@qoder-ai/qoder-agent-sdk 1.0.22 → 1.0.24

package/README.md

@@ -213,6 +213,30 @@ for await (const message of q) {
 }
 ```
 
+## Code Security
+
+Built-in code security is disabled by default in SDK sessions. Enable only the
+capabilities the integration needs:
+
+```ts
+const q = query({
+  prompt: "Review this repository for security issues.",
+  options: {
+    auth: qodercliAuth(),
+    cwd: process.cwd(),
+    securityScan: {
+      l1StaticCheck: true,
+      l2LightweightScan: true,
+      l3DeepScan: false,
+    },
+  },
+});
+```
+
+Omitted switches remain disabled. The top-level option is authoritative for
+the SDK session. Enabling any switch also makes the native security skill
+available; project and file scans do not have a separate switch.
+
 ## Tools and Permissions
 
 Qoder Agent can use tools such as file reads, file edits, shell commands, and

package/dist/core/process-transport.d.ts

@@ -15,7 +15,7 @@ import type { SdkPluginConfig, ToolConfig } from '../types/common.js';
 import type { PermissionMode } from '../types/permissions.js';
 import type { McpServerConfigForProcessTransport, McpServerToolPolicy } from '../types/mcp.js';
 import type { InternalAuthOptions } from '../types/auth.js';
-import type { SpawnedProcess, SpawnOptions, SettingSource } from '../types/options.js';
+import type { SecurityScanOptions, SpawnedProcess, SpawnOptions, SettingSource } from '../types/options.js';
 import type { DiagnosticsSink } from './sdk-diagnostics.js';
 export declare class QoderCliProcessError extends Error {
     readonly code: "QODER_CLI_PROCESS_ERROR";
@@ -93,6 +93,7 @@ export interface ProcessTransportOptions {
     allowedMcpServerNames?: string[];
     strictMcpConfig?: boolean;
     settings?: string | Record<string, unknown>;
+    securityScan?: SecurityScanOptions;
     settingSources?: SettingSource[];
     additionalDirectories?: string[];
     plugins?: SdkPluginConfig[];

package/dist/core/runtime-command.d.ts

@@ -0,0 +1,14 @@
+export interface RuntimeCommandOptions {
+    pathToQoderCLIExecutable?: string;
+    cwd?: string;
+    env?: Record<string, string | undefined>;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}
+export interface RuntimeCommandResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+}
+/** Run a standalone qodercli subcommand using the packaged runtime carrier. */
+export declare function runRuntimeCommand(args: string[], options?: RuntimeCommandOptions): Promise<RuntimeCommandResult>;

package/dist/core/runtime-launch-options.d.ts

@@ -4,7 +4,7 @@ import type { InternalAuthOptions } from '../types/auth.js';
 import type { PermissionMode } from '../types/permissions.js';
 import type { McpServerConfigForProcessTransport } from '../protocol/mcp.js';
 import type { McpServerToolPolicy } from '../types/mcp.js';
-import type { SettingSource } from '../types/options.js';
+import type { SecurityScanOptions, SettingSource } from '../types/options.js';
 export declare class AuthAccessTokenEnvVarError extends Error {
     readonly code: "auth_access_token_env_var_not_configured";
     constructor(envVar: string);
@@ -50,6 +50,7 @@ export interface RuntimeLaunchOptions {
     allowedMcpServerNames?: string[];
     strictMcpConfig?: boolean;
     settings?: string | Record<string, unknown>;
+    securityScan?: SecurityScanOptions;
     settingSources?: SettingSource[];
     additionalDirectories?: string[];
     plugins?: SdkPluginConfig[];
@@ -79,6 +80,7 @@ export declare class RuntimeLaunchOptionsBuilder {
     buildArgs(): string[];
     private buildSettingsArg;
     private applyFileCheckpointingSetting;
+    private applySecurityScanSetting;
     private applySettingsCompatibility;
     private toQoderDefaultPermissionMode;
     private applyAdditionalDirectories;

package/dist/core/security-scan-options.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { SecurityScanOptions } from '../types/options.js';
+export declare function normalizeSecurityScanOptions(value: SecurityScanOptions): Required<SecurityScanOptions>;

package/dist/core/worker-runtime-launch.d.ts

@@ -0,0 +1,16 @@
+import type { PreparedWorkerRuntimePath } from './worker-runtime-assets.js';
+export declare const WORKER_CWD_ENV = "QODER_WORKER_CWD";
+export interface WorkerRuntimeLaunchContext {
+    env: Record<string, string>;
+    workerData: Record<string, unknown>;
+}
+/**
+ * Build the environment and workerData contract consumed by qoderWorkerRuntime.
+ * Query transports and one-shot commands must use the same contract so cwd and
+ * sidecar assets resolve identically in both launch modes.
+ */
+export declare function buildWorkerRuntimeLaunchContext(preparedRuntime: PreparedWorkerRuntimePath, options: {
+    cwd: string;
+    env: Record<string, string>;
+    workerData?: Record<string, unknown>;
+}): WorkerRuntimeLaunchContext;

package/dist/core/worker-runtime-path.d.ts

@@ -0,0 +1,2 @@
+export declare function resolveQoderWorkerRuntimePath(explicitPath?: string): string;
+export declare function hasResolvableQoderWorkerRuntime(explicitPath?: string): boolean;

package/dist/core/worker-transport.d.ts

@@ -11,6 +11,8 @@ import type { ProcessTransportOptions } from './process-transport.js';
 import type { StdoutMessage } from '../types/control.js';
 import type { DiagnosticsSink } from './sdk-diagnostics.js';
 import { type RuntimeLaunchOptions } from './runtime-launch-options.js';
+import { hasResolvableQoderWorkerRuntime, resolveQoderWorkerRuntimePath } from './worker-runtime-path.js';
+export { hasResolvableQoderWorkerRuntime, resolveQoderWorkerRuntimePath };
 export declare class QoderWorkerRuntimeError extends Error {
     readonly code: "QODER_WORKER_RUNTIME_ERROR";
     readonly exitCode?: number;
@@ -93,6 +95,4 @@ export declare class WorkerRuntimeTransport implements Transport {
     private cleanupAbortListener;
     private cleanupAuthPayload;
     private fireAuthExpired;
-}
-export declare function resolveQoderWorkerRuntimePath(explicitPath?: string): string;
-export declare function hasResolvableQoderWorkerRuntime(explicitPath?: string): boolean;
+}

package/dist/index.d.ts

@@ -86,13 +86,14 @@ export type { AccessTokenInput, AuthOptions, FetchServiceAccountToken, ServiceAc
  */
 export type { FetchJobToken, JobTokenAuthOptions, JobTokenRequest, JobTokenResult, } from './types/auth.js';
 export type { AccountInfo, UsageAddOnQuotaBucket, UsageInfo, UsageOrgResourcePackage, UsageQuotaBucket, SessionCreditsUsage, ApiKeySource, ExitReason, FastModeState, ConfigScope, SettingSource, SDKAssistantMessageError, SDKStatus, EffortLevel, ThinkingAdaptive, ThinkingEnabled, ThinkingDisabled, ThinkingConfig, ModelInfo, ModelSource, ServerModelJson, ServerModelJsonValue, ModelStrategy, ModelPromotion, LocalizedModelText, ModelContextConfig, ModelContextWindowEntry, ModelEffortEntry, ModelThinkingConfig, ModelThinkingDisabled, ModelThinkingEnabled, ModelUsage, NonNullableUsage, SlashCommand, ToolConfig, SdkPluginConfig, } from './types/common.js';
-export type { SDKMessage, SDKAssistantMessage, SDKToolNonExecutionKind, SDKToolResultMeta, SDKUserMessage, SDKUserMessageReplay, SDKResultMessage, SDKResultSuccess, SDKResultError, SDKSystemMessage, SDKSystemInitMessage, SDKSystemMessageSubtype, SDKSystemMessageBySubtype, SDKPartialAssistantMessage, SDKCompactBoundaryMessage, SDKStatusMessage, SDKAPIRetryMessage, SDKHookStartedMessage, SDKHookProgressMessage, SDKHookResponseMessage, SDKPermissionDeniedMessage, SDKMirrorErrorMessage, SDKTaskNotificationMessage, SDKTaskStartedMessage, SDKTaskProgressMessage, SDKTaskUpdatedMessage, SDKBackgroundTasksChangedMessage, SDKSessionStateChangedMessage, SDKSessionTitleChangedMessage, SDKFilesPersistedEvent, SDKElicitationCompleteMessage, SDKPromptSuggestionMessage, SDKCloudAgentEventMessage, SDKPermissionDenial, } from './types/messages.js';
+export type { SDKMessage, SDKAssistantMessage, SDKToolNonExecutionKind, SDKToolResultMeta, SDKUserMessage, SDKUserMessageReplay, SDKResultMessage, SDKResultSuccess, SDKResultError, SDKSystemMessage, SDKSystemInitMessage, SDKSystemMessageSubtype, SDKSystemMessageBySubtype, SDKPartialAssistantMessage, SDKCompactBoundaryMessage, SDKStatusMessage, SDKAPIRetryMessage, SDKModelQueueStatusMessage, SDKControlRequestProgressMessage, SDKHookStartedMessage, SDKHookProgressMessage, SDKHookResponseMessage, SDKPermissionDeniedMessage, SDKMirrorErrorMessage, SDKTaskNotificationMessage, SDKTaskStartedMessage, SDKTaskProgressMessage, SDKTaskUpdatedMessage, SDKBackgroundTasksChangedMessage, SDKSessionStateChangedMessage, SDKSessionTitleChangedMessage, SDKFilesPersistedEvent, SDKElicitationCompleteMessage, SDKPromptSuggestionMessage, SDKCloudAgentEventMessage, SDKMemoryGenerationMessage, SDKMemoryConsumptionMessage, SDKPermissionDenial, } from './types/messages.js';
 export type { DefaultRuntimeTransport, } from './core/default-runtime.js';
 export type { QueryTransportCreateOptions, QueryTransportProviderOption, } from './core/query-transport.js';
 export type { ProcessTransportOptions } from './core/process-transport.js';
 export type { WorkerRuntimeTransportOptions, WorkerTransportOptions, } from './core/worker-transport.js';
 export type { QueryTransportProvider, Transport, } from './core/transport.js';
-export type { Options, QueryTransportOptions, Query, SpawnOptions, SpawnedProcess, ElicitationRequest, ElicitationResult, OnElicitation, PromptRequest, PromptRequestOption, PromptResponse, CanUseTool, } from './types/options.js';
+export type { Options, QueryTransportOptions, Query, SpawnOptions, SpawnedProcess, ElicitationRequest, ElicitationResult, OnElicitation, PromptRequest, PromptRequestOption, PromptResponse, CanUseTool, SecurityScanOptions, } from './types/options.js';
+export type { EffectiveMemoryConfig, MemoryConsumptionFile, MemoryConsumptionOptions, MemoryConsumptionResult, MemoryGenerationGateInput, MemoryGenerationGateResult, MemoryGenerationOptions, MemoryGenerationFailedFile, MemoryGenerationResult, MemoryMode, MemoryOptions, MemoryRoot, MemoryRootAccess, MemoryShouldGenerate, } from './types/memory.js';
 export type { AgentCreateParams, BetaManagedAgentsAgentToolName, BetaManagedAgentsAgentToolset20260401Params, BetaManagedAgentsCustomSkillParams, BetaManagedAgentsFileResourceParams, BetaManagedAgentsModel, BetaManagedAgentsSkillParams, BetaManagedAgentsURLMCPServerParams, CloudAgentOptions, CloudAgentReference, CloudAgentStreamOptions, CloudSessionResource, CloudSessionCreateParams, CloudSessionCreateReference, CloudSessionExistingReference, CloudSessionReference, SessionCreateParams, } from './types/cloud-agent.js';
 export type { SettingSource as SettingSourceFromOptions } from './types/options.js';
 export type { PermissionMode, PermissionBehavior, PermissionDecisionClassification, PermissionUpdateDestination, PermissionRuleValue, PermissionUpdate, PermissionResult, CanUseToolOptions, } from './types/permissions.js';
@@ -103,8 +104,9 @@ export type { SDKSessionInfo, SessionMessage, ListSessionsOptions, GetSessionInf
 export type { Settings, ResolveSettingsOptions, ResolvedSettingSource, ResolvedSettings, ResolvedSettingsSource, SettingsProvenanceEntry, } from './types/settings.js';
 export { filterEscalatingDefaultMode } from './types/settings.js';
 export type { QoderModelPurpose } from './types/control.js';
-export type { SDKControlRequest, SDKControlResponse, SDKControlInterruptResponse, SDKControlInitializeResponse, SDKControlGetContextUsageResponse, SDKControlGetUsageInfoRequest, SDKControlGetUsageInfoResponse, SDKControlAddDirectoriesResponse, SDKControlReloadPluginsResponse, SDKControlStopTaskRequest, SDKControlBackgroundTasksRequest, SDKControlBackgroundTasksResponse, } from './types/control.js';
+export type { SDKControlRequest, SDKControlResponse, SDKControlInterruptResponse, SDKControlInitializeResponse, SDKControlGetContextUsageResponse, SDKControlGetUsageInfoRequest, SDKControlGetUsageInfoResponse, SideQuestionHistoryEntry, AskSideQuestionOptions, SideQuestionRefusalFallback, SideQuestionResult, SDKControlAddDirectoriesResponse, SDKControlReloadPluginsResponse, SDKControlStopTaskRequest, SDKControlBackgroundTasksRequest, SDKControlBackgroundTasksResponse, } from './types/control.js';
 export type { SDKControlGetModelPolicyRequest, SDKControlGetModelPolicyResponse, SDKCapabilities, ModelPolicyContext, ModelPolicyResult, ModelPolicyProvider, } from './types/model-policy-provider.js';
 export type { SDKControlGetByokConfigRequest, SDKControlGetByokConfigResponse, SDKControlValidateByokModelRequest, SDKControlValidateByokModelResponse, BYOKModelValidationInput, BYOKProviderInfo, BYOKModelTypeInfo, BYOKModelInfo, CustomModel, } from './types/byok.js';
-export type { AgentInput, AgentOutput, AgentToolCompletionResult, AgentToolBackgroundLaunchResult, AgentToolTeammateSpawnedResult, BashInput, FileReadInput, FileReadOutput, FileEditInput, FileWriteInput, GlobInput, GrepInput, WebFetchInput, WebSearchInput, AskUserQuestionInput, NotebookEditInput, TaskCreateInput, TaskCreateOutput, TaskGetInput, TaskGetOutput, TaskUpdateInput, TaskUpdateOutput, TaskListInput, TaskListOutput, ExitPlanModeInput, TodoWriteInput, ToolInputSchemas, ToolOutputSchemas, } from './types/tools.js';
+export { isBashToolBackgroundLaunchResult } from './types/tools.js';
+export type { AgentInput, AgentOutput, AgentToolCompletionResult, AgentToolBackgroundLaunchResult, AgentToolTeammateSpawnedResult, BashInput, BashToolBackgroundLaunchResult, FileReadInput, FileReadOutput, FileEditInput, FileWriteInput, GlobInput, GrepInput, WebFetchInput, WebSearchInput, AskUserQuestionInput, NotebookEditInput, TaskCreateInput, TaskCreateOutput, TaskGetInput, TaskGetOutput, TaskUpdateInput, TaskUpdateOutput, TaskListInput, TaskListOutput, ExitPlanModeInput, TodoWriteInput, ToolInputSchemas, ToolOutputSchemas, } from './types/tools.js';
 export type { FeedbackResult } from './types/account.js';