issue-lifecycle: pr_merged and ship report success and advance the phase when swamp-club is unreachable, writing nothing upstream

3h ago

#3530

Remote readResource does not apply the legacy schema fallback for untagged sensitive records

4h ago

#3529

Remote resolveSecret allowlist is always empty for workflow steps that use vault.get

23h ago

#3523

auth login leaves auth.json apiKey empty and stores the key only in ~/.config/swamp/api-key, which the auth gate never reads

1d ago

#3516

swamp multi-model-eval: install promptfoo without optional dependencies to save ~900 MB of disk

1d ago

#3515

swamp install.sh: holds three copies of the binary at once (~913 MB peak); delete the archive and move instead of copy

1d ago

#3514

swamp-extensions CI: Review Integrity explains a stalled or failed audit (streamed progress, timeout, did-not-finish comment)

1d ago

#3495

Docs: manifest reference still describes the removed indexer symlinks directory for workflow resolution

1d ago

#3486

Docs: extension trust manual should describe OSV version resolution and the no-matching-version not-audited case

1d ago

#3483

Workflow run cancellation on concurrency-key conflict

2d ago

#3480

Read non-string sensitive resource fields back with their type

2d ago

#3470

Run index repair-by-stat misses an in-place, same-size record rewrite that restores mtime within the same second as its entry: ctime is reported in whole seconds

2d ago

#3466

Docs: private extension entitlement messages and whoami --json privateExtensions (follows swamp-club#3311)

2d ago

#3408

Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them

2d ago

#3401

A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through

3d ago

#3399

serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other

9h ago

#3392

Registry scorecard: dependency licenses follow the CLI's SPDX rules

3d ago

#3391

extension push: read dependency licenses with the shared SPDX parser (OR, AND, WITH)

s2d ago

#3390

@swamp/aws/ec2 has not published since 2026.09.29.1: its 23.4MB archive's publish job is killed after ~14 minutes

3d ago

#3383

extension pull: safety analysis scans the bundle the extension runs

3d ago

#3382

Teach defineBehavior in the extension skill now that swamp-testing 0.20261013.52 exports it

3d ago

#3378

verification: run the upgrade-path test in parallel, and skip the dynamic test for no-op bumps

3d ago

#3367

codegen: AWS models emit CloudFormation patterns JavaScript cannot compile, so @swamp/aws/chime, glue and transfer fail to import

3d ago

#3361

S3-backed serve: a poll that pulls one file invalidates the whole data catalog, so the next query re-reads every version

3d ago

#3354

extension push: pinned deprecated and unpinned or range dependency specifiers become errors (after the two-week window)

3d ago

#3353

Registry scorecard: audit the dependency version that ships, and JSR dependencies

3d ago

#3352

extension push: audit the dependency versions the bundle actually ships (pinned facts, deno info resolution, JSR existence)

3d ago

#3349

swamp-extensions: CI check that every manifest declares license: and ships a LICENSE file

3d ago

#3344

extensions_search index is never created if the first attempt fails, until the process restarts

3d ago

#3305

S3/GCS datastore sync: shared sync service lets one sync clear another's dirty marks and pull over unpushed files

4d ago

#3298

swamp-uat: the SIGTERM drain test does not check that the run succeeded

3d ago

#3297

stagecraft: a factory-wide read of work items waiting on a person (no studio, no per-item status loop)

4d ago

#3292

stagecraft: rebind a work item to another tracker (mirrored built-in tickets to Jira)

4d ago

#3280

s3-datastore: first push on a fresh cache prints 'Index merge failed' for a missing local .datastore-index.json

4d ago

#3272

swamp-extensions: use explicit npm:/jsr: specifiers in root extensions/models

4d ago

#3231

vercel/projects update: always resends the unchanged project name, which Vercel rejects with 409 "already exists"

6d ago

#3229

stagecraft: studio state_test 'after its event stream reconnects' is timing-flaky under load

6d ago

#3208

Activity projector fails with ZooKeeper "Bad version" error on swamp.score_grants during keeper instability

7d ago

#3198

s3-datastore: model-scoped pullChanged lists and walks the whole namespace

8d ago

#3174

swamp-extensions CI: Review Integrity audit stalls silently on a large trust-root change until Forgejo kills the job

s21h ago

#3169

extension safety analyzer does not warn on node:child_process or cluster subprocess spawning

8d ago

#3153

extension push: a swamp-quality-ignore directive after a comment holding an apostrophe is silently ignored

9d ago

#3133

Model types: decide whether names like @/@x/y or a+b/c should be legal (type grammar)

9d ago

#3103

seed:collective cannot produce a superseded personal trial or a returned trial, so the UAT cannot cover them

10d ago

#3073

serve HA: pull a token's definition on an auth miss so a peer accepts a new token at once

10d ago

#3065

extension push: accept attestation-backed adversarial-review evidence (lookup by extension and content hash), generated provenance, and carry the evidence to the registry at confirm (design: Lab #3023)

10d ago

#3060

Decide a stricter naming rule for workflow step and job names

10d ago

#3041

digitalocean codegen leaves an orphaned security_secret.ts model file after its endpoint left the spec

11d ago

#3010

s3-datastore/serve: readResource without a version returns an older version; the latest marker is rewritten backwards

Team4h ago

#3004

Publish agent-facing projections of the manual: /llms.txt, .md pages, and llms-full.txt

Enterprise12d ago

← Back to list

01Issue

BugTriagedExtensionsPublicTeam

Assigneesstack72

Relationships

#3540 Cloudflare extensions reject account-owned API tokens: credential check uses /user/tokens/verify

Opened by randybias · 10/16/2026

Description

Every @swamp/cloudflare/* extension validates an API token with GET /user/tokens/verify before its first call (models/_lib/cloudflare.ts, getAuth()). Cloudflare account-owned API tokens (created under Manage Account → API Tokens, or via POST /accounts/{account_id}/tokens) always fail that endpoint with HTTP 401 and error 1000 Invalid API Token, even though they are valid and active. Cloudflare verifies them at GET /accounts/{account_id}/tokens/verify instead.

So any model run with an account-owned token fails in getAuth() before it reaches the API. That includes @swamp/cloudflare/tokens/tokens itself, whose endpoints are all /accounts/{account_id}/tokens, meaning an account token is the natural credential to manage account tokens with.

Steps to reproduce

Create an account-owned API token (for example with Zone:Read, DNS:Edit).
GET https://[HOST-1]/client/v4/accounts/<id>/tokens/verify with it returns success: true, status: active.
GET https://[HOST-1]/client/v4/user/tokens/verify with the same token returns success: false, code 1000.
Run any @swamp/cloudflare/* model method with apiToken set to that token: it fails with Cloudflare API token is invalid (GET /user/tokens/verify returned 401).

Suggested fix

If /user/tokens/verify returns 401 with code 1000 and an account ID is available (most models take account_id), retry /accounts/{account_id}/tokens/verify. Alternatively, skip the up-front verify and let the first real call report auth errors. The check lives in the shared _lib/cloudflare.ts, so the fix applies to every @swamp/cloudflare/* package (seen in tokens and dns, version 2026.10.13.1).

Environment

@swamp/cloudflare/tokens and @swamp/cloudflare/dns 2026.10.13.1, swamp 20261013.025835.0.

Upstream repository: https://github.com/swamp-club/swamp-extensions

Environment

Extension: @swamp/cloudflare/tokens@2026.10.13.1
swamp: 20261013.025835.0-sha.1b6f0c59
OS: darwin (aarch64)
Deno: 2.9.7
Shell: /bin/zsh

02Bog Flow

Triaged

10/16/2026, 9:30:31 PM

Click a lifecycle step above to view its details.

03Sludge Pulse

stack72 assigned stack7210/16/2026, 9:29:22 PM

system commented 10/16/2026, 8:34:48 AM

Classified automatically when this issue was filed.

Source: Extensions

If you feel this classification is incorrect, add a ripple to tell us so.