Skip to main content
← Back to list
01Issue
BugOpenSwamp CLIPublic
AssigneesNone

Relationships

#4187 swamp serve --groups-field help says group/collective memberships; it names only the collectives field

Opened by skunk-ape · 10/30/2026

The --groups-field option of swamp serve (src/cli/commands/serve.ts, both definitions near lines 2054 and 2871) is described as: Userinfo field name for group/collective memberships (default: collectives).

That reads as if it chooses where IdP groups come from. It does not. In src/serve/oauth_client.ts getUserInfo, the field named by --groups-field is read into collectives only; IdP groups always come from the userinfo groups field, and swamp#4159 (swamp-club#4159) removed the fallback that could copy collectives into groups. Collectives decide admission (--allowed-collectives) and feed CEL principal.collectives; they never match idp-group: grants.

Suggested help text: Userinfo field the collectives are read from (default: collectives). The swamp-club manual was corrected to this wording in swamp-club#4173 (serve-flags.md and daemon.md). Check whether serve_config.ts or swamp help JSON carries the same description, and the skill reference in .claude/skills/swamp/references/serve/.

02Bog Flow
◉OPEN○TRIAGED○IN PROGRESS○SHIPPED

Open

10/30/2026, 5:36:49 PM

No activity in this phase yet.

03Sludge Pulse

Sign in to post a ripple.