> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pensar.dev/apex/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pensar.dev/apex/_mcp/server.

# runPatchingAgent

> Fix a security vulnerability in a codebase and get a pull request title and description

**`Signature`**

```ts title="Signature"
function runPatchingAgent(input: PatchingAgentInput): Promise<PatchResult>;
```

Reads, searches, and edits code in `cwd` to fix the vulnerability you describe. It then checks the fix by running the project's lint, type-check, and tests. The changes are left in the working tree, so you decide how to commit and open the pull request.

If you don't pass an `eventBus`, the agent's text and tool calls are printed to stdout.

> **Warning**
>
> The agent edits files and runs commands in `cwd`. Point it at a disposable clone or a sandbox, not a working copy with uncommitted changes.

**`Import`**

```ts title="Import"
import { runPatchingAgent } from "@pensar/apex/core/api";
```

## Parameters

**`cwd`** `string` — required

Root of the repository to patch.

---

**`vulnerability`** `VulnerabilityDetails` — required

The vulnerability to fix.

---

**`name`** `string` — required

Vulnerability title.

---

**`severity`** `string` — required

Severity, for example `HIGH`.

---

**`description`** `string` — required

What's wrong and why.

---

**`location`** `string`

File path of the vulnerable code.

---

**`startLineNumber`** `number | null`

First vulnerable line.

---

**`endLineNumber`** `number | null`

Last vulnerable line.

---

**`cweMapping`** `string[]`

CWE IDs, for example `["CWE-89"]`.

---

**`poc`** `{ fileName: string; contents: string }`

Proof of concept the agent can use to confirm the fix.

---

**`session`** `SessionInfo` — required

Session for logs and artifacts. See [`sessions.create()`](/apex/sdk/reference/sessions).

---

**`model`** `AIModel` — required

Model ID. See [Models](/apex/sdk/configuration#models).

---

**`authConfig`** `AIAuthConfig`

AI provider credentials.

---

**`eventBus`** `AgentEventBus`

Streaming events. When omitted, output is printed to stdout.

---

**`abortSignal`** `AbortSignal`

Cancels the run.

---

## Returns

`Promise<PatchResult>`

**`filesChanged`** `{ filePath: string; changesDescription: string }[]`

Every file the agent modified, with a description of each change.

---

**`prTitle`** `string`

Suggested pull request title.

---

**`prDescription`** `string`

Suggested pull request description.

---

## Example

```ts
import { buildAuthConfig } from "@pensar/apex/core/ai";
import { runPatchingAgent } from "@pensar/apex/core/api";
import { config } from "@pensar/apex/core/config";
import { sessions } from "@pensar/apex/core/session";

const repo = "/tmp/my-app-clone";
const patch = await runPatchingAgent({
  cwd: repo,
  vulnerability: {
    name: "SQL injection in order search",
    severity: "HIGH",
    description: "The `q` parameter is concatenated into a raw SQL query.",
    location: "src/orders/search.ts",
    startLineNumber: 42,
    endLineNumber: 48,
    cweMapping: ["CWE-89"],
  },
  session: await sessions.create({ name: "Patch", targets: [repo] }),
  model: "claude-opus-4-6",
  authConfig: buildAuthConfig(await config.get()),
});

console.log(patch.prTitle);
for (const f of patch.filesChanged) console.log(`${f.filePath}: ${f.changesDescription}`);
```