greenbump 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -0,0 +1,54 @@
+# Changelog
+
+All notable changes to this project are documented here. Format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+## [0.2.1]
+
+### Added
+- `--scan` flag: list outdated dependencies without upgrading (read-only mode)
+- Risk boundaries documentation in README (when to use greenbump vs manual review)
+- Competitor comparison table (vs Dependabot, Renovate, Migratowl)
+- CI smoke tests for real toolchains (npm, pip, cargo)
+- Options table updated with `--scan`, `--all`, `--group`, `--max-tokens`
+
+### Changed
+- GitHub Action branding icon from `arrow-up-circle` to `refresh-cw`
+- npm package excludes test files via `.npmignore` (reduced from 116 to 114 files)
+
+## [0.2.0]
+
+### Added
+- Batch upgrades: `--all` (every outdated dep) and multi-dep args, with `--group <name>`
+  to combine several deps into one branch/PR, and `--fail-fast` to abort a batch on the
+  first hard failure.
+- Monorepo/workspace support: detects npm/yarn `workspaces` and pnpm's
+  `pnpm-workspace.yaml`, resolving ambiguous dependency names via `--workspace`.
+- `needsReview` field on run summaries, surfaced as CLI exit code 3 (distinct from exit
+  code 2 for an unfixed upgrade) — flags runs where a human should look before merging
+  (a test file was touched to get green, the run was unverifiable, or a `--max-tokens`
+  budget was hit).
+- `--max-tokens`: hard cap on total tokens spent by the fix loop. Stops the loop and
+  flags `needsReview` instead of silently overspending.
+- `--report-file <path>`: persist a JSON report (schema-versioned) of the run(s).
+- GitHub Action: PR draft/label updates driven by `needsReview`, new `review-label`
+  input (default `needs-review`), and `report-file` input.
+- Parser unit tests for the 7 ecosystems that had none: npm, pnpm, pip, uv, pipenv,
+  swiftpm, elm.
+
+### Changed
+- Clarified in the docs and in `EcosystemAdapter.verified`'s own type comment that
+  `verified: true` is a self-reported, one-time manual smoke test by the maintainer —
+  not an automated, CI-backed guarantee.
+
+### Fixed
+- A CI-only flaky test in `checks.test.ts` caused by cross-stream (stdout/stderr)
+  write-ordering not being guaranteed when appended into one combined buffer.
+
+## [0.1.0]
+
+Initial release: single-dependency upgrade via `greenbump <dep>` or the GitHub Action,
+auto-detecting the ecosystem (npm, Yarn, pnpm, pip, Poetry, uv, Pipenv, Cargo, Go
+modules, Bundler, Composer, Gradle, Maven, NuGet, Mix, Pub, Swift Package Manager,
+CocoaPods, Conan, Elm), running the project's build/test, and handing any breakage to
+an AI fix agent (Anthropic/OpenAI-compatible providers) until checks pass again.

package/CONTRIBUTING.md

@@ -0,0 +1,52 @@
+# Contributing
+
+## Setup
+
+```bash
+npm install
+npm run build
+npm test
+```
+
+`npm test` builds the project then runs every `*.test.js` file under `dist/`
+with Node's built-in test runner. Some tests (`git.test.ts`) create real
+temporary git repositories and shell out to the actual `git` binary — no
+mocking — so they need `git` on `PATH` but touch nothing outside `os.tmpdir()`.
+
+## Adding or fixing an ecosystem adapter
+
+Each package manager lives in its own file under
+`src/engine/ecosystems/<id>.ts` and implements the `EcosystemAdapter`
+interface (`src/engine/ecosystems/types.ts`): `detect`, `outdated`, `install`,
+`defaultCheckCommands`.
+
+If you're fixing a parser bug, please:
+1. Reproduce it against the *real* CLI output, not a guessed format — most
+   existing bugs here came from a test fixture that didn't match what the
+   real tool actually prints (e.g. `mix hex.outdated`'s "Only" column, or
+   `pod outdated`'s `(latest version X)` suffix).
+2. Add or update the corresponding case in
+   `src/engine/ecosystems/parsers.test.ts` with a comment explaining the
+   real-world quirk, not just the happy path.
+3. If you have the toolchain installed locally, run the adapter against a
+   throwaway project to confirm `detect`/`outdated`/`install` work end to end
+   before setting `verified: true`.
+
+## Code style
+
+- No unnecessary abstractions — match the size of the existing adapters.
+- Don't add error handling for cases that can't happen; only validate at
+  actual boundaries (parsing untrusted CLI/API output, user-supplied paths).
+- Keep PRs scoped: a parser fix doesn't need to also refactor the adapter
+  around it.
+
+## Reporting a bug in a specific ecosystem
+
+Include:
+- The ecosystem id (`--ecosystem <id>` or auto-detected)
+- The exact manifest/lockfile involved (redact anything private)
+- The raw output of the underlying CLI command that greenbump would have
+  parsed (e.g. `npm outdated --json`, `pod outdated`)
+
+For security issues, see [SECURITY.md](SECURITY.md) instead of opening a
+public issue.

package/README.md

@@ -34,6 +34,40 @@ npx greenbump react
 - **Safe by default.** Works on a fresh git branch, never auto-merges, never edits your lockfile to cheat, never deletes tests to go green.
 - **Bounded cost.** The fix loop is capped (`--max-rounds`) so a hard upgrade can't run away with your tokens.
 
+## When to use greenbump (and when not to)
+
+**✓ Great for:**
+- Minor/patch upgrades with small breaking changes (renamed exports, updated function signatures)
+- Dependency chains where the upgrade path is documented in changelogs
+- Projects with fast, reliable build + test suites that catch regressions
+
+**⚠️ Use caution or manual review:**
+- Major version jumps with architectural changes (e.g., Angular 2 → 3, React 15 → 16)
+- Upgrades that require coordinated changes across multiple dependencies
+- Security patches where you need to audit the fix, not just make tests pass
+- Projects without tests — greenbump can only verify what your suite checks
+
+**✗ Not recommended:**
+- Upgrades that break core framework assumptions (e.g., async/await refactors, build system migrations)
+- Dependencies with runtime-only failures your tests don't cover
+- Scenarios where "tests pass" doesn't mean "the app works" (missing integration tests, flaky suites)
+
+greenbump works best as a first pass on straightforward upgrades. Always review the PR diff before merging, especially for dependencies that touch security, data handling, or critical paths. Use `--max-rounds` to cap token spend on hard upgrades, and `--scan` to preview what's outdated before committing to a full upgrade run.
+
+## How is greenbump different?
+
+| Feature | greenbump | Dependabot | Renovate | Migratowl |
+|---------|-----------|------------|----------|-----------|
+| **Auto-fix breaking changes** | ✓ (LLM edits source) | ✗ (version bump only) | ✗ (version bump only) | ✓ (LLM + sandbox) |
+| **Multi-ecosystem** | ✓ (20+ ecosystems) | ✓ | ✓ | ✗ (Python only) |
+| **Model flexibility** | ✓ (Claude, DeepSeek, OpenAI, custom) | N/A | N/A | ✗ (Claude only) |
+| **Verification** | Your build + tests | GitHub's CI (after PR) | CI after PR | Sandbox + your tests |
+| **Cost model** | Your API key (pay per fix) | Free (GitHub-hosted) | Free (self-host or SaaS) | Your API key |
+| **Batch upgrades** | ✓ (`--all`) | ✓ | ✓ | ✗ |
+| **Best for** | Fast iteration on minor/patch bumps with simple breaking changes | No-touch version bumps, large fleets | Advanced scheduling, auto-merge rules | High-risk major upgrades needing sandbox isolation |
+
+**greenbump is the only tool that combines multi-ecosystem support + actual code fixing + model flexibility.** Dependabot and Renovate excel at *detecting* outdated dependencies and *opening* PRs, but stop there — you still write the fix. Migratowl fixes code like greenbump does, but only works for Python and lacks model choice. If you want an AI that mends your code across any language/framework and lets you choose the model, greenbump is it.
+
 ## Install / Use
 
 ```bash
@@ -62,6 +96,10 @@ npx greenbump
 | `--provider <name>` | Model provider preset (`anthropic`, `openai`, `deepseek`, `groq`, …). |
 | `--model <model>` | Model id for the fix agent (default: per provider). |
 | `--max-rounds <n>` | Cap fix-loop rounds / token spend (default: `15`). |
+| `--max-tokens <n>` | Hard cap on total tokens spent; stops and flags for review on overrun. |
+| `--scan` | List outdated dependencies without upgrading (read-only mode). |
+| `--all` | Upgrade every outdated dependency found. |
+| `--group <name>` | Combine multiple deps into one branch/PR. |
 | `--no-git` | Operate in place instead of on a new branch. |
 | `--pr-body` | Print a ready-to-paste PR body. |
 

package/SECURITY.md

@@ -0,0 +1,38 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please do **not** open a public GitHub issue for security vulnerabilities.
+
+Instead, report it privately via GitHub's
+[private vulnerability reporting](https://github.com/shidesheng0218/greenbump/security/advisories/new)
+(https://github.com/shidesheng0218/greenbump), or by
+emailing the maintainer directly if that's not enabled yet.
+
+Include:
+- A description of the issue and its impact
+- Steps to reproduce
+- The version/commit affected
+
+We'll acknowledge reports as quickly as we can and credit you in the fix
+unless you'd prefer otherwise.
+
+## Scope and known risk areas
+
+greenbump is a CLI/GitHub Action that:
+- Runs shell commands from your project's own package manager (`npm`,
+  `poetry`, `cargo`, etc.) against your working directory.
+- Gives an LLM-driven agent tool access (`read_file`, `write_file`,
+  `search_code`, `run_check`) scoped to the project directory — see
+  `src/agent/fixer.ts`'s `safePath()` for the path-escape guard.
+- Sends your build/test failure output, and optionally dependency changelogs,
+  to the LLM provider you configure (your own API key — nothing is sent to
+  any greenbump-operated server).
+
+If you find a way for the fix agent to escape the project directory, run
+arbitrary commands beyond your configured build/test scripts, or exfiltrate
+data beyond what's needed for the fix loop, that's a valid report.
+
+Vulnerabilities in third-party dependencies (`@anthropic-ai/sdk`, `openai`,
+`commander`, etc.) should be reported upstream, though we're happy to hear
+about them too if they materially affect greenbump.

package/action.yml

@@ -1,7 +1,7 @@
 name: "greenbump"
 description: "Upgrade a dependency and let an AI agent fix the code it breaks, then open a green PR."
 branding:
-  icon: "arrow-up-circle"
+  icon: "refresh-cw"
   color: "green"
 inputs:
   anthropic-api-key:

package/dist/cli.js

@@ -10,6 +10,8 @@ import { formatDuration, printSummaryBox, printBatchSummary } from "./format.js"
 import { listEcosystems } from "./engine/ecosystems/index.js";
 import { exitCodeFor, overallExitCode } from "./exitcode.js";
 import { buildReport, writeReport } from "./report.js";
+import { detectOutdatedAll, WORKSPACE_ROOT } from "./engine/workspace.js";
+import { detectPackageManager } from "./engine/pm.js";
 const program = new Command();
 program
     .name("greenbump")
@@ -35,6 +37,7 @@ program
     .option("--group <name>", "combine multiple deps named on the command line into one branch/PR")
     .option("--fail-fast", "abort a batch on the first hard failure instead of continuing")
     .option("--workspace <path>", "disambiguate a dep that's outdated at different versions in multiple workspace packages")
+    .option("--scan", "list outdated dependencies without upgrading (read-only mode)")
     .action(async (deps, opts) => {
     if (opts.listProviders) {
         console.log("Built-in provider presets:\n" + listProviders());
@@ -46,6 +49,25 @@ program
         console.log("Supported dependency ecosystems:\n" + listEcosystems());
         process.exit(0);
     }
+    if (opts.scan) {
+        const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();
+        const pm = opts.ecosystem || await detectPackageManager(cwd);
+        if (!pm) {
+            console.error(pc.red("✗ Could not detect package manager. Use --ecosystem to specify one."));
+            process.exit(1);
+        }
+        const outdated = await detectOutdatedAll(pm, cwd);
+        if (outdated.length === 0) {
+            console.log(pc.green("✓ All dependencies are up to date."));
+            process.exit(0);
+        }
+        console.log(pc.bold(`Found ${outdated.length} outdated dependencies:\n`));
+        for (const o of outdated) {
+            const loc = o.workspacePath === WORKSPACE_ROOT ? "(root)" : o.workspacePath;
+            console.log(`  ${pc.cyan(o.name)} ${pc.dim(o.current)} → ${pc.green(o.latest)} ${pc.dim(`[${loc}]`)}`);
+        }
+        process.exit(0);
+    }
     const choice = {
         provider: opts.provider,
         model: opts.model,

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,WAAW,CAAC;KACjB,WAAW,CACV,kGAAkG,CACnG;KACA,QAAQ,CAAC,WAAW,EAAE,yGAAyG,CAAC;KAChI,MAAM,CAAC,cAAc,EAAE,wDAAwD,CAAC;KAChF,MAAM,CAAC,gBAAgB,EAAE,uEAAuE,CAAC;KACjG,MAAM,CAAC,kBAAkB,EAAE,+EAA+E,CAAC;KAC3G,MAAM,CAAC,mBAAmB,EAAE,oCAAoC,CAAC;KACjE,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;KAC9E,MAAM,CAAC,kBAAkB,EAAE,+CAA+C,CAAC;KAC3E,MAAM,CAAC,mBAAmB,EAAE,8DAA8D,CAAC;KAC3F,MAAM,CAAC,iBAAiB,EAAE,oDAAoD,CAAC;KAC/E,MAAM,CAAC,kBAAkB,EAAE,0DAA0D,CAAC;KACtF,MAAM,CAAC,iBAAiB,EAAE,qDAAqD,CAAC;KAChF,MAAM,CAAC,kBAAkB,EAAE,yCAAyC,CAAC;KACrE,MAAM,CAAC,kBAAkB,EAAE,wCAAwC,EAAE,IAAI,CAAC;KAC1E,MAAM,CAAC,kBAAkB,EAAE,uFAAuF,CAAC;KACnH,MAAM,CAAC,UAAU,EAAE,+CAA+C,CAAC;KACnE,MAAM,CAAC,WAAW,EAAE,4CAA4C,CAAC;KACjE,MAAM,CAAC,sBAAsB,EAAE,gDAAgD,CAAC;KAChF,MAAM,CAAC,OAAO,EAAE,yCAAyC,CAAC;KAC1D,MAAM,CAAC,gBAAgB,EAAE,oEAAoE,CAAC;KAC9F,MAAM,CAAC,aAAa,EAAE,+DAA+D,CAAC;KACtF,MAAM,CAAC,oBAAoB,EAAE,yFAAyF,CAAC;KACvH,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IAC3B,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,8BAA8B,GAAG,aAAa,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC;QAClG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,oCAAoC,GAAG,cAAc,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CACX,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC;YAC7B,mEAAmE,CACtE,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACxE,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACtE,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACtE,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC,CAAC;QACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE;QACxB,MAAM,OAAO,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QACvE,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG;QACf,GAAG;QACH,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;QACvC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QACpE,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,KAAK;QACzB,KAAK,EAAE,GAAG;KACX,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QAEjD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC;gBACjC,GAAG,QAAQ;gBACX,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;gBACjC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YAEH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAE1C,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC;YACxB,GAAG,QAAQ;YACX,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACZ,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC,CAAC;QAEH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAExC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,EAAE,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,WAAW,CAAC;KACjB,WAAW,CACV,kGAAkG,CACnG;KACA,QAAQ,CAAC,WAAW,EAAE,yGAAyG,CAAC;KAChI,MAAM,CAAC,cAAc,EAAE,wDAAwD,CAAC;KAChF,MAAM,CAAC,gBAAgB,EAAE,uEAAuE,CAAC;KACjG,MAAM,CAAC,kBAAkB,EAAE,+EAA+E,CAAC;KAC3G,MAAM,CAAC,mBAAmB,EAAE,oCAAoC,CAAC;KACjE,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,CAAC;KAC9E,MAAM,CAAC,kBAAkB,EAAE,+CAA+C,CAAC;KAC3E,MAAM,CAAC,mBAAmB,EAAE,8DAA8D,CAAC;KAC3F,MAAM,CAAC,iBAAiB,EAAE,oDAAoD,CAAC;KAC/E,MAAM,CAAC,kBAAkB,EAAE,0DAA0D,CAAC;KACtF,MAAM,CAAC,iBAAiB,EAAE,qDAAqD,CAAC;KAChF,MAAM,CAAC,kBAAkB,EAAE,yCAAyC,CAAC;KACrE,MAAM,CAAC,kBAAkB,EAAE,wCAAwC,EAAE,IAAI,CAAC;KAC1E,MAAM,CAAC,kBAAkB,EAAE,uFAAuF,CAAC;KACnH,MAAM,CAAC,UAAU,EAAE,+CAA+C,CAAC;KACnE,MAAM,CAAC,WAAW,EAAE,4CAA4C,CAAC;KACjE,MAAM,CAAC,sBAAsB,EAAE,gDAAgD,CAAC;KAChF,MAAM,CAAC,OAAO,EAAE,yCAAyC,CAAC;KAC1D,MAAM,CAAC,gBAAgB,EAAE,oEAAoE,CAAC;KAC9F,MAAM,CAAC,aAAa,EAAE,+DAA+D,CAAC;KACtF,MAAM,CAAC,oBAAoB,EAAE,yFAAyF,CAAC;KACvH,MAAM,CAAC,QAAQ,EAAE,+DAA+D,CAAC;KACjF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IAC3B,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,8BAA8B,GAAG,aAAa,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC;QAClG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,oCAAoC,GAAG,cAAc,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACzD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC,CAAC;YAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,MAAM,2BAA2B,CAAC,CAAC,CAAC;QAC1E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,CAAC,CAAC,aAAa,KAAK,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAC5E,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CACX,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC;YAC7B,mEAAmE,CACtE,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACxE,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACtE,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACtE,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC,CAAC;QACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE;QACxB,MAAM,OAAO,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QACvE,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG;QACf,GAAG;QACH,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;QACvC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QACpE,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,KAAK;QACzB,KAAK,EAAE,GAAG;KACX,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QAEjD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC;gBACjC,GAAG,QAAQ;gBACX,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;gBACjC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YAEH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAE1C,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC;YACxB,GAAG,QAAQ;YACX,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACZ,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC,CAAC;QAEH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAExC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,EAAE,CAAC"}

package/examples/greenbump.yml

@@ -0,0 +1,37 @@
+# Copy this to .github/workflows/greenbump.yml in your repo.
+# Example GitHub Actions workflow for greenbump
+# See https://github.com/shidesheng0218/greenbump for full documentation
+name: greenbump
+
+on:
+  schedule:
+    - cron: "0 6 * * 1" # every Monday 06:00 UTC
+  workflow_dispatch: # or run it by hand, optionally naming a dependency
+    inputs:
+      dependency:
+        description: "Dependency to upgrade (blank = most outdated)"
+        required: false
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  bump:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - run: npm ci
+
+      - uses: shidesheng0218/greenbump@v0
+        with:
+          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+          dependency: ${{ inputs.dependency }}
+          # Optional: use a PAT instead of the default token if you want
+          # the generated PR to trigger your CI workflows.
+          # github-token: ${{ secrets.GREENBUMP_PAT }}

package/examples/legacy-repo/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "legacy-repo",
+  "version": "1.0.0",
+  "description": "Sample repo with a deliberately outdated dependency, for greenbump e2e testing.",
+  "private": true,
+  "scripts": {
+    "test": "node test.js"
+  },
+  "dependencies": {
+    "uuid": "3.4.0"
+  }
+}

package/examples/legacy-repo/test.js

@@ -0,0 +1,17 @@
+const assert = require("node:assert");
+const { newId } = require("./src/id.js");
+
+// A real test that asserts behaviour — greenbump must NOT weaken this to pass.
+const id = newId();
+assert.strictEqual(typeof id, "string", "id must be a string");
+assert.match(
+  id,
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,
+  "id must be a valid UUID",
+);
+
+const a = newId();
+const b = newId();
+assert.notStrictEqual(a, b, "ids must be unique");
+
+console.log("ok - newId() returns unique valid UUIDs");

package/examples/multi-file-repo/models/todo.js

@@ -0,0 +1,8 @@
+// Breaks on uuid v7+: the `uuid/v4` subpath import was removed.
+const uuidv4 = require("uuid/v4");
+
+function createTodo(title) {
+  return { id: uuidv4(), title, done: false };
+}
+
+module.exports = { createTodo };

package/examples/multi-file-repo/models/user.js

@@ -0,0 +1,11 @@
+// Breaks on uuid v7+: the `uuid/v4` subpath import was removed.
+// Note the different local name (`generateId`) from models/todo.js —
+// a fix agent that patches one call site and re-runs tests will only
+// see this one break AFTER fixing todo.js, one at a time.
+const generateId = require("uuid/v4");
+
+function createUser(name) {
+  return { id: generateId(), name };
+}
+
+module.exports = { createUser };

package/examples/multi-file-repo/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "multi-file-repo",
+  "version": "1.0.0",
+  "description": "Sample repo where one dependency upgrade breaks 3 separate files, for greenbump e2e testing of search_code.",
+  "private": true,
+  "scripts": {
+    "test": "node test.js"
+  },
+  "dependencies": {
+    "uuid": "3.4.0"
+  }
+}

package/examples/multi-file-repo/services/session.js

@@ -0,0 +1,9 @@
+// Breaks on uuid v7+: the `uuid/v4` subpath import was removed.
+// Yet another local name (`newUUID`) — third independent call site.
+const newUUID = require("uuid/v4");
+
+function startSession(userId) {
+  return { token: newUUID(), userId, startedAt: Date.now() };
+}
+
+module.exports = { startSession };

package/examples/multi-file-repo/test.js

@@ -0,0 +1,19 @@
+const assert = require("node:assert");
+const { createTodo } = require("./models/todo.js");
+const { createUser } = require("./models/user.js");
+const { startSession } = require("./services/session.js");
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+
+const todo = createTodo("write tests");
+assert.match(todo.id, UUID_RE, "todo id must be a valid UUID");
+assert.strictEqual(todo.title, "write tests");
+
+const user = createUser("ada");
+assert.match(user.id, UUID_RE, "user id must be a valid UUID");
+
+const session = startSession(user.id);
+assert.match(session.token, UUID_RE, "session token must be a valid UUID");
+assert.strictEqual(session.userId, user.id);
+
+console.log("ok - todo, user, and session all generate valid UUIDs");

package/package.json

@@ -1,16 +1,11 @@
 {
   "name": "greenbump",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Upgrade a dependency and let an AI agent fix the code it breaks — until CI is green. The Renovate that actually mends your code.",
   "type": "module",
   "bin": {
     "greenbump": "dist/cli.js"
   },
-  "files": [
-    "dist",
-    "action-dist",
-    "action.yml"
-  ],
   "engines": {
     "node": ">=20"
   },