open source · apache-2.0
Detect upstream API breaking changes and Dependabot-style dependency updates — then open PRs that fix your TypeScript/JavaScript codebase.
Package is @patch-dev/cli. If npx patch hits the unrelated npm package, use npx -y --package=@patch-dev/cli patch init.
@@ demo @@
From upstream break to a reviewed fix — connectors, classification, and the agentic loop in one pass. Raw MP4 on GitHub →
@@ two jobs, one bot @@
Same scan → classify → PR/Issue pipeline. One bot for SDK surface changes and for npm version/security updates.
OpenAPI diffs, package .d.ts diffs, and doc scrape feed an agentic fix loop with validation and confidence ceilings — then a PR or Issue.
Watches npm package.json dependencies. Patch + minor bumps by default; majors opt-in. OSV advisories raise confidence so security bumps land as PRs.
@@ how it works @@
Connectors watch API sources and npm deps. Scanners map API changes onto call sites; dependency updates bump package.json. An agentic fix loop proposes, validates, and revises — then the GitHub App opens a PR or Issue by confidence.
patch init → detect API deps + languages → config + Action + App install │ ▼ (on schedule) connector fetch → diff snapshot → classify (ChangeEvent) → map FixInstruction → LanguageScanner(s) / package.json → agentic fix loop (propose → validate → revise ≤3) → confidence ≥ threshold? PR : Issue → update snapshot
change event types
@@ bring your own model @@
Classify and fix call a pluggable provider. Config stores provider and api_key_env only — never the key. patch init asks which to use; patch scan fails fast if that env var is missing.
Set provider: "anthropic" and api_key_env: "ANTHROPIC_API_KEY".
Set provider: "openai" and api_key_env: "OPENAI_API_KEY".
@@ connectors @@
Downstream stages do not special-case connector types. API sources and dependency updates share the same classify → fix → publish path.
openapi-diff
Formal OpenAPI JSON/YAML. Structural contract diffs with the highest signal.
reliability · highest
package-diff
npm/PyPI plus .d.ts signatures. Exact surface-area comparison.
reliability · high
dependency-update
npm registry + OSV advisories. Dependabot-style version and security bumps for package.json.
reliability · high
doc-scrape
HTML docs with no formal spec. The LLM carries more of the burden.
reliability · lower
@@ quick start @@
The bin is named patch. The npm package is @patch-dev/cli. Confirm connectors (including dependency-update when a package.json exists), pick a model provider, install the GitHub App, and let scheduled scans open PRs.
# In your TS/JS repo npx patch init npx patch scan --dry-run # If npx patch hits the wrong package: npx -y --package=@patch-dev/cli patch init # Required: ANTHROPIC_API_KEY or OPENAI_API_KEY # (matches patch.config.json → model.api_key_env) # Optional: GITHUB_TOKEN or the Patch GitHub App # Without it, reports land in .patch/reports/
@@ confidence @@
Above confidence_threshold (default 0.7) → PR via the GitHub App (or GITHUB_TOKEN). Below → Issue with the same diagnosis. You always review before it merges.
confidence, capped by validation
confidence gate
@@ open source @@
Patch is open source under Apache-2.0 — the CLI, connectors, scanners, PR templates, and schemas. Run it yourself, fork it, or use hosted scheduling when you'd rather not operate the pipeline.
Everything you need to detect breaks, bump deps, and propose fixes ships in the open.
Cross-customer scheduler, billed model calls, and certified connector packs for APIs without formal specs.
@@ known mvp limitations @@
Call-site scanning ships for TypeScript/JavaScript; other language scanners detect the repo but do not yet match call sites. Dependency updates are npm-only. Dynamic import() is not scanned; the PyPI registry path is stubbed.