#3569 Extension lockfile stores machine-local paths (OS separators, gitignored .swamp/ files, pulledAt), so a repo shared by Windows and Linux never stays clean

What happened

A repo shared between Windows and Linux (the same git repo, checked out on both) never stays clean.

extensions/models/upstream_extensions.json records each extension's files with the pulling OS's path separator:

"@swamp/ssh": {
  "version": "2026.10.13.1",
  "pulledAt": "2026-10-16T01:34:34.943Z",
  "files": [".swamp\\bundles\\2f6574ec\\ssh.js", ".swamp\\pulled-extensions\\@swamp\\ssh\\files\\LICENSE.txt", "…"],
  "filesChecksum": "e0461e3a…",
  "serverUrl": "https://swamp-club.com",
  "publishedChannel": "stable"
}

On Linux, after a git pull of a lockfile written on Windows, every command warns:

[WRN] 14 pulled extension(s) have missing source files: @swamp/ssh, @swamp/stagecraft, … (e.g. .swamp\\bundles\\2f6574ec\\ssh.js, …). Run 'swamp extension install' to restore them.

swamp extension install then rewrites all 464 lines with /. The next commit from Windows flips them back, so the Linux checkout always shows the file as modified and blocks git pull --ff-only.

The underlying problem

The committed lockfile holds machine-local state:

• Every path in files is under .swamp/, which swamp's own managed .gitignore excludes. The lockfile lists files that are never committed. Each machine rebuilds them, and the bundle hash directories may differ.
• The paths are derivable. version and filesChecksum pin the content, and the extension's manifest lists its files.
• pulledAt changes the file on every pull, even when nothing pinned changed.

Proposed

• Better: pin only what makes an install reproducible: name, version, checksum, serverUrl and publishedChannel, as deno.lock and package-lock.json do. Derive local paths at runtime, and keep pulledAt and the file list under .swamp/.
• Smaller fallback: write POSIX / separators always, and accept either separator on read. Accepting both matters too: without it, lockfiles already committed from Windows keep warning on Linux.

Environment

• Windows 11 Pro: swamp 20261015.233727.0-sha.a39bdd69
• WSL2 Ubuntu 26.04 on the same machine: swamp 20261016.021405.0-sha.b46b8895
• The WSL clone's git origin is the Windows checkout. swamp serve runs in WSL.