#4383 @swamp/cve http2shell, php-rce-2026-10 and tailworm: scan fails with 'Duplicate data instance name' (log and status share a name)

scan fails on every target in three @swamp/cve extensions, because each writes its log file and its status resource under the same data name. Since #3700, swamp refuses the second write in one run:

Duplicate data instance name 'localhost' (already written as file 'log' in this run)
code: method_execution_failed

Affected (latest versions, swamp 20261103.172234.0-sha.b94358f0, Ubuntu 24.04 runner):

• @swamp/cve/http2shell 2026.11.02.2: models/http2shell.ts:361 creates the log as createFileWriter("log", instanceName(t.label)), then :381 writes status under the same instanceName(t.label). scanFleet does the same per host (:436, :475), and so does mitigate (:557).
• @swamp/cve/php-rce-2026-10 2026.10.24.2: models/php_rce_2026_10.ts:3229 and :3244; per host in scanFleet at :3285 and :3323; and :3412.
• @swamp/cve/tailworm 2026.10.25.6: models/tailworm.ts:3647 and :3670; per host in scanFleet at :3720 and :3762; and :3510.

This happens in every mode, local and SSH, because the log and the status share the target's label. @swamp/cve/dirtyfrag and @swamp/cve/emudhra name their log <label>-log and work.

Repro

swamp extension pull @swamp/cve/tailworm
swamp model method run @swamp/cve/tailworm scan tailworm-local

It fails with the error above, and no status record is written. The same happens with http2shell and php-rce-2026-10 (scan), and with targetHost set.

Suggested fix

Name the log as dirtyfrag and emudhra do, for example createFileWriter("log", \${instanceName(label)}-log`), in scan, scanFleet (per host) and mitigate. Anything that reads the old log name needs the same change. A test that runs scan` against a fake target through a context that refuses duplicate names would catch it.

Related: #3700 (refuses a name written as two kinds in one run) and #4302 (the same check across runs).

Upstream repository: https://github.com/swamp-club/swamp-extensions

Environment

• Extension: @swamp/cve/http2shell@2026.11.02.2
• swamp: 20261103.172234.0-sha.b94358f0
• OS: windows (x86_64)
• Deno: 2.9.8
• Shell: C:\Program Files\Git\usr\bin\bash.exe