@webframp/hashicorp-vault: empty KV engine causes 'data.data.keys is not iterable' on vault put

.claude/skills/swamp/references/vault/guide.md (as written by swamp repo upgrade v20260605) shows inline KEY=VALUE examples for storing secrets as a primary option, with the warning relegated to a parenthetical label. Copy-pasted examples leak the literal values into shell history, sudoers logs, and process tables.

Affected section

Store Secrets (~line 118-122):

**Inline value (appears in shell history):**

swamp vault put dev-secrets API_KEY=sk-1234567890 --json
swamp vault put prod-secrets DB_PASSWORD=secret123 -f --json  # Skip confirmation

The safer piped/interactive variants follow afterwards but aren't presented as the default.

Suggested fix

Lead with --stdin / piped and interactive variants. Demote the inline form to an anti-pattern (or remove it entirely) with an explicit "do not use for real secrets" callout.

Detected by

hivemq/hivemq-pi-review-action@v1 (gpt-5.5) flagged this as severity HIGH on hivemq/swamp-extensions#103.

02Bog Flow

Open

6/6/2026, 12:43:39 PM

No activity in this phase yet.

03Sludge Pulse

bixu commented 6/6/2026, 1:12:43 PM

Additional location of the same class of bug in v20260605: .claude/skills/swamp/references/vault/references/troubleshooting.md line ~49-51 recommends echo $AWS_ACCESS_KEY_ID; echo $AWS_SECRET_ACCESS_KEY as a credential check. Patched downstream in hivemq/swamp-extensions#103 by switching to presence-only test -n "${VAR:-}" checks; please apply equivalent fix upstream so the next swamp repo upgrade doesn't re-introduce.

@webframp/hashicorp-vault: empty KV engine causes 'data.data.keys is not iterable' on vault put

workflow resume fails to register all extension model types (local and pulled) — "Unknown model type"

model method run: cannot pass arrays, numbers, or booleans via --input

extension push --dry-run --json reports local helper imports as bogus model entries

Extension source: direct-content export scan only reads first 64 KiB, silently drops exports beyond it

Homepage install command: wrong domain and missing https:// protocol

Homepage install command: wrong domain and missing https:// protocol

first-class refresh hook for short-lived vault values (gcloud / aws-sso / kubectl-oidc token UX)

swamp issue ripple logged "Posted ripple on issue #514" but the ripple is not visible on the Lab

vault guide promotes inline secret values (KEY=VALUE) as a primary "swamp vault put" example

swamp-getting-started SKILL.md still references removed swamp-model / swamp-workflow / swamp-vault / swamp-extension / swamp-repo skills

extension rm blocked by stale /workspace bundle_types rows from prior container sessions with host repo bind-mounted

extension search returns null repository fields that extension info populates

Quality rubric: scope "No slow types" for model extensions (consumed via model+CEL, not type imports)

data get/list --workflow and workflow history get/logs cannot resolve extension-delivered workflows (Workflow not found)

Docs: add doctor secrets and doctor vaults to the troubleshooting how-to guide

UAT: sensitive resource output without vault produces clear pre-flight error

Docs: add doctor vaults subcommand and pre-flight vault validation

gcs-datastore: registerNamespace does not detect conflicts with existing registrations

Validate vault availability when model has sensitive output fields

Managed skills ship with dangling reference-doc links

swamp-club: update skill references and CLAUDE.md after superskill consolidation

swamp-uat: init_test.ts asserts old skill directory names after superskill consolidation

Codegen: auto-merge resources across GCP API versions instead of manual ADDITIONAL_VERSION_RESOURCE_FILTER

fix: giga-swamp UAT failures — 9 bugs found during comprehensive testing

fix: datastore setup extension with namespace config doesn't scope sync or register manifest

fix: namespace set on default repo writes incomplete filesystem config (missing path)

@swamp/1password put double-escapes JSON values

feat: giga-swamp comprehensive UAT coverage

@swamp/kubernetes 2026.06.04.1 missing upgrade path from 2026.05.27.2

@swamp/kubernetes ignores certificate-authority-data from kubeconfig for self-signed CAs

Inconsistent failures in swamp doctor extensions (database is locked, bundle build failed)

docs: giga-swamp user documentation — reference, how-to, and conceptual guide

@swamp/gcp/iam missing serviceAccounts model type

@swamp/ssh@2026.06.04.1 fails to load: bare zod import + missing 2026.06.04.1 upgrade entry

feat: giga-swamp phase 7 — Data migration commands

feat: S3/GCS extension namespace manifest support (registerNamespace/listNamespaces)

Relocate Docker image from systeminit org to swamp-club

Move JSR packages from @systeminit to @swamp-club scope

Should be able to see all the issues I created by a filter "submitted by me"

Ability to change the email address associated with my Swamp Club Account

feat: giga-swamp phase 5 — CLI output + namespace management commands

CI review jobs use two-dot diff that includes files the PR never touched

paths.base: manifest is not honored for workflows: — bundled workflows only resolve from repo root, blocking self-contained subdir layouts (sibling to #459)

Lab profanity filter rejects legitimate CLI flag tokens via substring match

Sign and notarize the swamp macOS binary

Add platform type to issue-lifecycle extension model Zod schema

fix: datastoreSetupExtension() ignores namespace config on initial migration push/pull

Remote execution: orchestrator/worker fan-out (replaces execution drivers)

swamp datastore sync --push creates global .datastore-index.json ignoring namespace config

feat: S3/GCS extension namespace-scoped sync support

Copy explicitGlobalArgs before mutation in resolveOrCreateDefinition

vault.get() expressions in extension model globalArguments are not resolved at runtime

swamp-issue skill should scrub secrets and org-specific data before submission

workflow validate: trim stale 'skipped' label from model_not_found warning

Add pi coding agent support

hashicorp-vault should read token from env

swamp-extension adversarial review skill needs mandatory mechanical verification checklist

feat: giga-swamp phase 6 — Namespace-scoped sync

swamp workflow validate emits misleading "Extension failed to load" warning when type resolves locally

Add issue search/list command to discover existing issues

Support vault-resolved private key content in transport auth (not just file paths)

Workflow engine resolves extension methods against base type, ignoring extension-registered methods

Per-model LockTimeoutError at 60s causes cascading failures under concurrent access

Persistent, queryable workflow runs (status / cancel from any shell)

swamp repo upgrade: ERR_SQLITE_ERROR 'attempt to write a readonly database' during extension catalog schema migration

workflow validate: fail on references to unknown model instances (typo'd modelIdOrName)

feat: giga-swamp phase 4 — CEL cross-namespace queries

Docs: document the extension push adversarial-review gate

vault://local_encryption token does not round-trip correctly for GCP OAuth2 access tokens

swamp issue: add ability to edit issue title and body after submission

@swamp/gcp/iam: add WIF pool, provider, service account, and binding support

Support vault-sourced identity keys

copy method reports success when scp exits non-zero (e.g. 255)

Docs: TLS behind inspecting proxies / private CAs (system trust store, DENO_CERT, SSL_CERT_FILE)

Extension quality/adversarial-review: add a 'published-surface hygiene' check for real infra identifiers

Feed-post scoring is a direct domain write, not a consumer of feed_post_approved telemetry

workflow validate silently PASSES steps whose model type is a pulled extension (step-inputs skipped = false pass)

extension quality fails to resolve bare specifiers — contradicts fmt no-import-prefix rule

Allow global arguments in direct type execution (workflow fan-out)