@skaleagents/swarm 0.7.0 → 0.7.1

package/README.md

@@ -21,6 +21,8 @@ the MCP tool for a structured review.
 
 `npx -y @skaleagents/swarm scan [paths...]` scans IaC, CI, Dockerfile and package files on your machine. It needs no account and sends nothing over the network. Use `--changed` for files changed against HEAD, `--fail-on high` to exit 1, and `--json` for machine output.
 
+Adopt it on an existing repo: `npx @skaleagents/swarm scan --write-baseline .skaleagents-baseline.json`, commit the file, and later scans (hook and Action included) show only new findings. Findings match on rule, file and resource, not line number.
+
 Suppress an intended setting with a comment on the flagged line or the line above: `# skaleagents-ignore DATA001 public asset bucket`.
 
 **Claude Code plugin.** It adds a stop hook that scans changed files and asks the agent to fix `high` and `critical` findings, plus a skill and the hosted MCP server:
@@ -33,7 +35,7 @@ Suppress an intended setting with a comment on the flagged line or the line abov
 **Cursor.** Add `.cursor/hooks.json`:
 
 ```json
-{ "version": 1, "hooks": { "stop": [{ "command": "npx -y --registry=https://registry.npmjs.org @skaleagents/swarm@0.7.0 scan --hook" }] } }
+{ "version": 1, "hooks": { "stop": [{ "command": "npx -y --registry=https://registry.npmjs.org @skaleagents/swarm@0.7.1 scan --hook" }] } }
 ```
 
 **GitHub Action.** It posts one PR comment and fails on `critical` by default:
@@ -47,7 +49,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with: { fetch-depth: 0 }
-      - uses: SkaleAgents/mcp-server@v0.7.0
+      - uses: SkaleAgents/mcp-server@v0.7.1
         with: { fail-on: high }
 ```
 

package/dist/cli.d.ts

@@ -8,5 +8,7 @@ export declare function scanFiles(files: string[], minSeverity?: FindingSeverity
     suppressed: number;
     warnings: string[];
 };
+export declare const baselineKey: (f: FileFinding) => string;
+export declare function readBaseline(path: string): Set<string>;
 export declare function formatText(findings: FileFinding[], suppressed: number): string;
 export declare function runScan(argv: string[]): Promise<number>;

package/dist/cli.js

@@ -1,5 +1,5 @@
 import { execFileSync } from "node:child_process";
-import { existsSync, lstatSync, readdirSync, readFileSync } from "node:fs";
+import { existsSync, lstatSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative } from "node:path";
 import { scanIac, severityRank } from "./iac/scan.js";
 const usage = `Usage: skaleagents-swarm scan [paths...] [options]
@@ -9,6 +9,8 @@ Scans IaC, CI and package files locally. No account or network needed.
   --changed              Scan files changed against HEAD plus untracked files
   --min-severity <s>     Hide findings below info|low|medium|high|critical (default low)
   --fail-on <s>          Exit 1 when a finding is at or above this severity
+  --baseline <file>      Hide findings already listed in this baseline file (.skaleagents-baseline.json is used automatically)
+  --write-baseline <file>  Write current findings to a baseline file and exit 0
   --json                 Print JSON instead of text
   --hook                 Agent stop hook mode for Claude Code and Cursor (implies --changed)
 
@@ -91,6 +93,16 @@ export function scanFiles(files, minSeverity = "low") {
 }
 // Names come from scanned files, so they are flattened and capped before reaching an agent or PR comment.
 const clean = (value, max = 160) => (value ?? "").replace(/[\x00-\x1f\x7f`]+/g, " ").slice(0, max);
+// Line numbers are left out so unrelated edits above a finding do not make it look new.
+export const baselineKey = (f) => `${f.ruleId}|${f.file.replaceAll("\\", "/")}|${f.resource ?? ""}`;
+export function readBaseline(path) {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    const keys = parsed?.findings;
+    if (!Array.isArray(keys) || keys.some((key) => typeof key !== "string")) {
+        throw new Error(`${path} is not a SkaleAgents baseline file`);
+    }
+    return new Set(keys);
+}
 export function formatText(findings, suppressed) {
     if (findings.length === 0)
         return `SkaleAgents: no findings${suppressed ? ` (${suppressed} suppressed)` : ""}.`;
@@ -110,6 +122,8 @@ export async function runScan(argv) {
     let hook = false;
     let minSeverity = "low";
     let failOn;
+    let baselinePath;
+    let writeBaseline;
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
         if (arg === "--") {
@@ -124,6 +138,15 @@ export async function runScan(argv) {
             hook = changed = true;
         else if (arg === "--min-severity")
             minSeverity = severityArg(argv[++i], arg);
+        else if (arg === "--baseline" || arg === "--write-baseline") {
+            const value = argv[++i];
+            if (!value)
+                throw new Error(`${arg} needs a file path`);
+            if (arg === "--baseline")
+                baselinePath = value;
+            else
+                writeBaseline = value;
+        }
         else if (arg === "--fail-on")
             failOn = severityArg(argv[++i], arg);
         else if (arg === "-h" || arg === "--help") {
@@ -149,7 +172,18 @@ export async function runScan(argv) {
     }
     for (const path of paths.length || changed ? paths : ["."])
         walk(path, files);
-    const { findings, suppressed, warnings } = scanFiles([...new Set(files)], minSeverity);
+    const scanned = scanFiles([...new Set(files)], minSeverity);
+    const { suppressed, warnings } = scanned;
+    if (writeBaseline) {
+        const keys = [...new Set(scanned.findings.map(baselineKey))].sort();
+        writeFileSync(writeBaseline, `${JSON.stringify({ version: 1, findings: keys }, null, 2)}\n`);
+        console.log(`SkaleAgents: wrote ${keys.length} findings to ${writeBaseline}.`);
+        return 0;
+    }
+    // A committed baseline at the repo root applies automatically, so hooks and the Action need no flag.
+    baselinePath ??= existsSync(".skaleagents-baseline.json") ? ".skaleagents-baseline.json" : undefined;
+    const known = baselinePath ? readBaseline(baselinePath) : new Set();
+    const findings = scanned.findings.filter((f) => !known.has(baselineKey(f)));
     const failing = failOn ? findings.filter((f) => severityRank[f.severity] >= severityRank[failOn]) : [];
     if (hook) {
         if (failing.length) {

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.7.0";
+export declare const VERSION = "0.7.1";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.7.0";
+export const VERSION = "0.7.1";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaleagents/swarm",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -53,5 +53,6 @@
   "devDependencies": {
     "@types/node": "^22.20.1",
     "tsx": "^4.23.12"
-  }
+  },
+  "mcpName": "io.github.SkaleAgents/swarm"
 }