@webframp/hashicorp-vault: empty KV engine causes 'data.data.keys is not iterable' on vault put

swamp data get --workflow, swamp data list --workflow, and swamp workflow history get/logs fail with Workflow not found: <name> for any workflow delivered by a pulled extension (e.g. @swamp/kubernetes/cluster-health). The same commands work for repo-local workflows. Execution is unaffected — workflow run/get/list resolve extension workflows fine — so a user can run an extension workflow successfully and then be unable to retrieve its data through any workflow-scoped CLI path. The retrieval commands that swamp itself prints in the post-run output are the ones that fail.

Steps to reproduce (clean room)

swamp init . in an empty directory
swamp extension pull @swamp/kubernetes
swamp workflow run @swamp/kubernetes/cluster-summary (any extension workflow; even a run with failed steps produces the @swamp/workflow-summary report artifact)
Retrieval fails by name AND by UUID:

$ swamp data list --workflow @swamp/kubernetes/cluster-summary
Error: Workflow not found: @swamp/kubernetes/cluster-summary

$ swamp data get --workflow @swamp/kubernetes/cluster-summary report-swamp-workflow-summary
Error: Workflow not found: @swamp/kubernetes/cluster-summary

$ swamp data list --workflow eaea8dd8-54f0-4d86-ab75-68bd3dd5ec1b
Error: Workflow not found: eaea8dd8-54f0-4d86-ab75-68bd3dd5ec1b

Control — a repo-local workflow retrieves fine with the identical commands (swamp workflow create test-wf ..., run it, then swamp data get --workflow test-wf <data> works).

Reproduced on a pristine repo; swamp doctor extensions reports a healthy catalog. Not environmental. Also verified the artifacts ARE persisted correctly on disk under .swamp/data/workflow/<workflow-uuid>/<data-name>/<version>/raw — only the resolution step fails.

Root cause

The deps factories on the data-retrieval paths construct a bare repo-local workflow repository instead of the composite one:

src/libswamp/data/get.ts (createDataGetDeps): const workflowRepo = new YamlWorkflowRepository(repoDir);
YamlWorkflowRepository scans only <repo>/workflows/workflow-*.yaml (yaml_workflow_repository.ts, baseDir default join(repoDir, "workflows")); extension workflows live under .swamp/pulled-extensions/<ext>/workflows/ and are invisible to it. findById also builds the local path directly, which is why UUID lookup fails too.
The working commands (workflow run/get/list) resolve through CompositeWorkflowRepository(yamlRepo, ExtensionWorkflowRepository) built in repository_factory.ts::createRepositoryContext — the data paths never get that composite.

Same bare new YamlWorkflowRepository(repoDir) construction on these read paths:

src/libswamp/data/get.ts → data get --workflow
src/libswamp/data/list.ts → data list --workflow
src/libswamp/workflows/history_get.ts → workflow history get
src/libswamp/workflows/history_logs.ts → workflow history logs
(src/libswamp/reports/search.ts and src/cli/completion_types.ts look similar but I did not repro those surfaces)

Suggested fix: have these deps factories accept/construct the same composite repository the factory already provides.

Note: workflows/delete.ts shares the construction, but local-only there is arguably correct (extension workflows are read-only by design) — though it fails with Workflow not found rather than a "read-only / managed by extension" message.

#337 ("Workflow-scope report artifacts unreachable via swamp data get --workflow", shipped) fixed the same command surface one layer deeper — report artifacts missing from step dataArtifacts after the workflow name resolved. This issue is upstream of that: for extension workflows, name resolution itself fails, so the #337 fix is unreachable.

Environment

swamp 20260605.223149.0-sha.ff10af58 (also repro'd on 20260523.014309.0)
macOS (darwin), filesystem datastore
Source inspected via swamp source fetch at the matching version

Workaround

swamp data query 'ownerRef == "<workflow-uuid>" && name == "<data-name>"' --select content reaches workflow-scope artifacts; step outputs are reachable via swamp data query 'workflowName == "@ns/wf" && name == "<data>"' --select content or model-scoped swamp data get <model> <name>.

02Bog Flow

Shipped

6/6/2026, 10:19:29 PM

Click a lifecycle step above to view its details.

03Sludge Pulse

stack72 assigned stack726/6/2026, 9:30:37 PM

stack72 commented 6/6/2026, 10:19:40 PM

Thanks @jdh313 for reporting this! The fix has been merged and a release is on its way. We appreciate your contribution to swamp.

@webframp/hashicorp-vault: empty KV engine causes 'data.data.keys is not iterable' on vault put

workflow resume fails to register all extension model types (local and pulled) — "Unknown model type"

model method run: cannot pass arrays, numbers, or booleans via --input

extension push --dry-run --json reports local helper imports as bogus model entries

Extension source: direct-content export scan only reads first 64 KiB, silently drops exports beyond it

Homepage install command: wrong domain and missing https:// protocol

Homepage install command: wrong domain and missing https:// protocol

first-class refresh hook for short-lived vault values (gcloud / aws-sso / kubectl-oidc token UX)

swamp issue ripple logged "Posted ripple on issue #514" but the ripple is not visible on the Lab

vault guide promotes inline secret values (KEY=VALUE) as a primary "swamp vault put" example

swamp-getting-started SKILL.md still references removed swamp-model / swamp-workflow / swamp-vault / swamp-extension / swamp-repo skills

extension rm blocked by stale /workspace bundle_types rows from prior container sessions with host repo bind-mounted

extension search returns null repository fields that extension info populates

Quality rubric: scope "No slow types" for model extensions (consumed via model+CEL, not type imports)

data get/list --workflow and workflow history get/logs cannot resolve extension-delivered workflows (Workflow not found)

Docs: add doctor secrets and doctor vaults to the troubleshooting how-to guide

UAT: sensitive resource output without vault produces clear pre-flight error

Docs: add doctor vaults subcommand and pre-flight vault validation

gcs-datastore: registerNamespace does not detect conflicts with existing registrations

Validate vault availability when model has sensitive output fields

Managed skills ship with dangling reference-doc links

swamp-club: update skill references and CLAUDE.md after superskill consolidation

swamp-uat: init_test.ts asserts old skill directory names after superskill consolidation

Codegen: auto-merge resources across GCP API versions instead of manual ADDITIONAL_VERSION_RESOURCE_FILTER

fix: giga-swamp UAT failures — 9 bugs found during comprehensive testing

fix: datastore setup extension with namespace config doesn't scope sync or register manifest

fix: namespace set on default repo writes incomplete filesystem config (missing path)

@swamp/1password put double-escapes JSON values

feat: giga-swamp comprehensive UAT coverage

@swamp/kubernetes 2026.06.04.1 missing upgrade path from 2026.05.27.2

@swamp/kubernetes ignores certificate-authority-data from kubeconfig for self-signed CAs

Inconsistent failures in swamp doctor extensions (database is locked, bundle build failed)

docs: giga-swamp user documentation — reference, how-to, and conceptual guide

@swamp/gcp/iam missing serviceAccounts model type

@swamp/ssh@2026.06.04.1 fails to load: bare zod import + missing 2026.06.04.1 upgrade entry

feat: giga-swamp phase 7 — Data migration commands

feat: S3/GCS extension namespace manifest support (registerNamespace/listNamespaces)

Relocate Docker image from systeminit org to swamp-club

Move JSR packages from @systeminit to @swamp-club scope

Should be able to see all the issues I created by a filter "submitted by me"

Ability to change the email address associated with my Swamp Club Account

feat: giga-swamp phase 5 — CLI output + namespace management commands

CI review jobs use two-dot diff that includes files the PR never touched

paths.base: manifest is not honored for workflows: — bundled workflows only resolve from repo root, blocking self-contained subdir layouts (sibling to #459)

Lab profanity filter rejects legitimate CLI flag tokens via substring match

Sign and notarize the swamp macOS binary

Add platform type to issue-lifecycle extension model Zod schema

fix: datastoreSetupExtension() ignores namespace config on initial migration push/pull

Remote execution: orchestrator/worker fan-out (replaces execution drivers)

swamp datastore sync --push creates global .datastore-index.json ignoring namespace config

feat: S3/GCS extension namespace-scoped sync support

Copy explicitGlobalArgs before mutation in resolveOrCreateDefinition

vault.get() expressions in extension model globalArguments are not resolved at runtime

swamp-issue skill should scrub secrets and org-specific data before submission

workflow validate: trim stale 'skipped' label from model_not_found warning

Add pi coding agent support

hashicorp-vault should read token from env

swamp-extension adversarial review skill needs mandatory mechanical verification checklist

feat: giga-swamp phase 6 — Namespace-scoped sync

swamp workflow validate emits misleading "Extension failed to load" warning when type resolves locally

Add issue search/list command to discover existing issues

Support vault-resolved private key content in transport auth (not just file paths)

Workflow engine resolves extension methods against base type, ignoring extension-registered methods

Per-model LockTimeoutError at 60s causes cascading failures under concurrent access

Persistent, queryable workflow runs (status / cancel from any shell)

swamp repo upgrade: ERR_SQLITE_ERROR 'attempt to write a readonly database' during extension catalog schema migration

workflow validate: fail on references to unknown model instances (typo'd modelIdOrName)

feat: giga-swamp phase 4 — CEL cross-namespace queries

Docs: document the extension push adversarial-review gate

vault://local_encryption token does not round-trip correctly for GCP OAuth2 access tokens

swamp issue: add ability to edit issue title and body after submission

@swamp/gcp/iam: add WIF pool, provider, service account, and binding support

Support vault-sourced identity keys

copy method reports success when scp exits non-zero (e.g. 255)

Docs: TLS behind inspecting proxies / private CAs (system trust store, DENO_CERT, SSL_CERT_FILE)

Extension quality/adversarial-review: add a 'published-surface hygiene' check for real infra identifiers

Feed-post scoring is a direct domain write, not a consumer of feed_post_approved telemetry

workflow validate silently PASSES steps whose model type is a pulled extension (step-inputs skipped = false pass)

extension quality fails to resolve bare specifiers — contradicts fmt no-import-prefix rule

Allow global arguments in direct type execution (workflow fan-out)