codegate-ai 0.15.1 → 0.16.0

package/dist/cli.js

@@ -9,6 +9,7 @@ import { Command, Option } from "commander";
 import { DEFAULT_CONFIG, OUTPUT_FORMATS, PERSONAS, RUNTIME_MODES, SCAN_COLLECTION_MODES, SCAN_COLLECTION_KINDS, resolveEffectiveConfig, } from "./config.js";
 import { APP_NAME } from "./index.js";
 import { runSandboxCommand } from "./layer3-dynamic/sandbox.js";
+import { runClaudeViaSdk } from "./layer3-dynamic/claude-sdk-provider.js";
 import { loadKnowledgeBase } from "./layer1-discovery/knowledge-base.js";
 import { createScanDiscoveryContext, discoverDeepScanResources, discoverDeepScanResourcesFromContext, discoverLocalTextAnalysisTargetsFromContext, runScanEngine, } from "./scan.js";
 import { registerSignalHandlers } from "./runtime/signal-handlers.js";
@@ -70,6 +71,26 @@ export function isDirectCliInvocation(importMetaUrl, argv1, deps = {}) {
     }
 }
 async function runMetaAgentCommandWithSandbox(context) {
+    // Claude runs through the Agent SDK so we get structured message
+    // iteration and reuse the user's `claude login` session without
+    // having to shell-escape prompts or parse stdout JSON envelopes.
+    // Codex and generic/OpenCode still spawn their CLIs — swap those
+    // once the Codex SDK auth story (see openai/codex#7144) is
+    // dependable enough to adopt.
+    if (context.agent.metaTool === "claude") {
+        const sdkResult = await runClaudeViaSdk({
+            prompt: context.command.prompt,
+            cwd: context.command.cwd,
+            readOnly: context.command.readOnly,
+            timeoutMs: context.command.timeoutMs,
+        });
+        return {
+            command: context.command,
+            code: sdkResult.code,
+            stdout: sdkResult.stdout,
+            stderr: sdkResult.stderr,
+        };
+    }
     const commandResult = await runSandboxCommand({
         command: context.command.command,
         args: context.command.args,

package/dist/layer3-dynamic/claude-sdk-provider.d.ts

@@ -0,0 +1,21 @@
+import type { SandboxCommandResult } from "./sandbox.js";
+/**
+ * Run Claude's layer-3 analysis via @anthropic-ai/claude-agent-sdk instead
+ * of spawning the `claude` binary directly.
+ *
+ * Auth follows the SDK's default precedence: if ANTHROPIC_API_KEY is set it
+ * wins, otherwise the SDK delegates to the bundled Claude binary which
+ * reads the session written by `claude login` (~/.claude/settings.json).
+ * No explicit key plumbing here — intentional, the whole point of the
+ * swap is to reuse whatever auth the user already has.
+ *
+ * Contract matches runSandboxCommand so the caller in cli.ts can treat
+ * this as a drop-in for the claude CLI path.
+ */
+export interface ClaudeSdkInput {
+    prompt: string;
+    cwd: string;
+    readOnly: boolean;
+    timeoutMs?: number;
+}
+export declare function runClaudeViaSdk(input: ClaudeSdkInput): Promise<SandboxCommandResult>;

package/dist/layer3-dynamic/claude-sdk-provider.js

@@ -0,0 +1,71 @@
+import { query } from "@anthropic-ai/claude-agent-sdk";
+import { DEFAULT_SANDBOX_TIMEOUT_MS } from "./sandbox.js";
+const READ_ONLY_TOOLS = ["Read", "Glob", "Grep"];
+export async function runClaudeViaSdk(input) {
+    const timeoutMs = input.timeoutMs ?? DEFAULT_SANDBOX_TIMEOUT_MS;
+    const abort = new AbortController();
+    let timedOut = false;
+    const timer = setTimeout(() => {
+        timedOut = true;
+        abort.abort();
+    }, timeoutMs);
+    // Mirror the CLI flag set from command-builder.ts. Non-readOnly = no
+    // tools, one turn, plain completion. Read-only = file-read tools only,
+    // auto-allowed so we don't deadlock on a permission prompt (no human in
+    // the loop), permissionMode 'plan' blocks any write even if a tool slips
+    // in via future SDK defaults.
+    const options = input.readOnly
+        ? {
+            cwd: input.cwd,
+            maxTurns: 10,
+            permissionMode: "plan",
+            tools: [...READ_ONLY_TOOLS],
+            allowedTools: [...READ_ONLY_TOOLS],
+            abortController: abort,
+        }
+        : {
+            cwd: input.cwd,
+            maxTurns: 1,
+            tools: [],
+            abortController: abort,
+        };
+    try {
+        const stream = query({ prompt: input.prompt, options });
+        let finalResult = null;
+        let errorMessage = null;
+        for await (const message of stream) {
+            if (message.type !== "result") {
+                continue;
+            }
+            if (message.subtype === "success") {
+                finalResult = message.result;
+            }
+            else {
+                // SDK surfaces a structured error subtype — capture the whole
+                // thing as stderr so the caller's existing diagnostic path
+                // (parseMetaAgentOutput returning null → evidence snippet) sees
+                // something useful.
+                errorMessage = JSON.stringify(message);
+            }
+        }
+        clearTimeout(timer);
+        if (timedOut) {
+            return { code: 124, stdout: "", stderr: "claude-agent-sdk: query timed out" };
+        }
+        if (finalResult !== null) {
+            return { code: 0, stdout: finalResult, stderr: "" };
+        }
+        return { code: 1, stdout: "", stderr: errorMessage ?? "claude-agent-sdk: no result message" };
+    }
+    catch (error) {
+        clearTimeout(timer);
+        if (timedOut) {
+            return { code: 124, stdout: "", stderr: "claude-agent-sdk: query timed out" };
+        }
+        return {
+            code: 1,
+            stdout: "",
+            stderr: `claude-agent-sdk: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}

package/dist/layer3-dynamic/command-builder.d.ts

@@ -12,5 +12,12 @@ export interface MetaAgentCommand {
     cwd: string;
     preview: string;
     timeoutMs?: number;
+    /** Original prompt before CLI shell-escaping — used by SDK-based
+     *  runners (e.g. claude-sdk-provider) that call the model directly
+     *  rather than spawning the binary. */
+    prompt: string;
+    /** Read-only flag preserved so SDK runners can set the equivalent
+     *  permission mode without re-parsing argv. */
+    readOnly: boolean;
 }
 export declare function buildMetaAgentCommand(input: MetaAgentCommandInput): MetaAgentCommand;

package/dist/layer3-dynamic/command-builder.js

@@ -51,6 +51,8 @@ export function buildMetaAgentCommand(input) {
             args,
             cwd: input.workingDirectory,
             preview: `${command} ${args.map(shellEscape).join(" ")}`,
+            prompt,
+            readOnly,
         };
     }
     if (input.tool === "codex") {
@@ -63,6 +65,8 @@ export function buildMetaAgentCommand(input) {
             args,
             cwd: input.workingDirectory,
             preview: `${command} ${args.map(shellEscape).join(" ")}`,
+            prompt,
+            readOnly,
         };
     }
     // Generic / OpenCode
@@ -77,5 +81,7 @@ export function buildMetaAgentCommand(input) {
         args: ["-lc", pipeCommand],
         cwd: input.workingDirectory,
         preview: `${command} ${shellEscape("-lc")} ${shellEscape(pipeCommand)}`,
+        prompt,
+        readOnly,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codegate-ai",
-  "version": "0.15.1",
+  "version": "0.16.0",
   "description": "Pre-flight security scanner for AI coding tool configurations.",
   "license": "MIT",
   "type": "module",
@@ -63,6 +63,7 @@
     ]
   },
   "dependencies": {
+    "@anthropic-ai/claude-agent-sdk": "^0.2.118",
     "ajv": "^8.18.0",
     "commander": "^14.0.3",
     "dotenv": "^17.3.1",