UpgradeGuard installs the new version in an isolated copy of your project, runs your real tests against it, and tells you exactly what will break and why — before you ever touch your main branch.
Detection and rehearsal run instantly with no AI involved. Only the repair step calls on Bob — and only for dependencies that actually need it.
Reads your manifest and lockfile, checks the npm registry and audit data, and flags every outdated, deprecated, or vulnerable dependency.
Creates an isolated git worktree per dependency, installs the target version for real, and runs your actual test suite against it.
For anything that broke, Bob finds where it's used, explains the real breaking change, and writes a fix — inside its own branch only.
The fix is re-tested against your real suite before it's ever marked safe. Nothing is called "fixed" without a rerun proving it.
The expensive, deterministic work never touches an AI model. Bob is only called in for the one thing scripts can't do: understanding why something broke.
No Bobcoins, no network dependency beyond the public npm registry
scan.js Dependency + advisory scan via the npm registry and audit APIsrehearse.js Real install + real test run per dependency, in an isolated git worktreemerge-reports.js Deterministic assembly of the final risk reportgit worktree Isolation so parallel rehearsals never collide on diskOnly for dependencies rehearse.js already flagged risky
Usage Analyst Explore subagent — finds real call sites in your codeBreaking-Change Analyst Reads the actual changelog, cites the real causeFix Agent Writes and applies the patch inside its own worktree branchIBM Bob 2.0 Agent mode + parallel subagents, isolated per dependencyThese buttons run the real scripts against this project right now — not a simulation.