Extension scoring audits v2 archives exact-only and charges unaudited code, in the package and the CLI alike

s5m ago

#3869

extension fmt (and any command) creates or rewrites deno.lock when the extension lives in the repo's loaded extensions/ dir

s7m ago

#4015

extension quality: a collective-attested private repository scores provisional, and --json omits ifProvisionalEarned

22m ago

#3970

Extension push ships the canonical form: every npm:/jsr: import pinned exact, and a v2 dependency-audit.json

s58m ago

#4010

judgeRunRecord lets a forged record settle a waiting approval gate to skipped without an approve

1h ago

#3983

Extension dependencies: the shared import scan reads Babel syntax, not tokens (follow-up to #3969)

s2h ago

#3272

swamp-extensions: use explicit npm:/jsr: specifiers in root extensions/models

s2h ago

#3998

bundleExtension same-cache test can pass with a broken first-bundle gate under CPU load

2h ago

#3639

bundleExtension 'bundles on different caches do not wait for each other' test fails under CPU load

s2h ago

#3383

extension pull: safety analysis scans the bundle the extension runs

s13h ago

#3979

Extension scoring queue: two replicas can claim the same pending event

s14h ago

#3995

Registry: bump @swamp-club/extension-scoring to the version carrying #3983 (and #3845) before the v5 rescore

s10m ago

#3994

Five Mongo queues can hand the same row to two replicas

8h ago

#3863

Registry rescore: secret-safe-docs passes a secret README line on versions whose stored metadata predates the sensitive flag (follow-up to #3783)

s16h ago

#3977

Score extensions with @swamp-club/extension-scoring (rubric v5) instead of the registry's own copy

s17h ago

#3991

Move the Zod argument-field extractor into @swamp-club/extension-scoring so the CLI and registry read schemas alike

17h ago

#3969

Extension dependencies: one resolver for push, quality and fmt (no behaviour change)

s17h ago

#3989

Docs: extension quality scores with the registry formula and reports grade (swamp-club#3845)

s36m ago

#3980

Rescore every extension's current version under rubric v5

19h ago

#3153

extension push: a swamp-quality-ignore directive after a comment holding an apostrophe is silently ignored

19h ago

#3781

Share the extension quality rubric between the swamp CLI and swamp-club instead of mirroring it

s20h ago

#3974

Manual: the supported extension dependency categories, the canonical form and the lock rule, rewritten once against the final design

36m ago

#3973

Registry audits v2 extension archives as written, and a range costs the loose point only without a valid lock

s10m ago

#3972

Extension consumers keep the publisher's bundle: pull, update and auto-resolve stop rebuilding (direction A for #3634)

s16m ago

#3971

Extension push: inputs that open up (workspace root lock, ancestor config refused by name, JSR dist-tags) and the skill docs rewritten once

s7m ago

#3828

stagecraft studio: show a factory's open tickets that have no work item yet on the Board

s1d ago

#3964

stagecraft studio ticket columns: round-5 review lows from #3828 (source watch cost, relationText lookup, cross-instance claim)

1d ago

#3963

A long-lived serve client for extensions, and a stable rate_limited error code

1d ago

#3725

Docs: dependency trust across push, quality, fmt and the registry — Deno-config resolution, read-only lock, package.json mode, the archive's audit record (merges #3728)

s1d ago

#3793

extension push (package.json mode): two installed copies under one declared range are audited once, so the second shipped version goes unaudited

s1d ago

#3772

cve/emudhra page: Windows and macOS support, and shared CVE layer fixes (follow-up to #3710 and #3766)

s2d ago

#3775

@swamp/cve/php-rce-2026-10: match RHEL fixes for the PHP RCEs

s2d ago

#3776

@swamp/cve/dirtyfrag: report and README print the old swamp model command spelling

3d ago

#3870

package.json mode: no loose-specifier warning for a range push ships as the exact installed version

3d ago

#3826

method run masks a sensitive array from --input element by element, exposing its shape (regression from #3752)

s3d ago

#3783

Registry scorecard: score secret-safe-docs (rubric v4) and keep sensitive on extracted arguments

s3d ago

#3778

Registry dependency audit: audit the locked version push records in the archive, not the registry's newest match for a range specifier (swamp-club half of #3662)

s3d ago

#3855

stagecraft: rename work mode `method` to `behavior`, matching swamp's rename of models to behaviors

3d ago

#3662

extension push: record each dependency's audited (locked) version in the archive, so the registry audits what ships (swamp half; registry half #3778)

s4d ago

#3796

main fails type check: query_view_test.ts passes a namespace string where expressionQueryView now takes a NamespaceReader (semantic conflict between #3790 and #3785)

s4d ago

#3795

forEachNameWithoutSecrets property test fails intermittently: an empty-string secret and an overlapping recorded value give different names

4d ago

#3782

extension push finds no local modules when a folder above the repo is named node_modules

4d ago

#3630

extension push (package.json mode): audit dependencies resolved through package.json, and leave the author's node_modules/ unchanged (merges #3632)

s4d ago

#3764

Local verification docs still tell agents to put ANTHROPIC_API_KEY in verify.env for reviews

s4d ago

#3770

@swamp/cve/php-rce-2026-10 follow-ups: dry-run heading, command spelling, Debian 12 fix, podman image scan

s5d ago

#3612

extension push resolves the Deno config and import map the way Deno does: deno.jsonc, importMap file references and scopes

s5d ago

#3717

extension fmt --check writes deno.lock in deno.json mode, which push and quality then bundle against with --frozen

s5d ago

#3720

@swamp/cve/dirtyfrag: scan logs are never saved (file writer handle dropped, data name collides with the status resource)

5d ago

#3715

audit_deps.ts skips cve/ extensions, so their deno.lock files are never dependency-audited

s5d ago

#3719

@swamp/cve/dirtyfrag README shows --input targetHost/sshUser/sshKey/dockerContainer, which the CLI rejects

5d ago

#3716

@swamp/cve/dirtyfrag mitigate uses interactive sudo, so it can hang on a password prompt or fail mid-run

s5d ago

#3718

extension quality names the wrong cause: a bundle failure prints no reason, the not-audited row always blames an outage, and symbols-docs blames JSDoc when deno doc failed

s5d ago

#3728

Docs: extension fmt never writes deno.lock and warns on a stale one (swamp-club#3717)

3d ago

#3631

Docs: extension dependency trust pages — import-map auditing, bare-import rewrite and scoring, and the clarified warning/error plan

5d ago

#3682

Registry scorecard: a loose specifier costs one of the two dependency-trust points and a yanked one costs both, matching the CLI (#3354)

s5d ago

#3705

Server-driven warning and info messages to CLI users, targeted by swamp version (exploration)

6d ago

#3702

workflow cancel --server ignores --ca-cert and SWAMP_CA_CERT

6d ago

#3354

Dependency trust scoring (CLI): yanked and loose specifiers cost one of the two dependency-trust points (no new push errors)

s6d ago

#3669

extension quality crashes with deno doc --json failed when a package.json-mode archive ships a bare import

s6d ago

#3689

Docs: extension publishing reference quotes stale bare-specifiers and quality messages

6d ago

#3677

extension push: the yanked-dependency warning names a version to move to, and dependency warnings appear in the Unresolved warnings summary

s6d ago

#3688

Scorecard: copy the updated jsr-yanked wording from dependency_audit_vectors.json

6d ago

#3687

Docs: extension publishing reference should describe the yanked-version suggestion and dependency findings in Unresolved warnings

6d ago

#3601

eval-skill-triggers ignores evals/promptfoo/package-lock.json, so promptfoo's transitive deps are not locked

s6d ago

#3367

codegen: AWS models emit CloudFormation patterns JavaScript cannot compile, so @swamp/aws/chime, glue and transfer fail to import

6d ago

#3640

v3 outbox killed-writer test times out waiting for the kill point under CPU load

6d ago

#3673

On Windows, v3 outbox tests time out on a writer lock held by a dead fake pid

s6d ago

#3637

extension push: rewrite bare imports in the shipped source to their import-map specifiers

s6d ago

#3672

Flaky: probeStartServer 'a closed port is dead' gets unknown under the parallel test run

6d ago

#3638

workflow run --detach integration test fails under load: the run finishes before the test attaches

s6d ago

#3676

extension push: a deno.json scopes entry can make push ship and audit a different version than the extension resolves

6d ago

#3667

Skill trigger evals run through claude -p so verify-skills works on a subscription login

s6d ago

#3655

On Windows, extension pull and rm report paths with mixed separators

s6d ago

#3659

Windows CI: data_writer vary-suffix test writes a data name with a double quote, which #3568 refuses on Windows

s6d ago

#3664

Docs: bare imports mapped by deno.json are rewritten on push and scored

6d ago

#3663

vary/forEach object values with no key/name/id produce data names Windows refuses

7d ago

#3654

Since #3569: Datastore UAT's extension install row and 17 Windows extension unit tests fail on every release

s7d ago

#3611

extension push: dependencies named only through a deno.json import map are never audited

s7d ago

#3613

extension push rewrites the author's deno.lock when bundling

s7d ago

#3648

codegen/vercel: union (oneOf) read responses produce id-only ResourceSchemas

s7d ago

#3610

Docs: manual pages for push auditing the dependency version that ships (deprecated pin, loose specifier, JSR checks)

s7d ago

#3647

swamp core: a non-string sensitive value reads back as a JSON string

7d ago

#3634

extension install and extension pull leave different bundles for the same extension version

7d ago

#3632

extension push writes node_modules/.deno/ into the author's package.json project when bundling

5d ago

#3629

registry scorecard reports dependency trust passed for versions with bare imports it cannot audit

7d ago

#2564

swamp-club: unknown collective API token returns 422 instead of the documented 404

s7d ago

#3353

Registry scorecard: audit the dependency version that ships, and JSR dependencies

s7d ago

#3621

swamp update on Windows leaves no complete swamp.exe during a cross-volume copy, and keeps the zip until it finishes

s7d ago

#3618

install.ps1 keeps the release zip until exit and deletes the old swamp.exe before copying the new one

s7d ago

#3352

extension push: audit the dependency versions the bundle actually ships (pinned facts, deno info resolution, JSR existence)

s7d ago

#3616

Dev server (Vite) sends HTML pages with content-encoding: gzip over a body that isn't gzip

7d ago

#3515

swamp install.sh: holds three copies of the binary at once (~913 MB peak); delete the archive and move instead of copy

s7d ago

#3516

swamp multi-model-eval: install promptfoo without optional dependencies to save ~900 MB of disk

s7d ago

#3603

Multi-model skill eval: gpt-5.4 and gemini jobs fail preflight every run (OpenAI credits exhausted, Google API key invalid)

s7d ago

#3600

local_source_failed drops the indexing error: a transient local extension failure leaves no cause (follow-up to 1672)

7d ago

#3415

Docs: dependency trust reports unaudited dependencies (follows #3350)

s8d ago

#3463

auth whoami: log mode labels collectives Free and shows trial expired for a superseded trial

s8d ago

#3174

swamp-extensions CI: Review Integrity audit stalls silently on a large trust-root change until Forgejo kills the job

s8d ago

#3536

extension quality and push report source paths through the repo's resolved symlink: quality's entry.file climbs to / and back

z10d ago

#3313

extension pull: answering y to a dependency's overwrite prompt silently skips that dependency

z10d ago

#3311

extension push --private: trust the registry's privateExtensions verdict instead of deciding from plan/trial

s11d ago

#3500

A bare deno check fails with ~2,000 errors in packages/dashboard; make the dashboard type-check under Deno

s11d ago

#3514

swamp-extensions CI: Review Integrity explains a stalled or failed audit (streamed progress, timeout, did-not-finish comment)

7d ago

#2583

verify-reviews: adversarial review path guard is a hand-kept list, so new extensions silently skip it

s11d ago

#3503

whoami reports a superseded trial as expired, and a Personal License does not end the trial for private extensions

s11d ago

#3497

Flaky: v3 restore test 'serve's retake after another checkout wrote restores into its open store' fails under full-suite load

11d ago

#3498

Manual: extension quality --json status field should say a check that would block a push

s12d ago

#3464

extension quality --json reports status "failed" when a rubric factor is missing, though the exit code is 0

s12d ago

#3495

Docs: manifest reference still describes the removed indexer symlinks directory for workflow resolution

7d ago

#3385

bundle freshness ignores local modules outside the kind directory

z12d ago

#3486

Docs: extension trust manual should describe OSV version resolution and the no-matching-version not-audited case

7d ago

← Back to list

01Issue

FeatureShippedSwamp ClubPublic

Assigneesskunk-ape

Relationships

#3353 Registry scorecard: audit the dependency version that ships, and JSR dependencies

Opened by skunk-ape · 10/13/2026· Shipped 10/19/2026

Part D (#3353, release 2, swamp-club) of the extension dependency trust plan (#3350–#3354). Plan: Extension dependency trust plan (https://claude.ai/code/artifact/c333312a-ca26-4056-a7f2-cabd7f30457c).

Change

The registry scorer reads deprecation, license and maintainers from the audited version, not latest.
It audits JSR dependencies: exists, not yanked.
The registry can't run deno info, so it uses the archive's lockfile when present, and otherwise the declared specifier as today. Say which in the scorecard finding.

Depends on

#3351.

Acceptance

Unit tests mirroring #3352's cases, where they apply.
Club UAT: scorecard findings for a deprecated pin and a missing JSR version.

02Bog Flow

Shipped

10/19/2026, 6:34:52 PM

Click a lifecycle step above to view its details.

03Sludge Pulse

skunk-ape assigned skunk-ape10/19/2026, 3:41:29 PM

system commented 10/13/2026, 2:31:22 PM

Classified automatically when this issue was filed.

Source: Swamp Club

If you feel this classification is incorrect, add a ripple to tell us so.