`swamp extension pull` should gitignore pulled extension source files

[bixu]

Problem Statement

When pulling community extensions with swamp extension pull, the extracted source files (e.g. extensions/models/gcp_iam.ts, extensions/vaults/onepassword.ts) are written to the working tree but not added to .gitignore. This means:

1. Users accidentally commit pulled extension source code that should be treated as a dependency artifact
2. The .gitignore entries must be manually maintained per-extension, using exact file paths to avoid gitignoring future local extensions
3. If a user forgets to gitignore, PRs balloon with dependency code that doesn't belong in the repo

The upstream_extensions.json file already tracks exactly which files were pulled — this is the dependency manifest that should be committed. But the source files themselves are the equivalent of node_modules/ and should not be tracked.

How We Hit This

We pulled @swamp/1password, @hivemq/gcp/iam, and @hivemq/gcp/resourcemanager into a repo. All three were committed to git before we realized they should be gitignored. We then had to manually add each path to .gitignore and run git rm --cached across multiple commits.

Proposed Solution

Extract pulled extensions into a separate directory from local extensions (e.g. extensions/.pulled/ or .swamp/extensions/), then gitignore that entire directory. This would be easier to reason about than managing individual .gitignore entries:

• extensions/models/ — user-authored local extensions (committed to git)
• extensions/.pulled/models/ — pulled community extensions (gitignored, restored with swamp extension pull)

The separation makes the mental model clear: local code you write goes in extensions/, dependency code goes in a gitignored subdirectory. Similar to how node_modules/ is separate from src/.

Swamp would need to resolve types from both directories at startup.

Alternatives Considered

• Auto-manage a .gitignore section — similar to how swamp init manages .swamp/ in .gitignore. Would work but requires per-file entries and is fragile if users have local extensions with similar names.
• Ignore all of extensions/ — too broad, prevents committing local extensions.
• Document it — the current state; easy to forget and causes noisy PRs.

Summary

Scope: swamp extension pull command and extension resolution. Separate pulled dependency source from local extension source so the pulled files can be trivially gitignored as a directory.

[github-actions]

Hi @bixu, thanks for opening this issue!

We appreciate you taking the time to report it. A maintainer will review it as soon as possible.

In the meantime, please make sure you've included all relevant details (steps to reproduce, expected vs actual behaviour, swamp version, etc.) to help us triage it quickly.