@skaleagents/swarm 0.6.0 → 0.6.1

package/README.md

@@ -127,6 +127,11 @@ to your AI client. The package stores the OAuth refresh credential locally and
 refreshes access automatically. You do not need to create or paste an API key.
 Active connections can be revoked from the web app's MCP settings page.
 
+Local `review_architecture` calls validate the account and fetch public bot
+hints concurrently. The public directory request carries no credential. Every
+review still requires successful account validation. An anonymous directory
+request may already be in flight when validation rejects a connection.
+
 ## Local development
 
 ```bash
@@ -182,7 +187,7 @@ Dev without build:
   "mcpServers": {
     "skaleagents": {
       "command": "npx",
-       "args": ["-y", "@skaleagents/swarm@0.6.0"]
+       "args": ["-y", "@skaleagents/swarm@0.6.1"]
     }
   }
 }
@@ -205,6 +210,35 @@ Use the published package configuration above in `.mcp.json`. OAuth starts on th
 | `SKALEAGENTS_OAUTH_ENABLED` | No | Set to `false` only to disable browser OAuth. |
 | `MCP_RESOURCE_URL` | No | Hosted transport audience. Defaults to `https://skaleagents.com/mcp`; must match the API OAuth configuration. |
 
+## Steady-state tool latency probe
+
+With an existing, authorized `SKALEAGENTS_API_TOKEN` in the environment, run
+`npm run benchmark:tool`. The script builds this checkout, starts its stdio MCP
+server, makes five warmup calls, then times 50 `review_architecture` calls on a
+fixed synthetic application snippet. Set `BENCHMARK_WARMUP` from 0 to 20 and
+`BENCHMARK_SAMPLES` from 1 to 200 to change those counts. It refuses to start
+without the token and never opens an OAuth browser flow.
+Set `BENCHMARK_INPUT_FILE` to an existing, non-secret application source file to
+measure that source instead of the fixed snippet. Run separate samples for
+different file sizes or code patterns. The output reports only the input byte
+count and SHA-256 digest, not its path or contents. The supplied source must be
+nonempty and at most 500,000 characters. Use the same local file and pinned
+package commit when comparing runs.
+
+Each timed call includes JSON-RPC transport, hosted API account validation,
+static review, and the API bot-hint lookup. Process startup, the MCP handshake,
+OAuth login or refresh, and a hosted MCP runtime are outside the timer. The
+output contains aggregate p50/p95/p99/max latency, the API origin, and counts.
+It also reports response-header timing for the `/api/user` and `/api/bots`
+fetches, their overlap, and the remaining tool-call time after subtracting the
+union of those intervals. Overlapping time is counted once.
+That remainder includes response bodies, local work, and stdio overhead; it is
+not a single server or network measurement. Output omits the credential,
+account, and source text. A failed or unauthorized
+call aborts instead of being counted as a successful sample. This short,
+single-client diagnostic does not establish the platform's sub-second p95 or
+monthly availability target.
+
 ## Auth behavior
 
 - Missing bearer override → browser OAuth starts automatically.

package/dist/review.d.ts

@@ -16,4 +16,4 @@ export type Finding = {
 export declare function architectureFindings(content: string, focus: string): Finding[];
 export declare function literalCredential(value: string): boolean;
 export declare function externalHttp(value: string): boolean;
-export declare function fetchPublicBotHints(token?: string): Promise<string[]>;
+export declare function fetchPublicBotHints(): Promise<string[]>;

package/dist/review.js

@@ -168,13 +168,12 @@ export function externalHttp(value) {
         return false;
     }
 }
-export async function fetchPublicBotHints(token) {
+export async function fetchPublicBotHints() {
     try {
         const res = await fetch(`${getApiUrl()}/api/bots`, {
             signal: AbortSignal.timeout(10_000),
             headers: {
                 Accept: "application/json",
-                ...(token ? { Authorization: `Bearer ${token}` } : {}),
             },
         });
         if (!res.ok)

package/dist/server.js

@@ -1,6 +1,6 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
-import { getApiAccessToken, requireApiAuth, unauthorizedContent, } from "./auth.js";
+import { requireApiAuth, unauthorizedContent } from "./auth.js";
 import { architectureFindings, fetchPublicBotHints } from "./review.js";
 import { looksLikeIac, ScanInputError } from "./iac/parse.js";
 import { filterFindings, scanIac, summarize } from "./iac/scan.js";
@@ -79,14 +79,11 @@ export function createServer(remote = false) {
                 .describe("Content format: terraform, cloudformation, kubernetes, application, auto"),
         },
     }, async ({ content, focus, format, minSeverity, maxFindings }) => {
-        let token;
+        const botHints = fetchPublicBotHints();
         if (!remote) {
             const auth = await requireApiAuth();
             if (!auth.ok)
                 return unauthorizedContent(auth);
-            token = (await getApiAccessToken()) ?? undefined;
-            if (!token)
-                return unauthorizedContent({ ok: false, reason: "oauth_failed" });
         }
         try {
             const options = { focus, minSeverity, maxFindings };
@@ -94,7 +91,7 @@ export function createServer(remote = false) {
                 (format !== "auto" || looksLikeIac(content))) {
                 return result({
                     ...scanIac(content, { ...options, format }),
-                    botHints: await fetchPublicBotHints(token),
+                    botHints: await botHints,
                 });
             }
             const findings = filterFindings(architectureFindings(content, focus).slice(1), options);
@@ -111,7 +108,7 @@ export function createServer(remote = false) {
                 limitations: [
                     "Application checks are text patterns, not a language-aware or runtime analysis. Findings do not establish that code is safe.",
                 ],
-                botHints: await fetchPublicBotHints(token),
+                botHints: await botHints,
             });
         }
         catch (error) {

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.6.0";
+export declare const VERSION = "0.6.1";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.6.0";
+export const VERSION = "0.6.1";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaleagents/swarm",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -24,7 +24,8 @@
     "start": "node dist/index.js",
     "dev": "tsx src/index.ts",
     "typecheck": "tsc --noEmit",
-    "test": "tsx --test src/*.test.ts src/iac/*.test.ts src/application/*.test.ts",
+    "test": "tsx --test src/*.test.ts src/iac/*.test.ts src/application/*.test.ts && npm run build && node --test scripts/*.test.mjs",
+    "benchmark:tool": "npm run build && node scripts/benchmark-tool-latency.mjs",
     "smoke": "tsx scripts/smoke-tools.mjs"
   },
   "engines": {