#146

feat: add support for Nix via a flake

s12d ago

← Back to list

01Issue

FeatureShippedSwamp CLI

Assigneesstack72

Relationships

#883 Extension skill should explicitly prohibit bare 'zod' imports (scorer sandbox fails)

Opened by webframp · 6/29/2026· Shipped 6/30/2026

Problem

The extension development skill/docs explain that swamp's bundler excludes zod (it's provided at runtime), but they do NOT warn that bare from "zod" imports will fail the swamp.club scorer. The scorer runs deno doc --lint in a sandbox without the extension's deno.json import map, so bare specifiers can't resolve.

This creates a trap: bare "zod" works locally (via import map), works at runtime (bundler provides it), but fails scoring. The fix is always the same — change to from "npm:zod@X.Y.Z" — but nothing in the skill prevents the mistake.

Evidence of Repeated Failures

Six extensions in webframp/swamp-extensions hit this exact issue over a 2-month span:

Extension	Date	PR	Fix
redmine	2026-04-22	#43	`from "zod"` → `from "npm:zod@4.3.6"`
vault/macos-keychain	2026-04-22	#44	same
terraform	2026-04-22	#46	same
reddit	2026-05-20–24	#67, #70	same (compliance standards PR tried to fix all)
cloudflare	2026-06-27	#168	removed unused import map entry
twitch	2026-06-29	#176	`from "zod"` → `from "npm:zod@4.4.3"`

PR #67 ("enforce extension compliance standards") attempted to fix this across all extensions in May, but new extensions (cloudflare, twitch) reintroduced the problem because the underlying guidance doesn't prevent it.

Root Cause

Three execution contexts resolve imports differently:

Local Deno — uses deno.json import map → bare "zod" works
Swamp bundler — excludes zod, provides at runtime → bare "zod" works
Scorer sandbox — runs deno doc --lint without import map → bare "zod" FAILS

The skill only explains context #2. Agents and humans reasonably infer "zod is special, use bare import" without knowing about context #3.

Proposed Solution

Add an explicit rule to the extension development skill/docs:

Always use explicit npm:zod@<version> in import statements — never bare "zod". The swamp-club scorer runs deno doc --lint without your deno.json import map. Bare specifiers resolve locally but fail in the scorer's sandbox. Do not add zod to the deno.json imports map either — use the inline npm: specifier directly.

This should appear in the imports/dependencies section of the extension authoring guide, ideally with the scorer explanation so the why is clear and agents don't try to "optimize" it away.

02Bog Flow

Shipped

6/30/2026, 9:22:45 AM

Click a lifecycle step above to view its details.

03Sludge Pulse

stack72 assigned stack726/30/2026, 8:39:14 AM

stack72 commented 6/30/2026, 9:23:05 AM

Thanks @webframp for reporting this! The fix has been merged and a release is on its way. We appreciate your contribution to swamp.

Scorecard: beta/rc-only extensions show "not scored" despite successful scoring (GET /score resolves only latestVersion)

`swamp extension search --channel beta|rc|stable` ignores the filter — all channels + the no-flag default return an identical result set

Beta-channel extensions are never scored — perpetual 'Scoring is taking longer than expected'

feat: allow models to call other models mid-execution via context.runModel()

swamp-club: enable OAuth provider for swamp serve collective-based admission

extension update/install reports new version while on-disk pulled files stay old

command/shell: step with timeout + a surviving child process reports exit -1 despite command exiting 0

swamp serve startup/shutdown is very slow on large repo and lacks diagnostics

Vault push log overstates what left the machine: Pushed N vault file(s) to datastore counts every dirty file, not just vault files

serve-auth: mode: oauth — device grant client + collective-based admission

serve-auth: enable OIDC Provider + Device Authorization plugins in swamp-club

Orphaned data (migrated-away/deleted model) can't be GC'd or deleted

Docs: document swamp data prune (orphaned-data reclamation)

UAT: CLI coverage for swamp data prune (orphaned-data reclamation)

Session credential revocation scans entire credential map on every dispatch completion

Docs: update worker-commands.md for --all flag and JSON output change

datastore migrate-index aborts on hardcoded 30s S3 requestTimeout for large shards

swamp worker list: hide disconnected workers by default, add --all flag

swamp serve should survive bad extension failures

Worker fleets phase 7: how-to guides and explanation docs

swamp serve: catch unhandled promise rejections from extensions

[@adam/cfgmgmt] SSH helper can crash swamp serve via unhandled finally() rejection

Docs: add --server-token flag to worker connect reference

Add --server-token to worker connect for authenticated orchestrators

Docs: document --trusted-hosts flag for swamp serve

Document SWAMP_SERVE_EXTRA_HEADERS for reverse proxy/tunnel setups

Add --trusted-hosts flag to swamp serve for Docker/Kubernetes worker connections

Allow swamp clients to send custom headers when connecting to swamp serve

Docs: update serve-flags.md default queue timeout from 60s to 10m

Worker fleets phase 6: raise default queue timeout to 10 minutes

Worker fleets phase 4b: capacity slots and concurrent dispatch

MethodContext docs/comments mention context.putSecret but runtime exposes vaultService.put

Docs: add --concurrency flag and SLOTS column to worker-commands reference

install.sh still points users to systeminit/swamp

Support user systemd units for 'swamp serve daemon enable'

swamp serve scheduled execution runs steps in an isolated data scope: readResource sees empty state, writeResource never reaches the model-scope chain — stateful scheduled workflows duplicate instead of deduplicating

Support installing swamp via mise GitHub backend

Worker fleets phase 4a: dispatch runner extraction — child process per dispatch

Docs: add swamp worker daemon enable/disable/status to worker-commands reference

Worker fleets phase 3 PR2: swamp worker daemon enable

Docs: add drain, lifecycle policies, and exit-code contract to references

Worker fleets phase 3 PR1: drain state machine, lifecycle policies, signal handling

Leaderboard search excludes ghosts — a visible ghost can't be found by its alias

issue-lifecycle: plan lifecycle entry silently dropped when summary exceeds 1000 chars

Docs: add worker verify, --verify-on-enroll, and env-var config to references

Labs - Filters do not apply to Blocked status and Billing Tier category

Worker fleets phase 2 PR2: env-var config, swamp worker verify, --verify-on-enroll

Docs: add --type flag to issue edit reference and how-to

Docs: update manual with whole-field expression syntax for workflow task inputs/globalArgs

Allow changing an existing issue to security/confidential after submission

Allow dynamic object expressions for workflow task inputs/globalArgs

Docs: update enrollment token references for fleet tokens (--max-enrollments)

Worker fleets phase 2 PR1: fleet tokens (--max-enrollments, bindings, worker naming)

$identify events are never consumed — anonymous web history never binds to the account

Worker fleets phase 1 PR3: boot reconciliation and integration test

Login success still shows login tip

Support confidential visibility for non-security issues

Fine-grained scopes for swamp.club access tokens

Add associative info to user profiles: collective membership + collaborative contributions

Remove comments from /feed and redesign the page

feed_post_score_events queue grows unboundedly (no TTL, no delete-on-delivery)

Make paid subscribers visually stand out (badge, profile popup summary)

Relax the profanity filter

Giphy integration via /giphy command

@-mention autocomplete for users when writing lab ripples

Worker fleets phase 1 PR2: step_queued events, pending-dispatch model, queue introspection

Docs: add swamp worker queue to worker-commands reference

/lab shipped list is sorted by issue number, not ship date

Docs: update manual for ephemeral data and step-output dependency deferral

Docs: update remote execution references for elastic queueing

Support dynamic host discovery from external sources

Worker fleets phase 1: elastic queueing

catalog backfill should support scoped population for targeted lookups

Docs: document global skill sync behavior for custom tools in manual

swamp update syncs global skills to default agent directories instead of configured custom Pi skillsDir

coerceToSuffix does not sanitize path-unsafe characters, causing forEach items and vary dimensions with / to produce invalid data instance names

Badge for activity on other people's issues

swamp serve: add @keychain=<service>/<account> indirection for secret args on macOS

swamp serve: eliminate wrapper scripts via @vault= secret refs and native startup hooks

Automate mechanical frontmatter fixes in the fixing stage