01Issue

BugShippedSwamp ClubPublic

Relationships

#3458 Windows: extension yank fails with API key auth despite extensions:* scope

Opened by stack72 · 10/14/2026· Shipped 10/14/2026

extension yank returns Not authenticated even though auth whoami shows authenticated with extensions:* scope via API key. extension push works with the same credentials. The yank endpoint appears to require user-level OAuth auth rather than accepting API key auth. Tested on binary 20261014.165834.0 with collective swamp-uat.

02Bog Flow

Shipped

10/14/2026, 7:04:43 PM

Click a lifecycle step above to view its details.

03Sludge Pulse

stack72 assigned stack7210/14/2026, 5:58:07 PM

system commented 10/14/2026, 5:51:57 PM

Classified automatically when this issue was filed.

Source: Swamp Club

If you feel this classification is incorrect, add a ripple to tell us so.

stack72 commented 10/14/2026, 7:18:21 PM

Fixed in swamp-club PR #1354, deployed to production (326f2d99). Server-side, not Windows-specific: the yank/unyank/deprecate/undeprecate endpoint accepted only a signed-in session, so a collective API key got a 401. Collective keys can now run all four through the new extensions:lifecycle scope, which extensions:* includes. No CLI change needed. A key with only extensions:push now gets a clear scope error instead of 'Not authenticated'.

Retention: one timeframe, enforced automatically, after which nothing older remains anywhere in the datastore

serve shutdown waits for an unsignalled run index rebuild: the continuation sweep's boot pass and request-led rebuilds cannot be stopped by SIGTERM

Run index repair-by-stat misses an in-place, same-size record rewrite that restores mtime within the same second as its entry: ctime is reported in whole seconds

Docs: add PowerShell to Set Up Shell Completions

Docs: private extension entitlement messages and whoami --json privateExtensions (follows swamp-club#3311)

extension quality --json reports status "failed" when a rubric factor is missing, though the exit code is 0

auth whoami: log mode labels collectives Free and shows trial expired for a superseded trial

Docs: extension quality now reports repository-verified for private source hosting (swamp-club#3406)

Datastore rework Phase 4: real-endpoint check of Phase 4A's replication figures on a hosted S3-compatible service (spike)

Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them

A manual worker verify racing an enrollment probe can leave a healthy worker unverified until it reconnects

A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through

serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other

Datastore rework Phase 4 G: S3 and GCS implement the writable datastore-wide control plane and keep _control/writer/ at the bucket root

Registry scorecard: dependency licenses follow the CLI's SPDX rules

extension push: read dependency licenses with the shared SPDX parser (OR, AND, WITH)

@swamp/aws/ec2 has not published since 2026.09.29.1: its 23.4MB archive's publish job is killed after ~14 minutes

bundle freshness ignores local modules outside the kind directory

extension pull: safety analysis scans the bundle the extension runs

Teach defineBehavior in the extension skill now that swamp-testing 0.20261013.52 exports it

verification: run the upgrade-path test in parallel, and skip the dynamic test for no-op bumps

S3/GCS datastores: write data version files create-only so a second writer cannot overwrite an existing version

codegen: AWS models emit CloudFormation patterns JavaScript cannot compile, so @swamp/aws/chime, glue and transfer fail to import

S3-backed serve: a poll that pulls one file invalidates the whole data catalog, so the next query re-reads every version

extension push: pinned deprecated and unpinned or range dependency specifiers become errors (after the two-week window)

Registry scorecard: audit the dependency version that ships, and JSR dependencies

extension push: audit the dependency versions the bundle actually ships (pinned facts, deno info resolution, JSR existence)

swamp-extensions: CI check that every manifest declares license: and ships a LICENSE file

extensions_search index is never created if the first attempt fails, until the process restarts

extension pull: answering y to a dependency's overwrite prompt silently skips that dependency

S3/GCS datastore sync: shared sync service lets one sync clear another's dirty marks and pull over unpushed files

swamp-uat: the SIGTERM drain test does not check that the run succeeded

stagecraft: a factory-wide read of work items waiting on a person (no studio, no per-item status loop)

stagecraft: rebind a work item to another tracker (mirrored built-in tickets to Jira)

s3-datastore: first push on a fresh cache prints 'Index merge failed' for a missing local .datastore-index.json

swamp-extensions: use explicit npm:/jsr: specifiers in root extensions/models

vercel/projects update: always resends the unchanged project name, which Vercel rejects with 409 "already exists"

stagecraft: studio state_test 'after its event stream reconnects' is timing-flaky under load

Show wait keys and pending signals to remote clients and the dashboard

Activity projector fails with ZooKeeper "Bad version" error on swamp.score_grants during keeper instability

@swamp/s3-datastore and @swamp/gcs-datastore: implement datastoreControlPlaneStore() for the format marker read

s3-datastore: model-scoped pullChanged lists and walks the whole namespace

Datastore sync: a no-op push after a model-scoped pull arms the remote commitSeq, hiding other hosts' commits until the next commit

extension safety analyzer does not warn on node:child_process or cluster subprocess spawning

extension push: a swamp-quality-ignore directive after a comment holding an apostrophe is silently ignored

Model types: decide whether names like @/@x/y or a+b/c should be legal (type grammar)

seed:collective cannot produce a superseded personal trial or a returned trial, so the UAT cannot cover them

serve HA: pull a token's definition on an auth miss so a peer accepts a new token at once

extension push: accept attestation-backed adversarial-review evidence (lookup by extension and content hash), generated provenance, and carry the evidence to the registry at confirm (design: Lab #3023)

Decide a stricter naming rule for workflow step and job names

Relationships

#3458 Windows: extension yank fails with API key auth despite extensions:* scope

Shipped