swamp access grant create installs an extension from the registry that the repository never asked for. It is a network fetch plus 30 files written into .swamp/pulled-extensions/, with no prompt and no mention in the command's purpose. I hit it while probing grant conditions, noticed an unexplained @swamp/gcp/migrationcenter in my working tree, and traced it back.

Reproduce

$ swamp extension list
@swamp/software-factory  v2026.06.24.1

$ swamp access grant create --subject user:probe9 --allow run --on model:zzz-nonexistent
  Installed   @swamp/gcp/migrationcenter@2026.08.12.2 (13 models registered)
  Completed   create on grant-f2c1ff23 succeeded in 9ms

$ swamp extension list
@swamp/gcp/migrationcenter  v2026.08.12.2  (pulled 2026-08-16T22:09:29.868Z)
@swamp/software-factory     v2026.06.24.1

It repeats: swamp extension rm @swamp/gcp/migrationcenter --yes, then any swamp access grant create, and the extension is back.

What I ruled out

Not other commands. With the extension removed, swamp model list, swamp model type search gcp, swamp model method run <m> validate, swamp access grant list, and swamp access token list all leave it absent. swamp model create @swamp/software-factory <name> also leaves it absent, so this is not ordinary model creation.
Not repo config. .swamp.yaml holds only swampVersion, initializedAt, repoId, tools, gitignoreManaged. swamp extension source list reports none.
Not a local reference. Nothing in the repository names @swamp/gcp/migrationcenter except upstream_extensions.json, which is the record of the install itself.
Not another operator. The repo's command audit log shows one session for the day and no swamp extension pull|install|search at any point.

Expected

swamp access grant create writes a grant. It does not reach the registry, and it does not install extensions. If some code path genuinely needs an extension installed, it should say which one and why, and ask first.

Why it matters

The install path runs unprompted from a command with no stated relationship to extensions, which is a supply-chain surface: a local, unrelated operation fetches and registers third-party model code. It also breaks sandboxed and air-gapped use, where an unexpected egress attempt is a failure rather than a convenience. And it dirties the working tree — upstream_extensions.json is tracked, so the install shows up as an unexplained diff.

Once installed, the extension fails to load, and every later swamp access command prints:

Error   @swamp/gcp/migrationcenter already installed at
        .../pulled-extensions/@swamp/gcp/migrationcenter but failed to load
        Local edits may be preventing it from registering

There are no local edits — the tree came straight from the install. Meanwhile .swamp/_extension_catalog.db records all 13 of its bundle_types with state = Indexed and an empty last_error, so the catalog and the loader disagree about the same extension.

Environment

swamp 20260815.023608.0-sha.a648c130, macOS 25.6.0 (darwin arm64).

02Bog Flow

Shipped

8/17/2026, 12:04:33 AM

Click a lifecycle step above to view its details.

03Sludge Pulse

stack72 assigned stack728/16/2026, 10:28:04 PM

stack72 commented 8/17/2026, 12:04:43 AM

Thanks @skunk-ape for reporting this! The fix has been merged and a release is on its way. We appreciate your contribution to swamp.

stack72 commented 8/17/2026, 12:13:05 AM

Great catch @skunk-ape — this was a supply-chain issue hiding in plain sight. Every swamp access grant create was silently fetching and installing an unrelated extension from the registry, with no prompt and no connection to what the command actually does. The root cause was a key mismatch in how we look up built-in model types: the lookup missed the built-in, fell through to a registry search, and installed the first thing that came back. The fix ensures built-in types are always resolved locally — no network call, no surprise installs. Shipped in #2164. Reports like this are really important to us. Keeping the supply chain solid is something we take seriously, and we can only do that when people take the time to dig in and document what they're seeing the way you did here. Thanks for flagging it.

skunk-ape commented 8/17/2026, 2:51:13 PM

Follow-up: the registry install this issue reported is gone, but the underlying path is still there. swamp access grant create continues to create a @swamp/grant model instance (the Completed create on grant-f2c1ff23 succeeded line in the repro above) rather than registering an authorization grant, so the grant never reaches grant list, access check, or the policy snapshot. Filed as #1682 — the sharp end is that a --deny grant created this way reports success and does not apply, which fails open.

serve: triggerSource not persisted to workflow run summary

dataOutputOverrides not applied during remote execution — ephemeral resources GC'd before override takes effect

extension rm also deletes the lockfile entry, and install on an empty lockfile is a silent success — rm/install is not a round trip

vault: audit trail should record put, delete, and annotate operations

ExtensionWorkflowRepository scans manifest.yaml as a workflow, emitting 'Unknown key manifestVersion' warning

--max-run-duration only applies to detached runs, not attached runs

Cancel endpoint reports status: cancelled for runs it did not actually cancel

@swamp/git: no way to amend a commit, but push can --force

Installation with new account creation times out

pre-flight checks run on orchestrator, not on worker — breaks remote execution with filesystem-dependent checks

Docs: update cancel endpoint response statuses in REST API reference and workflows page

docs: document --remote-only flag for swamp serve

Swamp serve daemon doesn't run with --hot-reload

serve: include workflowName in HealthSnapshotSchedule

Retyping a model instance strands catalog rows no command can reclaim — prune matches on model_id, delete resolves the current type (follow-up to #1009)

knowledge-base retrieve persists query output into the state resource, with lifetime infinite and the query text in the instance name

Method-name collision between a base model type and an extending extension silently drops the whole extension file — no error, doctor reports pass

Skip 50MB monolithic index rewrite on v2 shard-first path

Share single AwsS3Client instance across lock, sync, and verifier

Double shard assembly per command lifecycle (pull + push both read all shards)

pullChanged never records commitSeq for shard-first (v2) index

localHasAllRemoteEntries() permanently blocks sidecar update on partial caches

serve: workflow.history.get cannot find CLI-created runs or look up by run ID

"TRIAL ENDED" modal shown to team plan user when toggling extension visibility

Concurrent suspended workflow runs can't be disambiguated from 'approvals'; fresh runs should supersede matching-input suspended runs

I _think_ I might like a guard in the trigger yaml

swamp cmds don't realise the user is sshed into the system

serve dashboard: add cluster.instances and serve.config endpoints

CEL expressions have timestamp/duration but no current-time value, so no guard can express "older than N"

Support direct type execution (@type) with --server

access token mint writes to user vault, not serve's _token-secrets control plane in HA mode

Generic OTLP endpoint appends signal path after query or fragment

Issue lifecycle start drops top-level issue comments

serve dashboard: add instanceId, triggerSource, and step progress to WorkflowRunSummary

Document worker affinity (affinity: true) for workflows and jobs

Datastore MongoDB driver leaks connections — 5960 accumulated over 8 days

workflow approvals displays the latest run's prompt for every suspended run

@swamp/git: add a read-only working-tree diff for pre-commit review

docs: document --oauth-client-name flag for swamp serve

Docs: update workflow reference to include trigger in JSON output shapes

@swamp/git branch and push methods fail data naming when branch contains '/'

Docs: update workflow-placement.md for job/workflow-level placement inheritance

feat(serve): use identifiable OAuth client_name instead of random UUID

@swamp/git does not pass AbortSignal to Git subprocesses

Global Secret Manager methods build an invalid regional parent

Document model.method() support in assert expressions

No way to store code-review results — verdicts, findings, and cost are not persisted for any repo

Redaction regex boundary bug: label_base64 secrets with an unrecognized label pass through unredacted (e.g. swamp_ API keys)

User token page (/u/<user>) shows only "swamp_..." for every API key, making leaked-key identification impossible

upstream_state treats sparse-fetch branches as having no upstream

Add native support for the Pi coding harness

Cloud Build create supplies project instead of required projectId path parameter

workflows: support labels/target/platform at job and workflow level

swamp access grant create never registers the grant — a --deny created this way silently fails open

Support credentials in datastore config (vault-resolvable)

swamp serve OOMs on repos with 2000+ model definitions

Serve telemetry attribution for collectives

Extension workflows: no way to override trigger configuration

Add a list/discover method to the generated @swamp/aws types — no way to enumerate resources in a region

Document @vault= prefix for webhook secrets in serve.yaml

swamp access grant create installs an unrelated extension from the registry

docs: document SWAMP_API_KEY headless OAuth bootstrap for swamp serve

workflow-succeeded selects the globally-latest run, so siblings block each other under parallel use

swamp serve: webhook secrets should support @vault= resolution

Misleading collective_not_trusted auto-resolve error when a local source extension transiently fails to index during workflow validate

datastore setup: symlinks not counted in bytesCopied, causing misleading '(0B)' output

vault.get() CEL error embeds raw newline when wrapped by model resolver, producing broken output

Feature: user-configurable redaction rules (.swamp/redaction.yaml)

Fatal JavaScript out of memory: Ineffective mark-compacts near heap limit

Sync every signup to Attio, and backfill the existing population (#809 follow-up)

@swamp/issue-lifecycle probes /api/health, which swamp-club stopped serving when the Fresh scaffold stubs were removed

Lab lifecycle POST rejects any payload string that starts with a dollar sign, not just operator keys

Feed: detect and gracefully handle dead (404) post links (link rot)

/feed: per-post unread indicators and mark-as-read to track reading progress

/feed: filter and search by author, title/text, and topic

Add a :micdrop: emoji / reaction shortcode (swamp-native art included)

Push down the two cheap leaderboard scans: ghost-gate dictionary and eventCounts owner filter

$identify events are never consumed — anonymous web history never binds to the account

Finish the swamp_* attribute set on Attio users, and settle the two unprefixed ones (#809 follow-up)

aria-expanded is a raw boolean in 12 places — collapsed state is unannounced to screen readers