Skip to navigation
SDKReference

runPatchingAgent

Signature
function runPatchingAgent(input: PatchingAgentInput): Promise<PatchResult>;

Reads, searches, and edits code in cwd to fix the vulnerability you describe. It then checks the fix by running the project’s lint, type-check, and tests. The changes are left in the working tree, so you decide how to commit and open the pull request.

If you don’t pass an eventBus, the agent’s text and tool calls are printed to stdout.

The agent edits files and runs commands in cwd. Point it at a disposable clone or a sandbox, not a working copy with uncommitted changes.

Import
import { runPatchingAgent } from "@pensar/apex/core/api";

Parameters

cwd
stringRequired

Root of the repository to patch.

vulnerability
VulnerabilityDetailsRequired

The vulnerability to fix.

name
stringRequired

Vulnerability title.

severity
stringRequired

Severity, for example HIGH.

description
stringRequired

What’s wrong and why.

location
string

File path of the vulnerable code.

startLineNumber
number | null

First vulnerable line.

endLineNumber
number | null

Last vulnerable line.

cweMapping
string[]

CWE IDs, for example ["CWE-89"].

poc
{ fileName: string; contents: string }

Proof of concept the agent can use to confirm the fix.

session
SessionInfoRequired

Session for logs and artifacts. See sessions.create().

model
AIModelRequired

Model ID. See Models.

authConfig
AIAuthConfig

AI provider credentials.

eventBus
AgentEventBus

Streaming events. When omitted, output is printed to stdout.

abortSignal
AbortSignal

Cancels the run.

Returns

Promise<PatchResult>

filesChanged
{ filePath: string; changesDescription: string }[]

Every file the agent modified, with a description of each change.

prTitle
string

Suggested pull request title.

prDescription
string

Suggested pull request description.

Example

import { buildAuthConfig } from "@pensar/apex/core/ai";
import { runPatchingAgent } from "@pensar/apex/core/api";
import { config } from "@pensar/apex/core/config";
import { sessions } from "@pensar/apex/core/session";
const repo = "/tmp/my-app-clone";
const patch = await runPatchingAgent({
  cwd: repo,
  vulnerability: {
    name: "SQL injection in order search",
    severity: "HIGH",
    description: "The `q` parameter is concatenated into a raw SQL query.",
    location: "src/orders/search.ts",
    startLineNumber: 42,
    endLineNumber: 48,
    cweMapping: ["CWE-89"],
  },
  session: await sessions.create({ name: "Patch", targets: [repo] }),
  model: "claude-opus-4-6",
  authConfig: buildAuthConfig(await config.get()),
});
console.log(patch.prTitle);
for (const f of patch.filesChanged) console.log(`${f.filePath}: ${f.changesDescription}`);