Relationships
#3360 model validate: false "Template syntax passed through" warning on vault.get with unquoted arguments
Opened by mtaylor · 10/13/2026· Shipped 10/13/2026
swamp model validate warns "Template syntax passed through" on ${{ vault.get(t, KEY) }} (unquoted arguments), saying the text "is not a swamp expression and is passed to the method unchanged". That isn't true: the runtime resolves it to the secret, the same as the quoted form. Bare-token arguments are supported by the runtime (see #1786), so the check is a false positive.
Seen on swamp 20261013.025835.0-sha.1b6f0c59, Ubuntu (WSL2).
Repro
mkdir vt && cd vt && swamp repo init .
swamp vault create local_encryption t
swamp vault put t KEY not-a-secret-123Three command/shell models, identical except for env.X:
type: command/shell
typeVersion: 2026.02.09.1
id: a7b15a3c-297c-4f16-a1c9-ec1e23231250
name: unq
version: 1
tags: {}
globalArguments: {}
methods:
execute:
arguments:
run: 'if [ "$X" = not-a-secret-123 ]; then echo MATCH; else echo "NOMATCH len=${#X}"; fi'
env:
X: ${{ vault.get(t, KEY) }}unq:X: ${{ vault.get(t, KEY) }}q:X: ${{ vault.get("t", "KEY") }}inl:X: "pre-${{ vault.get(t, KEY) }}"
Result
| model | swamp model validate |
swamp model method run <m> execute |
|---|---|---|
| unq | ⚠ Template syntax passed through | MATCH (resolved to the secret) |
| q | clean | MATCH |
| inl | ⚠ Template syntax passed through | resolved ("pre-" + secret, len 20) |
Expected
No warning for vault.get with bare-token arguments, since the runtime resolves them. The validator's expression check should accept the same argument forms as the runtime's vault.get handling.
Workaround: quote the arguments, vault.get("t", "KEY").
Shipped
Click a lifecycle step above to view its details.
zack commented 10/13/2026, 5:31:56 PM
Thanks @mtaylor for reporting this! We shipped: Make the swamp-expression classifier read vault.get arguments the way the resolver does, so a bare-token vault.get is recognised as a swamp expression everywhere the classifier is used. This removes the false Template syntax passed through warning in model validate and makes the validate Global arguments check and the run-time global-argument guards treat the bare-token form exactly like the quoted form.. The fix has been merged and a release is on its way. We appreciate your contribution to swamp.
Sign in to post a ripple.