Epic: Buddy Bot next-gen — feature parity with Pullfrog & CodeRabbit (and beyond)

Buddy Bot is today a fast, Bun-native dependency-update bot (Renovate/Dependabot alternative). This epic tracks the roadmap to evolve it into an AI-native dependency & PR automation platform that reaches feature parity with — and surpasses — the two strongest products in the adjacent space:

• Pullfrog (docs) — open-source, model-agnostic AI coding-agent bot that runs inside your own GitHub Actions. Strengths: BYOK model-agnosticism, secure agent runtime (prompt-injection defense, sandboxing, OIDC tokens), CI auto-fix, issue enrichment, persistent repo/PR learnings, purpose-built GitHub toolbelt.
• CodeRabbit (docs) — AI code-review platform. Strengths: PR summaries/walkthroughs/line comments, ~60 auto-orchestrated linters/SAST tools, finishing touches (docstrings, unit tests, autofix, fix-ci), pre-merge checks & post-merge actions, learnings with governance, scheduled reports, multi-platform (GitHub/GitLab/Azure DevOps/Bitbucket).

Neither product does dependency updates. That is our moat: Buddy Bot keeps its best-in-class dependency engine and adds the AI review/agent layer both competitors sell — open-source, Bun-fast, runs in your own Actions, model-agnostic.

Strategy

1. Pay down foundation debt first — several shipped features are placeholders (auto-merge, dashboard checkboxes, dead config). AI features built on a fragile base will amplify the fragility.
2. Build the AI foundation once — a provider-agnostic LLM layer and a secure agent runtime, then every AI feature (review, fix-ci, planning, major upgrades) composes on top.
3. Differentiate, don't just chase — AI-assisted major version upgrades (changelog-driven breaking-change analysis + codemods + CI-verified fix loops) is something neither Pullfrog nor CodeRabbit offers and is the natural fusion of our dependency engine with an agent runtime.

Phase 0 — Foundation & debt (milestone: v1.0 Foundation)

These unblock everything else and fix promises the README already makes.

• #1368 Structured PR metadata manifest (kill regex body round-tripping)
• #1369 Implement functional auto-merge
• #1370 Make dashboard interactive controls & pinning actually work
• #1371 Honor dead config options (packages.pin, PR templates, releaseNotes.*)
• #1372 Finish half-built ecosystems: Zig updates, pantry.lock, resolution-drift

Phase 1 — AI foundation (milestone: AI Foundation)

• #1373 Model-agnostic AI provider layer (BYOK: Anthropic, OpenAI, Google, OpenRouter, custom endpoints)
• #1374 Secure agent runtime in GitHub Actions (sandbox, prompt-injection defense, permission tiers, toolbelt)

Phase 2 — AI review parity (milestone: AI Review Parity)

• #1375 AI PR review engine (summaries, walkthroughs, line comments, incremental re-review, profiles)
• #1376 @buddy-bot comment commands & conversational chat
• #1377 Custom review instructions: path filters, path instructions, code-guidelines ingestion
• #1378 Static-analysis orchestration (generalize src/security/ into a multi-tool engine)
• #1379 Learnings & memory system (repo-, PR-, and org-level)
• #1380 Finishing touches: docstring gen, unit-test gen, autofix, simplify
• #1381 CI failure analysis & auto-fix (fix-ci)
• #1382 Pre-merge checks & post-merge actions
• #1383 Issue enrichment: planning, auto-labeling, duplicate detection

Phase 3 — Dependency-engine excellence (milestone: Dependency Engine v2)

• #1384 packageRules engine (Renovate-class matchers with per-rule overrides)
• #1385 New ecosystems: Python, Rust, Go, Ruby
• #1386 Docker registry expansion (GHCR/ECR/GCR/private) + OSV coverage for Actions & Docker
• #1387 Runtime plugin & notification system (Slack/Discord/Jira/webhooks on real events)
• #1388 AI-assisted major upgrades (the differentiator) — supersedes/implements #132, relates #108 #107
• #1389 Reporting & metrics: scheduled and on-demand natural-language reports

Phase 4 — Platform reach (milestone: Platform Reach)

• #1390 Extract a real GitProvider abstraction (unblocks #115 GitLab, #116 Bitbucket)
• #1391 Local CLI review mode + headless action with structured output

Existing issues folded into this plan

• #132 Automated major upgrades → #1388
• #108 Sniff deprecated deps → largely shipped (src/services/deprecated-dependencies-checker.ts); dashboard surfacing tracked in #1370
• #107 Bump engines → #1384 (rule engine makes engines a managed dep type) and #1385
• #117 pnpm catalogs → #1385 scope
• #115 GitLab / #116 Bitbucket → unblocked by #1390

Dependency graph (build order)

Phase 0:  I01 ──▶ I02, I03          I04, I05 independent
Phase 1:  I06 ──▶ I07
Phase 2:  I07 ──▶ I08 ──▶ I09, I10, I12, I15
          I07 ──▶ I13, I14, I16     I11 independent (feeds I08)
Phase 3:  I17, I18, I19, I20 independent
          I06+I07+I14 ──▶ I21       I06 ──▶ I22
Phase 4:  I23 independent           I06 ──▶ I24

Parallelizable: within each phase, issues without an arrow between them can be implemented concurrently by separate agents.

Guiding principles for implementers

1. Bun-native: use Bun.file, Bun.YAML, bun:test, fetch — no Node-only APIs (see CLAUDE.md).
2. Config-first: every feature gets typed options in BuddyBotConfig (src/types.ts), defaults in src/config.ts, validation in src/config-validation.ts, and docs in docs/.
3. No dead config: an option merged without a consumer is a bug (this epic exists partly because of that).
4. Graceful degradation: AI features must no-op cleanly when no API key is configured; the dependency bot must keep working with zero AI setup.
5. Security posture: follow Pullfrog's architecture — untrusted content (issue/PR bodies) reaches the model only as marked tool output, never inlined into prompts; secrets are allowlisted, never blanket-exposed (reference).
6. Tests: every issue lists acceptance criteria; each needs bun:test coverage for success, failure, and edge cases (see test/ conventions).
7. Lint with pickier (bunx --bun pickier . --fix), never eslint directly.

Competitor reference index

Research sources: Pullfrog docs index, CodeRabbit docs, CodeRabbit config reference, Pullfrog security, Pullfrog tools.

Status: Phases 0–4 complete

Every planned issue under this epic is now closed. Final state: 1,710 tests passing, tsc --noEmit and pickier clean, 12 commits on main.

Closed this cycle

Where the moat now sits

Pullfrog and CodeRabbit do not do dependency updates. That engine now spans 12 ecosystems with an adapter interface making the thirteenth a module rather than a branch, and every registry that speaks OCI. The review/agent layer that was the parity gap is closed: reviews, commands, gates, CI fixing, major-upgrade migration, local CLI review, headless pipeline steps.

Deliberately not attempted

• Stacked PRs for finishing touches (from #1394) — needs sandbox verification before it is safe to commit agent output onto a contributor's branch.
• pnpm catalogs, engines, overrides/resolutions (from #1385) — JS-side, independent of the adapter work, now small well-scoped tasks. Noted on #1385, #117 and #107.
• Base-image EOL awareness (from #1386).

Newly unblocked

#115 (GitLab) and #116 (Bitbucket) are now 'implement the interface and pass the conformance suite', with a checklist on each.

One principle worth keeping

The recurring rule across all of this: a check that could not run must never read as one that succeeded. AI gates return neutral rather than pass; analyzers report themselves skipped; reports name what they omitted; lockfiles that could not be regenerated say so in the PR. The alternative — silence — is what turns a safety net into decoration.

Complete — including everything previously deferred

Every issue under this epic is closed, and the three items I had explicitly left unbuilt are now built.

Since the last update

Final state

1,776 tests passing, tsc --noEmit and pickier clean, 14 commits on main.

What remains open

Only #115 (GitLab) and #116 (Bitbucket), both unblocked with a checklist, and the dashboard issue #3 which the bot maintains itself.

The principle that shaped this

Every safety decision here came back to the same rule: a thing that could not be verified must never be presented as verified. AI gates return neutral rather than pass. Analyzers report themselves skipped. Reports name what they omitted. Lockfiles that could not be regenerated say so in the PR. A finishing touch whose tests failed comes back as suggestions, not a branch. A repository with no test script is recorded as having declined verification, not failed it.

The alternative — silence — is what turns a safety net into decoration, and it is the failure mode that would have been easiest to ship without noticing.

Complete

Every issue under this epic is closed, including GitLab (#115) and Bitbucket (#116) — the last two, which the abstraction work had unblocked.

Final state: 1,856 tests passing, tsc --noEmit and pickier clean, 17 commits on main.

Where this ended up

Pullfrog and CodeRabbit do not do dependency updates. That engine now spans 12 ecosystems behind an adapter interface, every registry that speaks OCI, and three hosting platforms. The review and agent layer that was the parity gap is closed end to end: reviews, commands, gates, CI fixing, major-upgrade migration with real release-span notes, local CLI review, headless pipeline steps, and stacked pull requests for finishing touches.

The last stretch validated the design

The provider abstraction (#1390) was built before there was a second provider, which is usually where that kind of work goes wrong. It held: implementing GitLab and Bitbucket was writing two classes against a documented contract and making a conformance suite pass. Better, Bitbucket forced two new capabilities into existence — reopenPullRequests and labels — because a declined Bitbucket pull request is final and Bitbucket has no labels. Those became flags rather than silent no-ops, and the one call site that reopens now checks before looking.

The fake-API tests earned their keep immediately, catching two bugs a hand-written stub would have hidden: a GitLab DELETE returning an empty body being parsed as JSON, and Bitbucket returning file contents as plain text.

The principle underneath all of it

Every safety decision came back to the same rule: a thing that could not be verified must never be presented as verified. AI gates return neutral rather than pass. Analyzers report themselves skipped. Reports name what they omitted. Lockfiles that could not be regenerated say so in the pull request. A finishing touch whose tests failed comes back as suggestions, not a branch. A repository with no test script is recorded as having declined verification, not failed it. Bitbucket declines a draft rather than faking one with a title prefix.

Silence is what turns a safety net into decoration, and it is the failure mode that would have been easiest to ship without noticing.