine/ and tracker/)

16d ago

#3230

verification: check_upgrades skips models in subdirectories, so stagecraft version bumps go unchecked

s16d ago

#3228

swamp issue edit: a dotted code path in the body is redacted as a hostname

s16d ago

#2280

issue-lifecycle: swamp-club lifecycle post failures are logged but the method still reports success

s16d ago

#3229

stagecraft: studio state_test 'after its event stream reconnects' is timing-flaky under load

16d ago

#2478

Namespace names are not reserved against cache/datastore layout directories (e.g. data)

z17d ago

#3139

serve check-config writes the extension catalog into the repo, though its help says nothing is written

z17d ago

#3149

extension fmt output prints JavaScript string concatenation and quoted values

z17d ago

#3170

dynamic-code safety error reports Babel line numbers, which disagree with the analyzer's newline-split lines

z18d ago

#3138

extension push offers to promote a yanked version, and extension promote does not check for a yank

z18d ago

#3067

Search and list output follows directory iteration order in the definition, workflow, vault and output repositories

z18d ago

#3200

stagecraft: integration test 'studio watch: an unchanged follow sends nothing; an edit sends a definition event' fails on main (macOS)

18d ago

#3194

stagecraft: upgrade stored factory definitions on read, so a format change does not break work in progress

s18d ago

#2257

-q does not suppress the update, auth-nudge and autoupdate banners

s18d ago

#3182

access grant create: a refused condition still leaves an empty grant-… definition and a failed run behind

s18d ago

#3163

codegen/aws: 9 services still pin @aws-sdk/client-cloudcontrol@3.1090.0

s18d ago

#2477

Clear error when hydrateFile reports success but the file is missing

z18d ago

#3062

Workflow load errors print the raw Zod issue dump instead of a readable message

z19d ago

#3176

Docs: extension info reference should show the Accepted warnings block and contentMetadata.acceptances (swamp-club#3158)

18d ago

#3158

extension info: show the accepted warnings the registry returns for the latest version (swamp-club#3095)

s19d ago

#2269

Periodic worker GC sweep prunes outside the sync gate

z19d ago

#3172

Docs: restricted-model-types covers edit, delete, data delete/rename and workflow step changes

18d ago

#2965

extension safety analyzer's Deno.Command( warning is a plain substring match

s19d ago

#3095

registry: store and show declared acceptances sent in contentMetadata.acceptances at confirm (swamp-club#3021)

s19d ago

#3169

extension safety analyzer does not warn on node:child_process or cluster subprocess spawning

19d ago

#3120

Flaky property test: analyzeExpression hyphenated dot access fails when modelName generates a CEL keyword ("in")

19d ago

#3107

extension push/quality: structured acceptances for agents, a clearer title than For next time, and an optional reason

s19d ago

#3116

Docs: extension publishing reference is stale on bare specifiers, quality output and fmt config (swamp-club#3022)

s19d ago

#3104

extension push: the undecided private-entitlement verdict still says the registry may start a trial at publish

s19d ago

#3150

Docs: private-entitlement verdict for a free collective with no trial is now failed, not undecided

18d ago

#3013

auto-resolve: the Installing line prints the extension's entire multi-line description

z19d ago

#3069

extension push: version-drift check reports 'no previously published version found' when the registry call failed

s19d ago

#3100

extension push: resolved file names and content hash are relative to the repo dir, so a push from outside the extension root shows ../ paths and a hash that differs from publish.yml

s19d ago

#3040

extension promote accepts a yanked version and reports it promoted

s19d ago

#3112

extension push: 'Requested visibility' line prints to stdout without the logger prefix, twice per run

19d ago

#3118

extension push: a required global argument renders with a stray "" ("text": "string""")

19d ago

#3017

extension push output: double-quoted adjacent interpolations, repo-relative paths, and --json emits three JSON documents

s19d ago

#3142

Docs: extension push content hash no longer depends on the swamp repo location (Match CI's content hash section)

19d ago

#3119

extension quality and push crash with IsADirectory when additionalFiles lists a directory

s20d ago

#3088

extension push --dry-run: authentication verdict prints 'Signed in as .' when the credential is an API key with no username

s20d ago

#3137

Manual: additionalFiles and binaries entries must be files, not directories

19d ago

#3135

Docs: extension push dry-run authentication verdict names the credential (follow-up to Lab 3088)

19d ago

#3134

Docs: serve restricted-model-types matches any @ spelling; restriction warnings in serve and check-config

18d ago

#3133

Model types: decide whether names like @/@x/y or a+b/c should be legal (type grammar)

20d ago

#3022

extension quality, fmt --check and push disagree: bare-specifier severity, cache hit skips gates, gate failure hides the rubric, fmt ignores project config

s20d ago

#3071

Docs: extension push dry-run reference and how-to need the registry checks, API-call list and content hash from Lab #3016

s20d ago

#3113

Docs: channel-aware extension push prompts and promote with a manifest (follow-up to #2939)

20d ago

← Back to list

01Issue

BugShippedSwamp CLIPublic

Assigneesskunk-ape

Relationships

#2965 extension safety analyzer's Deno.Command( warning is a plain substring match

Opened by skunk-ape · 10/2/2026· Shipped 10/8/2026

PR #2923: https://github.com/swamp-club/swamp/pull/2923

analyzeExtensionSafety warns when a .ts file contains the substring Deno.Command(, so the warning fires on text inside comments and strings and misses aliased forms such as const { Command } = Deno or Deno['Command']. It is the same flaw swamp-club #2949 fixes for the eval check. Once #2949's tokenizer lands, the warning could reuse it.

02Bog Flow

Shipped

10/8/2026, 1:22:34 PM

Click a lifecycle step above to view its details.

03Sludge Pulse

skunk-ape assigned skunk-ape10/7/2026, 10:31:05 PM