Skip to main content
← Back to list
01Issue
BugShippedSwamp CLIPublic
Assigneeszack

Relationships

#3360 model validate: false "Template syntax passed through" warning on vault.get with unquoted arguments

Opened by mtaylor · 10/13/2026· Shipped 10/13/2026

swamp model validate warns "Template syntax passed through" on ${{ vault.get(t, KEY) }} (unquoted arguments), saying the text "is not a swamp expression and is passed to the method unchanged". That isn't true: the runtime resolves it to the secret, the same as the quoted form. Bare-token arguments are supported by the runtime (see #1786), so the check is a false positive.

Seen on swamp 20261013.025835.0-sha.1b6f0c59, Ubuntu (WSL2).

Repro

mkdir vt && cd vt && swamp repo init .
swamp vault create local_encryption t
swamp vault put t KEY not-a-secret-123

Three command/shell models, identical except for env.X:

type: command/shell
typeVersion: 2026.02.09.1
id: a7b15a3c-297c-4f16-a1c9-ec1e23231250
name: unq
version: 1
tags: {}
globalArguments: {}
methods:
  execute:
    arguments:
      run: 'if [ "$X" = not-a-secret-123 ]; then echo MATCH; else echo "NOMATCH len=${#X}"; fi'
      env:
        X: ${{ vault.get(t, KEY) }}
  • unq: X: ${{ vault.get(t, KEY) }}
  • q: X: ${{ vault.get("t", "KEY") }}
  • inl: X: "pre-${{ vault.get(t, KEY) }}"

Result

model swamp model validate swamp model method run <m> execute
unq ⚠ Template syntax passed through MATCH (resolved to the secret)
q clean MATCH
inl ⚠ Template syntax passed through resolved ("pre-" + secret, len 20)

Expected

No warning for vault.get with bare-token arguments, since the runtime resolves them. The validator's expression check should accept the same argument forms as the runtime's vault.get handling.

Workaround: quote the arguments, vault.get("t", "KEY").

02Bog Flow
✓OPEN✓TRIAGED✓IN PROGRESS✓SHIPPED+ 1 MOREASSIGNED+ 5 MOREREVIEW+ 16 MOREPR_MERGED+ 2 MORESESSION_SUMMARIZED

Shipped

10/13/2026, 5:31:54 PM

Click a lifecycle step above to view its details.

03Sludge Pulse
zack assigned zack10/13/2026, 3:08:21 PM
Editable. Press Enter to edit.

zack commented 10/13/2026, 5:31:56 PM

Thanks @mtaylor for reporting this! We shipped: Make the swamp-expression classifier read vault.get arguments the way the resolver does, so a bare-token vault.get is recognised as a swamp expression everywhere the classifier is used. This removes the false Template syntax passed through warning in model validate and makes the validate Global arguments check and the run-time global-argument guards treat the bare-token form exactly like the quoted form.. The fix has been merged and a release is on its way. We appreciate your contribution to swamp.

Sign in to post a ripple.