doctor datastores --repair --json prints two JSON documents instead of one

36m ago

#4010

judgeRunRecord lets a forged record settle a waiting approval gate to skipped without an approve

59m ago

#4009

Claude audit hook misses PowerShell tool calls and sessions started above the swamp repo

1h ago

#4008

access can-i: evaluate a local grants file without --server

1h ago

#4007

Show each method's kind in type describe --json

1h ago

#4006

Team mode: serve sends the compacted base, so a serve-mode checkout can catch up past compaction

1h ago

#3999

Support search and filters as URL query parameters on /extensions

2h ago

#3998

bundleExtension same-cache test can pass with a broken first-bundle gate under CPU load

2h ago

#3995

Registry: bump @swamp-club/extension-scoring to the version carrying #3983 (and #3845) before the v5 rescore

9m ago

#3994

Five Mongo queues can hand the same row to two replicas

7h ago

#3993

Docs: run-workflows-on-a-schedule tells readers to curl /health for queue state, which no longer lists schedules

7h ago

#3992

Collective invite shows "This invitation has expired or has already been used" after a successful join via Google sign-in

15h ago

#3991

Move the Zod argument-field extractor into @swamp-club/extension-scoring so the CLI and registry read schemas alike

16h ago

#3988

serve: dispatch to an idle worker waits for its worker_busy write on the shared gateway transition tail

17h ago

#3987

serve: worker enrollment resolves and creates the worker definition inside the serialized gateway transition tail

17h ago

#3980

Rescore every extension's current version under rubric v5

18h ago

#3974

Manual: the supported extension dependency categories, the canonical form and the lock rule, rewritten once against the final design

20h ago

#3973

Registry audits v2 extension archives as written, and a range costs the loose point only without a valid lock

20h ago

#3972

Extension consumers keep the publisher's bundle: pull, update and auto-resolve stop rebuilding (direction A for #3634)

20h ago

#3971

Extension push: inputs that open up (workspace root lock, ancestor config refused by name, JSR dist-tags) and the skill docs rewritten once

20h ago

#3964

stagecraft studio ticket columns: round-5 review lows from #3828 (source watch cost, relationText lookup, cross-instance claim)

1d ago

#3963

A long-lived serve client for extensions, and a stable rate_limited error code

1d ago

#3962

swamp serve on a v3 datastore never settles a workflow run left running by a stopped instance: boot reaper skips it as belonging to a remote instance

1d ago

#3961

swamp serve on a v3 datastore: a run interrupted at a clean shutdown is never committed when the bucket is slow, and stays running for every other checkout

1d ago

#3957

Support creating 1Password vaults for new clients

1d ago

#3953

datastore_v3_replica_verify_test stall case flakes under the full integration run: restore.pid is read before the stub writes it

1d ago

#3946

Generated state schemas require every child of nested objects, so normal resources warn on create/get

1d ago

#3930

Add LinkedIn as a login provider

1d ago

#3929

Showcase reward backfill can double-pay 5,000,000 points when replicas start together

1d ago

#3928

Docs: --trusted-hosts accepts host:port for public addresses on non-default ports

1d ago

#3887

A workflow step's method output is invisible to `data query` and `data list`, and the method summary's retrieval command returns an older run's data

1d ago

#3885

Skill propulsion rule is silent when no transition is satisfied because stage work is outstanding

2d ago

#3870

package.json mode: no loose-specifier warning for a range push ships as the exact installed version

3d ago

#3865

serve shutdown does not wait for worker status writes, and its listener accepts workers after the gateway is disposed

3d ago

#3855

stagecraft: rename work mode `method` to `behavior`, matching swamp's rename of models to behaviors

3d ago

#3843

auth token create --json fields key and signinToken are undocumented; no token-mode service setup page

3d ago

#3841

trigger.schedule is evaluated in the serve host's local time zone, with no zone field and no doc saying so

3d ago

#3839

workflow validate/run say "Workflow not found" for a file that doctor workflows explains is misnamed

3d ago

#3833

telemetry stats says "No telemetry data found" right after successful sends; say the spool is empty because it flushed

3d ago

#3829

Docs: publish typed-secrets Phase 4.6 expression and delivery semantics

3d ago

#3825

Extension registry page: a supported way to include media (images) in the README

3d ago

#3816

CEL: data.latest(...).version is a double, but data.version() only accepts int, so "version - 1" fails at run time

4d ago

#3815

workflow resume --run refuses workflows with the same step name in two jobs, though validate and run accept them

4d ago

#3787

Update public OpenTelemetry manual for remote waterfalls and execution metrics (#3786)

4d ago

#3705

Server-driven warning and info messages to CLI users, targeted by swamp version (exploration)

6d ago

#3703

Serve: delegate namespace-scoped extension pulls and reload without granting administrator access

6d ago

#3702

workflow cancel --server ignores --ca-cert and SWAMP_CA_CERT

6d ago

#3679

Preserve active worker execution across serve restarts and upgrades; reconnect and reattach dispatches

6d ago

#3674

v3: chunk durability barrier costs a full drive-cache flush per command on macOS; use an ordering barrier

3d ago

#3663

vary/forEach object values with no key/name/id produce data names Windows refuses

7d ago

#3651

issue-lifecycle start drops issue comments: context.comments is always empty

7d ago

#3647

swamp core: a non-string sensitive value reads back as a JSON string

7d ago

#3641

Generated vault keys carry raw data-name and vary characters that strict vault providers reject

7d ago

#3634

extension install and extension pull leave different bundles for the same extension version

7d ago

#3608

Registry drops contentMetadata.extensions (method grafts) at confirm-push

7d ago

#3603

Multi-model skill eval: gpt-5.4 and gemini jobs fail preflight every run (OpenAI credits exhausted, Google API key invalid)

s7d ago

#3600

local_source_failed drops the indexing error: a transient local extension failure leaves no cause (follow-up to 1672)

7d ago

#3580

Finer-grained method locking: a long-running method on one definition blocks unrelated objects managed by the same definition

Team10d ago

#3579

Surface (or warn about) values a model method returns besides dataHandles, with sensitive-field support

Team10d ago

#3578

workflow placement: run a workflow transparently on a specified host, local or via swamp workers (incl. nested child workflows)

Team10d ago

#3554

issue-lifecycle: pr_merged and ship report success and advance the phase when swamp-club is unreachable, writing nothing upstream

10d ago

#3523

auth login leaves auth.json apiKey empty and stores the key only in ~/.config/swamp/api-key, which the auth gate never reads

11d ago

#3514

swamp-extensions CI: Review Integrity explains a stalled or failed audit (streamed progress, timeout, did-not-finish comment)

7d ago

#3483

Workflow run cancellation on concurrency-key conflict

12d ago

#3480

Read non-string sensitive resource fields back with their type

12d ago

#3470

Run index repair-by-stat misses an in-place, same-size record rewrite that restores mtime within the same second as its entry: ctime is reported in whole seconds

12d ago

#3408

Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them

12d ago

#3401

A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through

13d ago

#3399

serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other

11d ago

← Back to list

01Issue

BugShippedExtensionsPublic

Assigneesstack72

Relationships

#3715 audit_deps.ts skips cve/ extensions, so their deno.lock files are never dependency-audited

Opened by skunk-ape · 10/21/2026· Shipped 10/22/2026

PR #531: https://git.swamp-club.com/swamp-club/swamp-extensions/pulls/531

scripts/audit_deps.ts SCAN_ROOTS lists vault, datastore, model, codegen, issue-lifecycle and stagecraft. cve/ is missing, so the lockfiles of cve/dirtyfrag, cve/mini-shai-hulud, cve/researcher (and the upcoming cve/php-rce-2026-10 from #3711) are never audited for vulnerable dependencies. Other top-level extension dirs (ssh, kubernetes, workflows, agent-runner, deno-runner, software-factory) look missing too and are worth checking in the same pass. Found during the #3711 adversarial review.

02Bog Flow

Shipped

10/22/2026, 1:23:27 AM

Click a lifecycle step above to view its details.

03Sludge Pulse

stack72 assigned stack7210/21/2026, 11:46:27 PM

doctor datastores --repair --json prints two JSON documents instead of one

judgeRunRecord lets a forged record settle a waiting approval gate to skipped without an approve

Claude audit hook misses PowerShell tool calls and sessions started above the swamp repo

access can-i: evaluate a local grants file without --server

Show each method's kind in type describe --json

Team mode: serve sends the compacted base, so a serve-mode checkout can catch up past compaction

Support search and filters as URL query parameters on /extensions

bundleExtension same-cache test can pass with a broken first-bundle gate under CPU load

Registry: bump @swamp-club/extension-scoring to the version carrying #3983 (and #3845) before the v5 rescore

Five Mongo queues can hand the same row to two replicas

Docs: run-workflows-on-a-schedule tells readers to curl /health for queue state, which no longer lists schedules

Collective invite shows "This invitation has expired or has already been used" after a successful join via Google sign-in

Move the Zod argument-field extractor into @swamp-club/extension-scoring so the CLI and registry read schemas alike

serve: dispatch to an idle worker waits for its worker_busy write on the shared gateway transition tail

serve: worker enrollment resolves and creates the worker definition inside the serialized gateway transition tail

Rescore every extension's current version under rubric v5

Manual: the supported extension dependency categories, the canonical form and the lock rule, rewritten once against the final design

Registry audits v2 extension archives as written, and a range costs the loose point only without a valid lock

Extension consumers keep the publisher's bundle: pull, update and auto-resolve stop rebuilding (direction A for #3634)

Extension push: inputs that open up (workspace root lock, ancestor config refused by name, JSR dist-tags) and the skill docs rewritten once

stagecraft studio ticket columns: round-5 review lows from #3828 (source watch cost, relationText lookup, cross-instance claim)

A long-lived serve client for extensions, and a stable rate_limited error code

swamp serve on a v3 datastore never settles a workflow run left running by a stopped instance: boot reaper skips it as belonging to a remote instance

swamp serve on a v3 datastore: a run interrupted at a clean shutdown is never committed when the bucket is slow, and stays running for every other checkout

Support creating 1Password vaults for new clients

datastore_v3_replica_verify_test stall case flakes under the full integration run: restore.pid is read before the stub writes it

Generated state schemas require every child of nested objects, so normal resources warn on create/get

Add LinkedIn as a login provider

Showcase reward backfill can double-pay 5,000,000 points when replicas start together

Showcase editor: caption counter is not announced to screen readers

Profile showcase read: approved list sorts on review.reviewedAt in memory

Showcase countByStatus: $match live statuses before the $group

Showcase admin queues: index-serve the updatedAt sort on approved/rejected

Annotate and retain past workflow runs and data after the fact

Docs: --trusted-hosts accepts host:port for public addresses on non-default ports

A workflow step's method output is invisible to `data query` and `data list`, and the method summary's retrieval command returns an older run's data

Skill propulsion rule is silent when no transition is satisfied because stage work is outstanding

package.json mode: no loose-specifier warning for a range push ships as the exact installed version

serve shutdown does not wait for worker status writes, and its listener accepts workers after the gateway is disposed

stagecraft: rename work mode `method` to `behavior`, matching swamp's rename of models to behaviors

auth token create --json fields key and signinToken are undocumented; no token-mode service setup page

trigger.schedule is evaluated in the serve host's local time zone, with no zone field and no doc saying so

workflow validate/run say "Workflow not found" for a file that doctor workflows explains is misnamed

telemetry stats says "No telemetry data found" right after successful sends; say the spool is empty because it flushed

Docs: publish typed-secrets Phase 4.6 expression and delivery semantics

Extension registry page: a supported way to include media (images) in the README

CEL: data.latest(...).version is a double, but data.version() only accepts int, so "version - 1" fails at run time

workflow resume --run refuses workflows with the same step name in two jobs, though validate and run accept them

Update public OpenTelemetry manual for remote waterfalls and execution metrics (#3786)

Server-driven warning and info messages to CLI users, targeted by swamp version (exploration)

Serve: delegate namespace-scoped extension pulls and reload without granting administrator access

workflow cancel --server ignores --ca-cert and SWAMP_CA_CERT

Preserve active worker execution across serve restarts and upgrades; reconnect and reattach dispatches

v3: chunk durability barrier costs a full drive-cache flush per command on macOS; use an ordering barrier

vary/forEach object values with no key/name/id produce data names Windows refuses

issue-lifecycle start drops issue comments: context.comments is always empty

swamp core: a non-string sensitive value reads back as a JSON string

Generated vault keys carry raw data-name and vary characters that strict vault providers reject

extension install and extension pull leave different bundles for the same extension version

Registry drops contentMetadata.extensions (method grafts) at confirm-push

Multi-model skill eval: gpt-5.4 and gemini jobs fail preflight every run (OpenAI credits exhausted, Google API key invalid)

local_source_failed drops the indexing error: a transient local extension failure leaves no cause (follow-up to 1672)

Finer-grained method locking: a long-running method on one definition blocks unrelated objects managed by the same definition

Surface (or warn about) values a model method returns besides dataHandles, with sensitive-field support

workflow placement: run a workflow transparently on a specified host, local or via swamp workers (incl. nested child workflows)

issue-lifecycle: pr_merged and ship report success and advance the phase when swamp-club is unreachable, writing nothing upstream

auth login leaves auth.json apiKey empty and stores the key only in ~/.config/swamp/api-key, which the auth gate never reads

swamp-extensions CI: Review Integrity explains a stalled or failed audit (streamed progress, timeout, did-not-finish comment)

Workflow run cancellation on concurrency-key conflict

Read non-string sensitive resource fields back with their type

Run index repair-by-stat misses an in-place, same-size record rewrite that restores mtime within the same second as its entry: ctime is reported in whole seconds

Configurable storage tiers: runs, outputs, data versions and audit move through an ordered list of user-defined tiers, and stay queryable across them

A global argument that evaluates to swamp-namespace expression text is silently dropped, and literal() cannot pass it through

serve: the per-IP WebSocket burst limit can't be configured, so workers behind one NAT IP throttle each other

Relationships

#3715 audit_deps.ts skips cve/ extensions, so their deno.lock files are never dependency-audited

Shipped