What's Changed

• ci: gate skill-review and skill-trigger-eval on .claude/ path changes (#805)

Summary

• Add a changes job using dorny/paths-filter to detect whether skill-related
  files changed (.claude/skills/**, CLAUDE.md, or the review/eval scripts).
• Gate skill-review and skill-trigger-eval jobs behind
  needs.changes.outputs.skills == 'true' so they only run when relevant files
  are touched — avoids burning tessl and claude -p API credits on unrelated PRs.
• Add !failure() && !cancelled() conditions to claude-review,
  claude-adversarial-review, and auto-merge so they still run when the skill
  jobs are skipped (no skill changes) but still block when they actually fail.

Test plan

• PR touching only src/ files — skill-review and skill-trigger-eval skip
• PR touching .claude/skills/ — both skill jobs run
• PR where skill-review fails — claude-review and auto-merge block
• PR where skill-review skips — claude-review and auto-merge proceed

🤖 Generated with Claude Code

Installation

macOS (Apple Silicon):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.234138.0-sha.dd72c27c/swamp-darwin-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

macOS (Intel):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.234138.0-sha.dd72c27c/swamp-darwin-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (x86_64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.234138.0-sha.dd72c27c/swamp-linux-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (aarch64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.234138.0-sha.dd72c27c/swamp-linux-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

What's Changed

• feat: add skill trigger eval framework with test suites for all swamp skills (#803)

Summary

• Add scripts/eval_skill_triggers.ts — a Deno-native eval framework that
  spawns claude -p subprocesses to test whether user prompts trigger the
  correct skill. Parses stream-json output to detect Skill/Read tool calls
  and measures trigger rates across multiple runs for statistical confidence.
• Add evals/trigger_evals.json for all 12 swamp-* skills (185 total queries)
  covering direct triggers, semantic triggers, and cross-skill confusion cases.
  Each negative case tests a specific confusion pair (e.g., swamp-vault vs
  swamp-extension-vault, swamp-model vs swamp-extension-model).
• Improve swamp-troubleshooting skill description to win over domain-specific
  skills when users describe errors/failures (50% → 88% pass rate).
• Add deno run eval-skill-triggers task with scoped env permissions and
  skill-trigger-eval CI job. Results render to GITHUB_STEP_SUMMARY as a
  markdown table matching the existing skill-review output format.
• Eval files are excluded from user repos — copySkillsTo() uses an explicit
  allowlist (BUNDLED_SKILLS) that does not include evals/ paths.

Test plan

• EVAL_RUNS=1 deno run eval-skill-triggers — all 12 skills pass (≥80%)
• --skill <name> flag filters to a single skill
• --debug flag dumps raw stream events for diagnosis
• Negative cases pass across all skills (no false triggers)
• Eval JSON files validated: 185 queries, all have query + should_trigger
• copySkillsTo() does not copy evals/ dirs (BUNDLED_SKILLS allowlist)
• CI job renders results table in GitHub Actions step summary

🤖 Generated with Claude Code

Installation

macOS (Apple Silicon):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.233002.0-sha.014259ac/swamp-darwin-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

macOS (Intel):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.233002.0-sha.014259ac/swamp-darwin-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (x86_64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.233002.0-sha.014259ac/swamp-linux-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (aarch64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.233002.0-sha.014259ac/swamp-linux-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

What's Changed

• fix: eliminate shell injection in command/shell vault secrets via env var injection (#802)

Summary

Fixes #430 — vault secrets with shell metacharacters (;, |, &, !, $(), etc.) were interpreted as shell syntax when used in command/shell model run fields, enabling arbitrary command execution.

Root cause: Shell-specific escaping lived in resolveVaultExpressions (serves ALL models) — the wrong layer for a shell-only problem. It was also incomplete (missed ;, |, &, !) and corrupted non-shell values ($100 → \$100).

Fix: Move shell safety to the shell model using environment variable injection:

• Vault secrets become sentinel tokens during CEL evaluation (safe alphanumeric strings)
• VaultSecretBag value object maps sentinels → raw values
• Shell model replaces sentinels with "${__SWAMP_VAULT_N}" env var refs, passes raw values via process environment
• All other models get exact raw values via resolveDeep() — no escaping artifacts

Shell variable expansion happens after command parsing, so secret content is never parsed as shell syntax. This eliminates the entire class of shell injection bugs — no character blocklist to maintain.

User impact

• No breaking changes — same YAML syntax, same output
• Shell commands: injection-proof for all metacharacters (current and future)
• Non-shell models: strictly better — no more \$ / \` corruption
• Existing definitions on disk: untouched (expressions stored, not values)

Files changed

Test plan

• All 3476 unit tests pass
• Type checking (deno check) clean
• Lint (deno lint) clean
• Manual verification: secrets with ;, |, $, & all treated as literal in shell commands
• Binary compiled and tested end-to-end
• Integration tests in CI

🤖 Generated with Claude Code

Co-authored-by: Walter Heck walterheck@helixiora.com

Installation

macOS (Apple Silicon):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.232533.0-sha.358d70ee/swamp-darwin-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

macOS (Intel):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.232533.0-sha.358d70ee/swamp-darwin-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (x86_64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.232533.0-sha.358d70ee/swamp-linux-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (aarch64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.232533.0-sha.358d70ee/swamp-linux-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

What's Changed

• chore: remove alpha disclaimer from README (#799)

Installation

macOS (Apple Silicon):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.205322.0-sha.009deadb/swamp-darwin-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

macOS (Intel):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.205322.0-sha.009deadb/swamp-darwin-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (x86_64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.205322.0-sha.009deadb/swamp-linux-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (aarch64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.205322.0-sha.009deadb/swamp-linux-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

What's Changed

• The Machine: Hooks proving to be painful (#797)

"the linter is firing between code blocks, so it winds up arguing with itself (for example, type only imports being written when its between edits, so then it just bounces back and forth)"

Installation

macOS (Apple Silicon):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.202156.0-sha.9f61241f/swamp-darwin-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

macOS (Intel):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.202156.0-sha.9f61241f/swamp-darwin-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (x86_64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.202156.0-sha.9f61241f/swamp-linux-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (aarch64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.202156.0-sha.9f61241f/swamp-linux-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

What's Changed

• chore: Upgrade CloudControl SDK to 3.1014.0 (#798)

Installation

macOS (Apple Silicon):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.201208.0-sha.b8d0c34e/swamp-darwin-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

macOS (Intel):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.201208.0-sha.b8d0c34e/swamp-darwin-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (x86_64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.201208.0-sha.b8d0c34e/swamp-linux-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (aarch64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.201208.0-sha.b8d0c34e/swamp-linux-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

What's Changed

• docs: guide agents to extend models instead of CLI fallback (#796)

Summary

• Strengthened Rule 2 in generated CLAUDE.md (generateInstructionsBody()) to explicitly call out CLI tools (gh, aws, curl) as an anti-pattern alongside shell scripts, and point agents to export const extension and swamp model type describe to check available methods
• Added "model exists but method missing" decision flow to swamp-extension-model skill, routing agents to extend existing models via export const extension instead of falling back to CLI tools
• Added "Existing model missing a method" row to the swamp-model skill's "Choosing the Right Approach" table
• Added "Extend model with new method" row to the swamp-report skill's "When to Use Other Skills" table
• Improved swamp-extension-driver skill verification section (tessl review: 94% → 100%)
• Tightened swamp-extension-model skill verbosity to stay under 500 lines (tessl review: 93% → 100%)

Closes #667

Test plan

• deno check passes
• deno lint passes
• deno run test — all 3475 tests pass
• deno run compile succeeds
• npx tessl skill review .claude/skills/swamp-extension-model — 100%
• npx tessl skill review .claude/skills/swamp-extension-driver — 100%

🤖 Generated with Claude Code

Installation

macOS (Apple Silicon):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.192844.0-sha.1bb5fa8f/swamp-darwin-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

macOS (Intel):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.192844.0-sha.1bb5fa8f/swamp-darwin-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (x86_64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.192844.0-sha.1bb5fa8f/swamp-linux-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (aarch64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.192844.0-sha.1bb5fa8f/swamp-linux-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

What's Changed

• docs: add report guidance to skills and generated CLAUDE.md (#795)

Summary

Closes #662

Agents default to inline shell scripts (python3 -c, deno eval, complex jq pipelines) when they need to transform model output, instead of using the proper extension points. With reports now available, this PR updates skill documentation so agents automatically choose the right approach based on task intent:

• Reusable pipeline (reports, analysis, summaries) → report extension
• Ad-hoc debugging / one-off inspection → inline is fine

Changes

• src/domain/repo/repo_service.ts — Added rule 8 ("Reports for reusable data pipelines") to the generated CLAUDE.md rules, and added swamp-report to the generated skills list (after swamp-data)
• .claude/skills/swamp-model/SKILL.md — Added a "Choosing the Right Approach" decision table before "When to Use Other Skills" that maps task type → approach (extension model, report extension, or inline), and added swamp-report to the skills cross-reference table
• .claude/skills/swamp-extension-model/SKILL.md — Added guidance in the decision flow that if the task is transforming/analyzing existing model output, a report extension is the right choice (not an extension model), and added swamp-report to the skills cross-reference table
• .claude/skills/swamp-report/SKILL.md — Added a "When to Create a Report" positioning section after the intro that defines when reports are the right choice (repeatable analysis, versioned output, multi-model analysis, user asks for report/summary/audit)

Design choices

The key decision was keeping the guidance lightweight and distributed across skills rather than creating a centralized decision document. Each skill now contains just enough context to redirect agents to the right tool — the swamp-model skill has the top-level decision table, swamp-extension-model has a guard clause before its creation flow, and swamp-report has positioning criteria. This means agents get the right guidance regardless of which skill they load first.

We chose not to add any code changes or new CLI behavior — this is purely a documentation/guidance fix that steers agent behavior through better skill content.

Test plan

• deno check passes
• deno lint passes
• deno run test — all 3475 tests pass
• Verify generated CLAUDE.md includes rule 8 and swamp-report skill by running swamp init in a test repo

🤖 Generated with Claude Code

Installation

macOS (Apple Silicon):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.190516.0-sha.5f63dd16/swamp-darwin-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

macOS (Intel):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.190516.0-sha.5f63dd16/swamp-darwin-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (x86_64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.190516.0-sha.5f63dd16/swamp-linux-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (aarch64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.190516.0-sha.5f63dd16/swamp-linux-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

What's Changed

• The Machine: Remove the stop verify script file (#794)

Installation

macOS (Apple Silicon):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.184735.0-sha.e821ef40/swamp-darwin-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

macOS (Intel):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.184735.0-sha.e821ef40/swamp-darwin-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (x86_64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.184735.0-sha.e821ef40/swamp-linux-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (aarch64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.184735.0-sha.e821ef40/swamp-linux-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

What's Changed

• The Machine: Moving the stop hook back to CLAUDE.md (#793)

Installation

macOS (Apple Silicon):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.183930.0-sha.b966a910/swamp-darwin-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

macOS (Intel):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.183930.0-sha.b966a910/swamp-darwin-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (x86_64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.183930.0-sha.b966a910/swamp-linux-x86_64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/

Linux (aarch64):

curl -L https://github.com/systeminit/swamp/releases/download/v20260320.183930.0-sha.b966a910/swamp-linux-aarch64 -o swamp
chmod +x swamp && sudo mv swamp /usr/local/bin/