Skip to main content
← Back to list
01Issue
BugShippedSwamp CLI
Assigneesstack72

Relationships

#531 vault.get() expressions in extension model globalArguments are not resolved at runtime

Opened by stack72 · 6/2/2026· Shipped 6/3/2026

Problem

When a ${{ vault.get('vault-name', 'key') }} expression is used in an extension model's globalArguments (e.g. @swamp/ssh identityContent), the expression is NOT resolved at runtime. The literal expression string passes through to the extension model code instead of the resolved vault secret.

The same vault expression syntax works correctly in the built-in command/shell model — both in method inputs and globalArguments (including nested objects).

Reproduction

  1. Create a swamp repo, pull @swamp/ssh, create a local_encryption vault with an SSH private key
  2. Configure an SSH model with identityContent: ${{ vault.get('test-vault', 'ssh-private-key') }}
  3. Run exec — the temp key file receives the literal expression string, not the PEM key
  4. OpenSSH reports 'Load key: invalid format'

Expected behavior

The vault expression should be resolved to the actual secret value before the extension model receives the globalArguments, just as it works for built-in models.

Environment

02Bog Flow
OPENTRIAGEDIN PROGRESSSHIPPED+ 1 MOREASSIGNED+ 3 MOREREVIEW+ 3 MOREPR_MERGED+ 1 MORENOTIFICATION_SKIPPED

Shipped

6/3/2026, 12:37:58 AM

Click a lifecycle step above to view its details.

03Sludge Pulse
stack72 assigned stack726/2/2026, 8:35:42 PM
stack72 linked blocked by #5116/2/2026, 6:04:56 PM
stack72 removed blocked by #5116/3/2026, 1:24:42 AM

Sign in to post a ripple.