Move the Zod argument-field extractor into @swamp-club/extension-scoring so the CLI and registry read schemas alike

14m ago

#3989

Docs: extension quality scores with the registry formula and reports grade (swamp-club#3845)

46m ago

#3988

serve: dispatch to an idle worker waits for its worker_busy write on the shared gateway transition tail

1h ago

#3987

serve: worker enrollment resolves and creates the worker definition inside the serialized gateway transition tail

1h ago

#3985

Datastore rework Phase 5 (team mode) 2/3: the CLI's serve upstream — with serverAddress, a v3 checkout commits, reads chunks and catches up through serve's datastore API, with no storage credentials

1h ago

#3983

Extension dependencies: the shared import scan reads Babel syntax, not tokens (follow-up to #3969)

1h ago

#3980

Manual: the supported extension dependency categories, the canonical form and the lock rule, rewritten once against the final design

3h ago

#3973

Registry audits v2 extension archives as written, and a range costs the loose point only without a valid lock

3h ago

#3972

Extension consumers keep the publisher's bundle: pull, update and auto-resolve stop rebuilding (direction A for #3634)

3h ago

#3971

Extension push: inputs that open up (workspace root lock, ancestor config refused by name, JSR dist-tags) and the skill docs rewritten once

3h ago

#3970

Extension push ships the canonical form: every npm:/jsr: import pinned exact, and a v2 dependency-audit.json

3h ago

#3964

stagecraft studio ticket columns: round-5 review lows from #3828 (source watch cost, relationText lookup, cross-instance claim)

7h ago

#3963

A long-lived serve client for extensions, and a stable rate_limited error code

7h ago

#3962

swamp serve on a v3 datastore never settles a workflow run left running by a stopped instance: boot reaper skips it as belonging to a remote instance

7h ago

#3961

swamp serve on a v3 datastore: a run interrupted at a clean shutdown is never committed when the bucket is slow, and stays running for every other checkout

7h ago

#3957

Support creating 1Password vaults for new clients

12h ago

#3955

Filesystem datastore: an unclean shutdown leaves zero-byte data versions as the latest version, and `doctor datastores --repair` does not detect them

15h ago

#3953

datastore_v3_replica_verify_test stall case flakes under the full integration run: restore.pid is read before the stub writes it

21h ago

#3946

Generated state schemas require every child of nested objects, so normal resources warn on create/get

23h ago

#3930

Add LinkedIn as a login provider

1d ago

#3929

Showcase reward backfill can double-pay 5,000,000 points when replicas start together

1d ago

#3928

Showcase editor: caption counter is not announced to screen readers

1d ago

#3927

Profile showcase read: approved list sorts on review.reviewedAt in memory

1d ago

#3926

Showcase countByStatus: $match live statuses before the $group

1d ago

#3925

Showcase admin queues: index-serve the updatedAt sort on approved/rejected

1d ago

#3914

Annotate and retain past workflow runs and data after the fact

Enterprise1d ago

#3913

Docs: --trusted-hosts accepts host:port for public addresses on non-default ports

23h ago

#3887

A workflow step's method output is invisible to `data query` and `data list`, and the method summary's retrieval command returns an older run's data

8h ago

#3885

Skill propulsion rule is silent when no transition is satisfied because stage work is outstanding

2d ago

#3870

package.json mode: no loose-specifier warning for a range push ships as the exact installed version

3d ago

#3869

extension fmt (and any command) creates or rewrites deno.lock when the extension lives in the repo's loaded extensions/ dir

3d ago

#3865

serve shutdown does not wait for worker status writes, and its listener accepts workers after the gateway is disposed

3d ago

#3855

stagecraft: rename work mode `method` to `behavior`, matching swamp's rename of models to behaviors

3d ago

#3843

auth token create --json fields key and signinToken are undocumented; no token-mode service setup page

3d ago

#3841

trigger.schedule is evaluated in the serve host's local time zone, with no zone field and no doc saying so

2d ago

#3839

workflow validate/run say "Workflow not found" for a file that doctor workflows explains is misnamed

3d ago

#3833

telemetry stats says "No telemetry data found" right after successful sends; say the spool is empty because it flushed

3d ago

#3829

Docs: publish typed-secrets Phase 4.6 expression and delivery semantics

3d ago

#3825

Extension registry page: a supported way to include media (images) in the README

3d ago

#3816

CEL: data.latest(...).version is a double, but data.version() only accepts int, so "version - 1" fails at run time

3d ago

#3815

workflow resume --run refuses workflows with the same step name in two jobs, though validate and run accept them

3d ago

#3787

Update public OpenTelemetry manual for remote waterfalls and execution metrics (#3786)

4d ago

#3705

Server-driven warning and info messages to CLI users, targeted by swamp version (exploration)

5d ago

#3703

Serve: delegate namespace-scoped extension pulls and reload without granting administrator access

5d ago

#3702

workflow cancel --server ignores --ca-cert and SWAMP_CA_CERT

5d ago

#3679

Preserve active worker execution across serve restarts and upgrades; reconnect and reattach dispatches

6d ago

#3674

v3: chunk durability barrier costs a full drive-cache flush per command on macOS; use an ordering barrier

2d ago

← Back to list

01Issue

BugClosedExtensionsPublic

AssigneesNone

Relationships

#3945 cve/tailworm extension README says the findings were not seen in the wild, which no source states

Opened by stack72 · 10/25/2026

swamp-extensions cve/tailworm/README.md line 8 says the findings were reproduced in a lab, not seen in the wild. The tailworm.com report says only that all findings were verified by reproduction in a lab environment; it says nothing about exploitation outside its lab, and no other source does either. swamp-club#3901 fixed the same claim on swamp-club.com/cve/tailworm. Suggested wording: The findings were reproduced in a lab; the report describes no exploitation outside it.

02Bog Flow

Closed

10/25/2026, 10:09:47 PM

No activity in this phase yet.

03Sludge Pulse

system commented 10/25/2026, 10:09:14 PM

Classified automatically when this issue was filed.

Source: Extensions

If you feel this classification is incorrect, add a ripple to tell us so.

Move the Zod argument-field extractor into @swamp-club/extension-scoring so the CLI and registry read schemas alike

Docs: extension quality scores with the registry formula and reports grade (swamp-club#3845)

serve: dispatch to an idle worker waits for its worker_busy write on the shared gateway transition tail

serve: worker enrollment resolves and creates the worker definition inside the serialized gateway transition tail

Datastore rework Phase 5 (team mode) 2/3: the CLI's serve upstream — with serverAddress, a v3 checkout commits, reads chunks and catches up through serve's datastore API, with no storage credentials

Extension dependencies: the shared import scan reads Babel syntax, not tokens (follow-up to #3969)

Rescore every extension's current version under rubric v5

Extension scoring queue: two replicas can claim the same pending event

Scheduled flaky-test detection is failing

Manual: the supported extension dependency categories, the canonical form and the lock rule, rewritten once against the final design

Registry audits v2 extension archives as written, and a range costs the loose point only without a valid lock

Extension consumers keep the publisher's bundle: pull, update and auto-resolve stop rebuilding (direction A for #3634)

Extension push: inputs that open up (workspace root lock, ancestor config refused by name, JSR dist-tags) and the skill docs rewritten once

Extension push ships the canonical form: every npm:/jsr: import pinned exact, and a v2 dependency-audit.json

stagecraft studio ticket columns: round-5 review lows from #3828 (source watch cost, relationText lookup, cross-instance claim)

A long-lived serve client for extensions, and a stable rate_limited error code

swamp serve on a v3 datastore never settles a workflow run left running by a stopped instance: boot reaper skips it as belonging to a remote instance

swamp serve on a v3 datastore: a run interrupted at a clean shutdown is never committed when the bucket is slow, and stays running for every other checkout

Support creating 1Password vaults for new clients

Filesystem datastore: an unclean shutdown leaves zero-byte data versions as the latest version, and `doctor datastores --repair` does not detect them

datastore_v3_replica_verify_test stall case flakes under the full integration run: restore.pid is read before the stub writes it

Generated state schemas require every child of nested objects, so normal resources warn on create/get

Add LinkedIn as a login provider

Showcase reward backfill can double-pay 5,000,000 points when replicas start together

Showcase editor: caption counter is not announced to screen readers

Profile showcase read: approved list sorts on review.reviewedAt in memory

Showcase countByStatus: $match live statuses before the $group

Showcase admin queues: index-serve the updatedAt sort on approved/rejected

Annotate and retain past workflow runs and data after the fact

Docs: --trusted-hosts accepts host:port for public addresses on non-default ports

A workflow step's method output is invisible to `data query` and `data list`, and the method summary's retrieval command returns an older run's data

Skill propulsion rule is silent when no transition is satisfied because stage work is outstanding

package.json mode: no loose-specifier warning for a range push ships as the exact installed version

extension fmt (and any command) creates or rewrites deno.lock when the extension lives in the repo's loaded extensions/ dir

serve shutdown does not wait for worker status writes, and its listener accepts workers after the gateway is disposed

stagecraft: rename work mode `method` to `behavior`, matching swamp's rename of models to behaviors

auth token create --json fields key and signinToken are undocumented; no token-mode service setup page

trigger.schedule is evaluated in the serve host's local time zone, with no zone field and no doc saying so

workflow validate/run say "Workflow not found" for a file that doctor workflows explains is misnamed

telemetry stats says "No telemetry data found" right after successful sends; say the spool is empty because it flushed

Docs: publish typed-secrets Phase 4.6 expression and delivery semantics

Extension registry page: a supported way to include media (images) in the README

CEL: data.latest(...).version is a double, but data.version() only accepts int, so "version - 1" fails at run time

workflow resume --run refuses workflows with the same step name in two jobs, though validate and run accept them

Update public OpenTelemetry manual for remote waterfalls and execution metrics (#3786)

Server-driven warning and info messages to CLI users, targeted by swamp version (exploration)

Serve: delegate namespace-scoped extension pulls and reload without granting administrator access

workflow cancel --server ignores --ca-cert and SWAMP_CA_CERT

Preserve active worker execution across serve restarts and upgrades; reconnect and reattach dispatches

v3: chunk durability barrier costs a full drive-cache flush per command on macOS; use an ordering barrier

Relationships

#3945 cve/tailworm extension README says the findings were not seen in the wild, which no source states

Closed