PatchFlow
Turn third-party SDK changes into evidence-backed, test-gated draft pull requests.
PatchFlow watches npm packages, gathers the best migration evidence available, asks a cloud coding agent to update a consumer repository, and proves the result with GitHub Checks or a local test gate.
Humans still decide what merges. PatchFlow stops at a draft pull request labeled patchflow:ready or patchflow:needs-attention.
detect update → collect evidence → migrate call sites
→ open draft PR → run required checks → human reviewWhy PatchFlow
Dependency bots are good at finding version drift. Breaking upgrades still leave engineers reading release notes, locating call sites, rewriting integrations, and waiting for CI. PatchFlow owns that middle mile.
- Structured playbooks when PatchFlow knows the migration
- Upstream release notes when an exact release is available
- Explicit inference when structured evidence is unavailable
- Fail-closed setup and tests before a PR is marked ready
- Budgets, cooldowns, allowlists, and bounded retries
Start here
| If you want to… | Read |
|---|---|
| See the complete loop in five minutes | Quickstart |
| Understand what the agent is allowed to do | Migration lifecycle |
| Configure CI as the source of truth | Test gates |
| Run unattended watch mode | Production operation |
What it is not
PatchFlow is not an auto-merge system, a general-purpose coding agent, or a guarantee that release notes are complete. It narrows an upgrade task, records the evidence used, and presents a tested change for review.
A green gate proves the configured checks passed. It does not prove that untested behavior is correct.