#236 Extension ecosystem: shared utility library, version sync tooling, and HTTP resilience patterns

Summary

Analysis of 33 published swamp extensions reveals systemic patterns that could be addressed at the platform or tooling level to improve extension quality across the ecosystem.

1. No shared utility library for extensions (HIGH)

Extensions in monorepos (and across the ecosystem) independently reinvent:

• Command execution wrappers (Deno.Command with timeout/piping) — 6+ copies across extensions
• HTTP clients with auth, pagination, error handling — 4 separate implementations
• Time parsing (parseRelativeTime for "1h", "30m", "2d" strings) — 5 identical copies
• String sanitization utilities

Recommendation: Publish a @swamp/extension-utils package (or document a recommended pattern) providing:

• runCommand(cmd, args, {timeout, env}) — subprocess execution with timeout
• fetchWithRetry(url, opts) — HTTP fetch with retry, timeout, rate-limit handling
• parseRelativeDuration(str) — duration string parser
• paginateApi(fetcher, opts) — generic async pagination iterator

2. Version drift between manifest.yaml and model exports (HIGH)

14 extensions examined had mismatched versions between manifest.yaml and the version string exported in their TypeScript model files. This suggests manifest versions are bumped independently of code changes.

Recommendation:

• Add a swamp extension validate check that compares manifest version to exported model versions
• Or eliminate the model-level version export in favor of the manifest as single source of truth
• Consider adding this to swamp extension quality scoring

3. tags vs labels inconsistency (MEDIUM)

4 extensions use tags: in manifest.yaml while 27 use labels:. One extension has neither. The schema accepts both but this creates confusion.

Recommendation:

• Emit a deprecation warning when tags: is used
• Or add a swamp extension fmt auto-fix that normalizes tags → labels
• swamp extension quality should flag this

4. No HTTP resilience in hand-rolled fetch wrappers (MEDIUM)

None of the examined fetch-based API clients implement retry, exponential backoff, timeout, or rate-limit (429) detection. A single transient error fails the entire operation.

Recommendation:

• Document recommended HTTP patterns in extension authoring guide
• Consider publishing a fetch wrapper as part of shared utilities
• swamp extension quality could flag raw fetch() calls without error handling patterns

5. Wheelshop integration for extension authoring (LOW)

@bixu/wheelshop is effective at finding community alternatives to hand-rolled code. It could be integrated into the extension quality pipeline:

• During swamp extension quality, scan for common reinvented patterns
• Suggest wheelshop searches for detected patterns
• Add a "dependency hygiene" score to the quality rubric

Environment

• CLI: 20260504.233645.0-sha.430c1535
• Extensions analyzed: 33 across aws, cloudflare, redmine, gitlab, github, network, system, terraform, sre, vault, datastore, driver categories