feat: centralize anthropic usage (CM-1357)

[ulemons]

Summary

Centralizes Claude Agent SDK / Claude Platform on AWS usage into a new shared library (@crowd/anthropic-aws), so that packages_worker's blast-radius agent isn't the only place with this plumbing — any future service that needs a Claude agent query can reuse it directly instead of redefining it.

Changes

• New lib services/libs/anthropic-aws (@crowd/anthropic-aws):
  • getAnthropicAwsCredentials() / getAnthropicAwsAgentSdkEnv() — resolves the CROWD_AKRITES_ANTHROPIC_AWS_{REGION,WORKSPACE_ID,API_KEY} env vars and maps them to the env vars the Claude Code CLI/Agent SDK needs to route through Claude Platform on AWS.
  • runClaudeAgentQuery() — generalized version of the former runAnalysisAgent: tool restrictions (allowedTools/disallowedTools) are now parameters instead of hardcoded, defaulting to the same read-only set (Read/Grep/Glob) used by blast-radius today.
• Removed packages_worker/src/blast-radius/agent/runner.ts — it was a thin pass-through with no behavior beyond the rename. All 7 call sites (intelGo, intelCargo, intelMaven, intelNuGet, intelRubyGems, intelNpm, reachabilityStage) and their test now import runClaudeAgentQuery from @crowd/anthropic-aws directly.
• Env var naming: CROWD_AKRITES_ANTHROPIC_AWS_*, following the repo's CROWD_<SERVICE>_<KEY> convention (e.g. CROWD_S3_AWS_REGION), with AKRITES as the scoping segment to avoid colliding with the existing bare AWS_REGION used by S3/Comprehend.
• Deliberate deviation from the existing CROWD_AWS_BEDROCK_* precedent (duplicated per-service, not centralized): these credentials and the query runner are centralized in a dedicated lib instead, since this credential is meant to be reused across services beyond packages_worker from the start.
• requireEnv() stays duplicated locally in services/libs/anthropic-aws/src/credentials.ts, matching the existing per-service config.ts pattern — not moved into @crowd/common.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Performance improvement
• Chore / dependency update
• Documentation

JIRA ticket

CM-1357

[Copilot]

Pull request overview

Centralizes Claude Agent SDK/AWS configuration in reusable @crowd/anthropic-aws library and migrates blast-radius analysis to it.

Changes:

• Adds shared AWS credential mapping and agent query runner.
• Migrates seven blast-radius call sites and related tests.
• Updates workspace dependencies and lockfile.

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
services/libs/anthropic-aws/tsconfig.json	Configures TypeScript.
services/libs/anthropic-aws/src/index.ts	Exports library APIs.
services/libs/anthropic-aws/src/credentials.ts	Maps AWS credentials.
services/libs/anthropic-aws/src/agent.ts	Implements shared agent runner.
services/libs/anthropic-aws/package.json	Defines the workspace package.
services/apps/packages_worker/src/blast-radius/workflows.ts	Updates runner reference.
services/apps/packages_worker/src/blast-radius/stages/rubygems/intelRubyGems.ts	Migrates RubyGems analysis.
services/apps/packages_worker/src/blast-radius/stages/reachabilityStage.ts	Migrates reachability analysis.
services/apps/packages_worker/src/blast-radius/stages/nuget/intelNuGet.ts	Migrates NuGet analysis.
services/apps/packages_worker/src/blast-radius/stages/npm/intelNpm.ts	Migrates npm analysis.
services/apps/packages_worker/src/blast-radius/stages/maven/intelMaven.ts	Migrates Maven analysis.
services/apps/packages_worker/src/blast-radius/stages/go/intelGo.ts	Migrates Go analysis.
services/apps/packages_worker/src/blast-radius/stages/cargo/intelCargo.ts	Migrates Cargo analysis.
services/apps/packages_worker/src/blast-radius/stages/__tests__/reachabilityStage.test.ts	Updates runner mocks.
services/apps/packages_worker/package.json	Adds shared-library dependency.
pnpm-lock.yaml	Updates workspace resolution.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (5)

services/libs/anthropic-aws/src/agent.ts:69

• Customizing allowedTools alone cannot enable any tool in the default deny list (for example, WebSearch), because disallowedTools still defaults to denying it and deny rules take precedence. Derive the default deny list from the effective allow list so this public option behaves as advertised.
  services/libs/anthropic-aws/src/agent.ts:56
• This comment exceeds the two-line limit and partly summarizes the wrapper's implementation. Keep only the non-obvious ESM/CommonJS constraint and link its upstream source.
  services/libs/anthropic-aws/src/agent.ts:28
• These lines restate the callback's type and usage. The project convention disallows comments that only describe obvious code; the onProgress name and callback type are already sufficient.
  services/libs/anthropic-aws/src/agent.ts:74
• This comment only narrates the immediately following credential lookup and fallback branches. Remove it to follow the project's self-explanatory-code convention.
  services/libs/anthropic-aws/src/agent.ts:24
• This external CLI restriction is a permitted comment only when it links to the relevant upstream documentation or issue. Please add the source so future maintainers can verify when the workaround is still necessary.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 19 out of 20 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (4)

services/libs/anthropic-aws/src/agent.ts:69

• A caller that supplies a custom allowedTools list still inherits the default blacklist. For example, allowedTools: ['Read', 'Bash'] leaves Bash disallowed unless the caller also knows to override disallowedTools, so this new API cannot reliably enable a tool through its allowlist. Apply the read-only blacklist only when the default allowlist is being used.
  services/libs/anthropic-aws/src/agent.ts:56
• This header mixes the necessary ESM interoperability constraint with a restatement of the wrapper's behavior, making the constraint comment longer than the repository's two-line limit. Keep only the non-obvious ESM requirement and link its source.

This issue also appears on line 73 of the same file.
services/libs/anthropic-aws/src/agent.ts:74

• These lines only narrate the immediately following try/fallback branch and will become stale if auth handling changes. Remove the restatement and let the control flow and authMode names explain the behavior.
  services/libs/anthropic-aws/src/credentials.ts:19
• The environment-resolution behavior lost its direct test coverage when the existing auth suite was deleted, while this new package has no tests or test script. Please preserve coverage for missing/partial credentials and the exact AWS SDK environment mapping so credential-name regressions do not silently send agent runs through local fallback.

export function getAnthropicAwsCredentials(): AnthropicAwsCredentials {
  return {
    region: requireEnv('CROWD_AKRITES_ANTHROPIC_AWS_REGION'),
    workspaceId: requireEnv('CROWD_AKRITES_ANTHROPIC_AWS_WORKSPACE_ID'),
    apiKey: requireEnv('CROWD_AKRITES_ANTHROPIC_AWS_API_KEY'),

[cursor]

PR Summary

High Risk
Production blast-radius LLM auth and required env vars change; missing CROWD_AKRITES_ANTHROPIC_AWS_* silently falls back to CLI auth, which can break or mis-route agent runs in deployed workers.

Overview
Introduces @crowd/anthropic-aws as the shared home for Claude Agent SDK runs and wires blast-radius intel/reachability stages to runClaudeAgentQuery instead of the local runAnalysisAgent wrapper. The Claude SDK dependency moves from packages_worker into the new lib.

Auth behavior changes for blast-radius agents: runs now prefer Claude Platform on AWS via CROWD_AKRITES_ANTHROPIC_AWS_{REGION,WORKSPACE_ID,API_KEY} (mapped to the SDK env vars). If those are missing, the runner falls back to local Claude Code CLI auth (dev). The previous paths—BLAST_RADIUS_ANTHROPIC_* / LiteLLM-style API keys and resolveAgentAuth Bedrock env wiring in @crowd/common—are removed along with their tests.

runClaudeAgentQuery generalizes the old runner (configurable allowedTools/disallowedTools, safer onProgress handling) while keeping the same read-only defaults. Lockfile updates reflect the new workspace package and SDK ownership shift.

^{Reviewed by Cursor Bugbot for commit 9ff90ad. Bugbot is set up for automated code reviews on this repo. Configure here.}