linuxfoundation · ulemons · Aug 7, 2026
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/services/apps/packages_worker/package.json b/services/apps/packages_worker/package.json
@@ -84,13 +84,13 @@
     "@crowd/archetype-standard": "workspace:*",
     "@crowd/archetype-worker": "workspace:*",
     "@crowd/temporal": "workspace:*",
+    "@crowd/anthropic-aws": "workspace:*",
     "@crowd/common": "workspace:*",
     "@crowd/data-access-layer": "workspace:*",
     "@crowd/database": "workspace:*",
     "@crowd/logging": "workspace:*",
     "@crowd/slack": "workspace:*",
     "@crowd/types": "workspace:*",
-    "@anthropic-ai/claude-agent-sdk": "^0.3.216",
     "@aws-sdk/client-bedrock-runtime": "^3.572.0",
     "@dsnp/parquetjs": "^1.7.0",
     "@google-cloud/bigquery": "^8.3.1",

diff --git a/services/apps/packages_worker/src/blast-radius/stages/__tests__/reachabilityStage.test.ts b/services/apps/packages_worker/src/blast-radius/stages/__tests__/reachabilityStage.test.ts
@@ -1,8 +1,8 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
+import { runClaudeAgentQuery } from '@crowd/anthropic-aws'
 import * as blastRadiusDal from '@crowd/data-access-layer/src/packages/blastRadius'
 
-import { runAnalysisAgent } from '../../agent/runner'
 import { ReachabilitySourceConfig, runReachabilityStage } from '../reachabilityStage'
 
 vi.mock('@crowd/data-access-layer/src/packages/blastRadius', () => ({
@@ -15,7 +15,7 @@ vi.mock('@crowd/data-access-layer/src/packages/blastRadius', () => ({
   completeStageRun: vi.fn(),
   failStageRun: vi.fn(),
 }))
-vi.mock('../../agent/runner', () => ({ runAnalysisAgent: vi.fn() }))
+vi.mock('@crowd/anthropic-aws', () => ({ runClaudeAgentQuery: vi.fn() }))
 
 const qx = {} as never
 const SYMBOL_SPEC_ROW = {
@@ -71,7 +71,7 @@ describe('runReachabilityStage', () => {
       qx,
       expect.objectContaining({ dependentId: 'dep-1', reasoning: 'no source', model: null }),
     )
-    expect(runAnalysisAgent).not.toHaveBeenCalled()
+    expect(runClaudeAgentQuery).not.toHaveBeenCalled()
   })
 
   it('persists an error verdict with downloadErrorPrefix when download throws', async () => {
@@ -89,11 +89,11 @@ describe('runReachabilityStage', () => {
         reasoning: 'download failed: boom',
       }),
     )
-    expect(runAnalysisAgent).not.toHaveBeenCalled()
+    expect(runClaudeAgentQuery).not.toHaveBeenCalled()
   })
 
   it('persists the mapped verdict on a successful agent run', async () => {
-    vi.mocked(runAnalysisAgent).mockResolvedValue({
+    vi.mocked(runClaudeAgentQuery).mockResolvedValue({
       structuredOutput: {
         uses_package: true,
         imports_vulnerable_symbol: true,
@@ -127,7 +127,7 @@ describe('runReachabilityStage', () => {
   })
 
   it('retries on agent error and succeeds on a later attempt', async () => {
-    vi.mocked(runAnalysisAgent)
+    vi.mocked(runClaudeAgentQuery)
       .mockResolvedValueOnce({
         structuredOutput: null,
         isError: true,
@@ -153,7 +153,7 @@ describe('runReachabilityStage', () => {
 
     await runReachabilityStage(qx, 'analysis-1', makeConfig())
 
-    expect(runAnalysisAgent).toHaveBeenCalledTimes(2)
+    expect(runClaudeAgentQuery).toHaveBeenCalledTimes(2)
     expect(blastRadiusDal.upsertVerdict).toHaveBeenCalledWith(
       qx,
       expect.objectContaining({ dependentId: 'dep-1', reachableVerdict: 'not_affected' }),

diff --git a/services/apps/packages_worker/src/blast-radius/stages/cargo/intelCargo.ts b/services/apps/packages_worker/src/blast-radius/stages/cargo/intelCargo.ts
@@ -2,6 +2,7 @@ import * as fs from 'fs'
 import * as os from 'os'
 import * as path from 'path'
 
+import { runClaudeAgentQuery } from '@crowd/anthropic-aws'
 import * as blastRadiusDal from '@crowd/data-access-layer/src/packages/blastRadius'
 import { getVersionNumbers } from '@crowd/data-access-layer/src/packages/blastRadiusDependents'
 import { findPackageId } from '@crowd/data-access-layer/src/packages/osv'
@@ -12,7 +13,6 @@ import {
   CARGO_INTEL_SYSTEM_PROMPT,
   buildCargoIntelPrompt,
 } from '../../agent/cargoPrompts'
-import { runAnalysisAgent } from '../../agent/runner'
 import { fetchPatch } from '../../clients/githubPatch'
 import { downloadAndExtractTarball } from '../../clients/npmTarball'
 import {
@@ -135,7 +135,7 @@ export async function runIntelStageCargo(
         patches,
       )
 
-      const agentResult = await runAnalysisAgent({
+      const agentResult = await runClaudeAgentQuery({
         prompt: agentPrompt,
         systemPrompt: CARGO_INTEL_SYSTEM_PROMPT,
         cwd: pkgsrcDir,

diff --git a/services/apps/packages_worker/src/blast-radius/stages/go/intelGo.ts b/services/apps/packages_worker/src/blast-radius/stages/go/intelGo.ts
@@ -2,14 +2,14 @@ import * as fs from 'fs'
 import * as os from 'os'
 import * as path from 'path'
 
+import { runClaudeAgentQuery } from '@crowd/anthropic-aws'
 import * as blastRadiusDal from '@crowd/data-access-layer/src/packages/blastRadius'
 import { getVersionNumbers } from '@crowd/data-access-layer/src/packages/blastRadiusDependents'
 import { findPackageId } from '@crowd/data-access-layer/src/packages/osv'
 import { QueryExecutor } from '@crowd/data-access-layer/src/queryExecutor'
 
 import { fetchVersionList } from '../../../go/proxyClient'
 import { GO_INTEL_SCHEMA, GO_INTEL_SYSTEM_PROMPT, buildGoIntelPrompt } from '../../agent/goPrompts'
-import { runAnalysisAgent } from '../../agent/runner'
 import { fetchPatch } from '../../clients/githubPatch'
 import { downloadAndExtractGoModule } from '../../clients/goModuleZip'
 import {
@@ -125,7 +125,7 @@ export async function runIntelStageGo(
         patches,
       )
 
-      const agentResult = await runAnalysisAgent({
+      const agentResult = await runClaudeAgentQuery({
         prompt: agentPrompt,
         systemPrompt: GO_INTEL_SYSTEM_PROMPT,
         cwd: pkgsrcDir,

diff --git a/services/apps/packages_worker/src/blast-radius/stages/maven/intelMaven.ts b/services/apps/packages_worker/src/blast-radius/stages/maven/intelMaven.ts
@@ -2,6 +2,7 @@ import * as fs from 'fs'
 import * as os from 'os'
 import * as path from 'path'
 
+import { runClaudeAgentQuery } from '@crowd/anthropic-aws'
 import * as blastRadiusDal from '@crowd/data-access-layer/src/packages/blastRadius'
 import { getVersionNumbers } from '@crowd/data-access-layer/src/packages/blastRadiusDependents'
 import { findPackageId } from '@crowd/data-access-layer/src/packages/osv'
@@ -14,7 +15,6 @@ import {
   MAVEN_INTEL_SYSTEM_PROMPT,
   buildMavenIntelPrompt,
 } from '../../agent/mavenPrompts'
-import { runAnalysisAgent } from '../../agent/runner'
 import { fetchPatch } from '../../clients/githubPatch'
 import { downloadAndExtractMavenSources } from '../../clients/mavenSourcesJar'
 import {
@@ -141,7 +141,7 @@ export async function runIntelStageMaven(
         patches,
       )
 
-      const agentResult = await runAnalysisAgent({
+      const agentResult = await runClaudeAgentQuery({
         prompt: agentPrompt,
         systemPrompt: MAVEN_INTEL_SYSTEM_PROMPT,
         cwd: pkgsrcDir,

diff --git a/services/apps/packages_worker/src/blast-radius/stages/npm/intelNpm.ts b/services/apps/packages_worker/src/blast-radius/stages/npm/intelNpm.ts
@@ -2,6 +2,7 @@ import * as fs from 'fs'
 import * as os from 'os'
 import * as path from 'path'
 
+import { runClaudeAgentQuery } from '@crowd/anthropic-aws'
 import * as blastRadiusDal from '@crowd/data-access-layer/src/packages/blastRadius'
 import { findPackageId } from '@crowd/data-access-layer/src/packages/osv'
 import { QueryExecutor } from '@crowd/data-access-layer/src/queryExecutor'
@@ -10,7 +11,6 @@ import { fetchPackument } from '../../../npm/fetchPackument'
 import { parseNpmName } from '../../../npm/normalize'
 import { isFetchError } from '../../../npm/types'
 import { INTEL_SCHEMA, INTEL_SYSTEM_PROMPT, buildIntelPrompt } from '../../agent/prompts'
-import { runAnalysisAgent } from '../../agent/runner'
 import { fetchPatch } from '../../clients/githubPatch'
 import { downloadAndExtractTarball } from '../../clients/npmTarball'
 import {
@@ -124,7 +124,7 @@ export async function runIntelStageNpm(
         patches,
       )
 
-      const agentResult = await runAnalysisAgent({
+      const agentResult = await runClaudeAgentQuery({
         prompt: agentPrompt,
         systemPrompt: INTEL_SYSTEM_PROMPT,
         cwd: pkgsrcDir,

diff --git a/services/apps/packages_worker/src/blast-radius/stages/nuget/intelNuGet.ts b/services/apps/packages_worker/src/blast-radius/stages/nuget/intelNuGet.ts
@@ -2,6 +2,7 @@ import * as fs from 'fs'
 import * as os from 'os'
 import * as path from 'path'
 
+import { runClaudeAgentQuery } from '@crowd/anthropic-aws'
 import * as blastRadiusDal from '@crowd/data-access-layer/src/packages/blastRadius'
 import { getVersionNumbers } from '@crowd/data-access-layer/src/packages/blastRadiusDependents'
 import { findPackageId } from '@crowd/data-access-layer/src/packages/osv'
@@ -14,7 +15,6 @@ import {
   NUGET_INTEL_SYSTEM_PROMPT,
   buildNuGetIntelPrompt,
 } from '../../agent/nugetPrompts'
-import { runAnalysisAgent } from '../../agent/runner'
 import { fetchPatch } from '../../clients/githubPatch'
 import { downloadAndExtractNuGetSource } from '../../clients/nugetSource'
 import {
@@ -135,7 +135,7 @@ export async function runIntelStageNuGet(
         patches,
       )
 
-      const agentResult = await runAnalysisAgent({
+      const agentResult = await runClaudeAgentQuery({
         prompt: agentPrompt,
         systemPrompt: NUGET_INTEL_SYSTEM_PROMPT,
         cwd: pkgsrcDir,

diff --git a/services/apps/packages_worker/src/blast-radius/stages/reachabilityStage.ts b/services/apps/packages_worker/src/blast-radius/stages/reachabilityStage.ts
@@ -3,12 +3,12 @@ import * as os from 'os'
 import * as path from 'path'
 import { promisify } from 'util'
 
+import { runClaudeAgentQuery } from '@crowd/anthropic-aws'
 import * as blastRadiusDal from '@crowd/data-access-layer/src/packages/blastRadius'
 import { QueryExecutor } from '@crowd/data-access-layer/src/queryExecutor'
 
 import { toPromptSymbolSpec } from '../agent/promptKit'
 import { SymbolSpec } from '../agent/prompts'
-import { runAnalysisAgent } from '../agent/runner'
 import { forEachWithConcurrency } from '../dependentsScan'
 
 const mkdtemp = promisify(fs.mkdtemp)
@@ -139,7 +139,7 @@ export async function runReachabilityStage(
           try {
             const systemPrompt = cfg.buildSystemPrompt(spec)
 
-            const agentResult = await runAnalysisAgent({
+            const agentResult = await runClaudeAgentQuery({
               prompt: cfg.prompt,
               systemPrompt,
               cwd: depDir,

diff --git a/services/apps/packages_worker/src/blast-radius/stages/rubygems/intelRubyGems.ts b/services/apps/packages_worker/src/blast-radius/stages/rubygems/intelRubyGems.ts
@@ -2,6 +2,7 @@ import * as fs from 'fs'
 import * as os from 'os'
 import * as path from 'path'
 
+import { runClaudeAgentQuery } from '@crowd/anthropic-aws'
 import * as blastRadiusDal from '@crowd/data-access-layer/src/packages/blastRadius'
 import { getVersionNumbers } from '@crowd/data-access-layer/src/packages/blastRadiusDependents'
 import { findPackageId } from '@crowd/data-access-layer/src/packages/osv'
@@ -14,7 +15,6 @@ import {
   RUBYGEMS_INTEL_SYSTEM_PROMPT,
   buildRubyGemsIntelPrompt,
 } from '../../agent/rubygemsPrompts'
-import { runAnalysisAgent } from '../../agent/runner'
 import { fetchPatch } from '../../clients/githubPatch'
 import {
   affectedEntriesForEcosystem,
@@ -136,7 +136,7 @@ export async function runIntelStageRubyGems(
         patches,
       )
 
-      const agentResult = await runAnalysisAgent({
+      const agentResult = await runClaudeAgentQuery({
         prompt: agentPrompt,
         systemPrompt: RUBYGEMS_INTEL_SYSTEM_PROMPT,
         cwd: pkgsrcDir,

diff --git a/services/apps/packages_worker/src/blast-radius/workflows.ts b/services/apps/packages_worker/src/blast-radius/workflows.ts
@@ -11,7 +11,7 @@ const { blastRadiusStart, blastRadiusFail } = proxyActivities<typeof activities>
 })
 
 // Intel runs an Opus agent over the downloaded package source (up to 15 turns,
-// 10-minute agent timeout in runAnalysisAgent) — give it headroom past that.
+// 10-minute agent timeout in runClaudeAgentQuery) — give it headroom past that.
 const { blastRadiusIntel } = proxyActivities<typeof activities>({
   startToCloseTimeout: '20 minutes',
   heartbeatTimeout: '5 minutes',

diff --git a/services/libs/anthropic-aws/package.json b/services/libs/anthropic-aws/package.json
@@ -0,0 +1,20 @@
+{
+  "name": "@crowd/anthropic-aws",
+  "private": true,
+  "main": "src/index.ts",
+  "type": "commonjs",
+  "scripts": {
+    "lint": "npx eslint --ext .ts src --max-warnings=0",
+    "format": "npx prettier --write \"src/**/*.ts\"",
+    "format-check": "npx prettier --check .",
+    "tsc-check": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "@types/node": "^20.8.2",
+    "typescript": "^5.6.3"
+  },
+  "dependencies": {
+    "@anthropic-ai/claude-agent-sdk": "^0.3.216",
+    "@crowd/logging": "workspace:*"
+  }
+}