feat: centralize anthropic usage (CM-1357)

[ulemons]

Summary

Centralizes Claude Agent SDK / Claude Platform on AWS usage into a new shared library (@crowd/anthropic-aws), so that packages_worker's blast-radius agent isn't the only place with this plumbing — any future service that needs a Claude agent query can reuse it directly instead of redefining it.

Changes

• New lib services/libs/anthropic-aws (@crowd/anthropic-aws):
  • getAnthropicAwsCredentials() / getAnthropicAwsAgentSdkEnv() — resolves the CROWD_AKRITES_ANTHROPIC_AWS_{REGION,WORKSPACE_ID,API_KEY} env vars and maps them to the env vars the Claude Code CLI/Agent SDK needs to route through Claude Platform on AWS.
  • runClaudeAgentQuery() — generalized version of the former runAnalysisAgent: tool restrictions (allowedTools/disallowedTools) are now parameters instead of hardcoded, defaulting to the same read-only set (Read/Grep/Glob) used by blast-radius today.
• Removed packages_worker/src/blast-radius/agent/runner.ts — it was a thin pass-through with no behavior beyond the rename. All 7 call sites (intelGo, intelCargo, intelMaven, intelNuGet, intelRubyGems, intelNpm, reachabilityStage) and their test now import runClaudeAgentQuery from @crowd/anthropic-aws directly.
• Env var naming: CROWD_AKRITES_ANTHROPIC_AWS_*, following the repo's CROWD_<SERVICE>_<KEY> convention (e.g. CROWD_S3_AWS_REGION), with AKRITES as the scoping segment to avoid colliding with the existing bare AWS_REGION used by S3/Comprehend.
• Deliberate deviation from the existing CROWD_AWS_BEDROCK_* precedent (duplicated per-service, not centralized): these credentials and the query runner are centralized in a dedicated lib instead, since this credential is meant to be reused across services beyond packages_worker from the start.
• requireEnv() stays duplicated locally in services/libs/anthropic-aws/src/credentials.ts, matching the existing per-service config.ts pattern — not moved into @crowd/common.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Performance improvement
• Chore / dependency update
• Documentation

JIRA ticket

CM-1357

[Copilot]

Pull request overview

Centralizes Claude Agent SDK/AWS configuration in reusable @crowd/anthropic-aws library and migrates blast-radius analysis to it.

Changes:

• Adds shared AWS credential mapping and agent query runner.
• Migrates seven blast-radius call sites and related tests.
• Updates workspace dependencies and lockfile.

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
services/libs/anthropic-aws/tsconfig.json	Configures TypeScript.
services/libs/anthropic-aws/src/index.ts	Exports library APIs.
services/libs/anthropic-aws/src/credentials.ts	Maps AWS credentials.
services/libs/anthropic-aws/src/agent.ts	Implements shared agent runner.
services/libs/anthropic-aws/package.json	Defines the workspace package.
services/apps/packages_worker/src/blast-radius/workflows.ts	Updates runner reference.
services/apps/packages_worker/src/blast-radius/stages/rubygems/intelRubyGems.ts	Migrates RubyGems analysis.
services/apps/packages_worker/src/blast-radius/stages/reachabilityStage.ts	Migrates reachability analysis.
services/apps/packages_worker/src/blast-radius/stages/nuget/intelNuGet.ts	Migrates NuGet analysis.
services/apps/packages_worker/src/blast-radius/stages/npm/intelNpm.ts	Migrates npm analysis.
services/apps/packages_worker/src/blast-radius/stages/maven/intelMaven.ts	Migrates Maven analysis.
services/apps/packages_worker/src/blast-radius/stages/go/intelGo.ts	Migrates Go analysis.
services/apps/packages_worker/src/blast-radius/stages/cargo/intelCargo.ts	Migrates Cargo analysis.
services/apps/packages_worker/src/blast-radius/stages/__tests__/reachabilityStage.test.ts	Updates runner mocks.
services/apps/packages_worker/package.json	Adds shared-library dependency.
pnpm-lock.yaml	Updates workspace resolution.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (5)

services/libs/anthropic-aws/src/agent.ts:69

• Customizing allowedTools alone cannot enable any tool in the default deny list (for example, WebSearch), because disallowedTools still defaults to denying it and deny rules take precedence. Derive the default deny list from the effective allow list so this public option behaves as advertised.
  services/libs/anthropic-aws/src/agent.ts:56
• This comment exceeds the two-line limit and partly summarizes the wrapper's implementation. Keep only the non-obvious ESM/CommonJS constraint and link its upstream source.
  services/libs/anthropic-aws/src/agent.ts:28
• These lines restate the callback's type and usage. The project convention disallows comments that only describe obvious code; the onProgress name and callback type are already sufficient.
  services/libs/anthropic-aws/src/agent.ts:74
• This comment only narrates the immediately following credential lookup and fallback branches. Remove it to follow the project's self-explanatory-code convention.
  services/libs/anthropic-aws/src/agent.ts:24
• This external CLI restriction is a permitted comment only when it links to the relevant upstream documentation or issue. Please add the source so future maintainers can verify when the workaround is still necessary.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.