AI Providers

SFDT’s AI features are optional and provider-agnostic. They work with Claude, Gemini, or OpenAI, configured during sfdt init or by editing .sfdt/config.json. Every AI command degrades gracefully when AI is disabled — heuristic fallbacks run where applicable (e.g. sfdt explain), and AI-only commands print how to enable it.

Enable AI


{
  "features": { "ai": true },
  "ai": { "provider": "claude", "model": "" }
}

Providers

Claude (default)

Requires the Claude Code CLI :


npm install -g @anthropic-ai/claude-code


{ "ai": { "provider": "claude" } }

Claude runs interactively and can read your repository files directly via tools, giving it full project context. No API key goes in sfdt config — Claude Code handles its own auth.

Claude’s interactive mode is not suitable for CI. Use Gemini or OpenAI for CI-based AI.

Gemini

Requires the Gemini CLI :


npm install -g @google/gemini-cli


{ "ai": { "provider": "gemini", "model": "" } }

Authentication and model selection are handled by the Gemini CLI. Suitable for CI.

OpenAI

Requires the Codex CLI :


npm install -g @openai/codex


{ "ai": { "provider": "openai", "model": "" } }

Authentication and model selection are handled by the Codex CLI. Suitable for CI.

Which commands use AI

Command	AI role
`sfdt test`	Failure analysis on test failure
`sfdt quality --fix-plan`	Prioritized, file-specific fix plan
`sfdt manifest --ai-cleanup`	Missing-dependency detection
`sfdt explain`	Deep log analysis (after the offline heuristic scan)
`sfdt review`	Code review across five categories
`sfdt pr-description`	GitHub/Slack content generation
`sfdt release`	Release-note generation
`sfdt changelog generate`	Changelog entries from commits
`sfdt ai prompt`	Ad-hoc prompts

Disabling AI


{ "features": { "ai": false } }

All AI steps are skipped. AI-only commands (review, pr-description) exit with an error explaining how to enable it. Heuristic fallbacks still run in sfdt explain.

Security: the read-only tool sandbox

All AI invocations default to a read-only tool sandbox (Read,Grep,Glob) across the Claude/Gemini/Codex providers. AI-influenced content — diffs, org output, browser context — cannot drive Bash/Write/Edit. This closes the prompt-injection surface for both the streaming dashboard chat and the request/response CLI paths. Callers may pass an explicit allowed-tools list to override.