#657 `extension quality` false-positive bare-import detection on string literal "flexible"

Summary

swamp extension quality manifest.yaml fails on @webframp/cloudflare-audit with:

Extension uses bare import specifiers that cannot be resolved by the server-side scorer: "flexible".
Use explicit npm: or jsr: prefixes in your source files (e.g., "npm:package@version").

No actual import of "flexible" exists anywhere in the extension. The string appears only as a Cloudflare SSL mode value in conditionals and messages within the report file:

} else if (ssl === "flexible") {
  findings.push({
    check: "Zone",
    severity: "warn",
    message: 'SSL mode is "flexible" — traffic between Cloudflare and origin is unencrypted',
  });

Reproduction

cd cloudflare-audit   # in the swamp-extensions monorepo
swamp extension quality manifest.yaml

Environment

• swamp version: 20260615.105123.0-sha.6ace6971
• Extension: @webframp/cloudflare-audit@2026.05.24.1
• All imports in the extension use npm:, jsr:, relative paths, or import-mapped @systeminit/swamp-testing

Notes

The @webframp/cloudflare extension (which cloudflare-audit depends on) passes quality at 14/14 on its own. The false positive only triggers when scoring cloudflare-audit, which bundles the dependency.

This was found in the swamp-extensions monorepo (each extension is its own swamp repo). If this is an expected limitation of the scorer's heuristic in this environment, feel free to close as invalid.