Maintenancemanual triggermarkdown-export Hardened

Dependency Upgrade Safety Loop

A dependency maintenance loop that treats install-time scripts and major-version changes as risk boundaries.

Use loop copies the kickoff prompt. Copy Markdown and Download loop include the complete Markdown page with context, source attribution, anchors, and guardrails. Cursor / Claude Code buttons prepare the shorter kickoff prompt only.

Run shape

Supported agents

Claude CodeCodexGemini CLIOpenCode

Goal

Upgrade dependencies without breaking the app or ignoring supply-chain risk.

Feedback gate

pnpm build

Stop condition

Selected dependency batch is upgraded and validation passes.

Do not weaken, skip, delete, or rewrite the validation command to force success.

Do not claim completion until the stated exit condition is actually satisfied.

If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.

Required context

Give the agent these inputs before it starts the loop. This keeps discovery bounded and prevents vague retries.

Allowed upgrade scope.

Package manager.

Validation commands.

Required tools

The loop assumes these commands or integrations are available. Missing tools should be reported as blockers, not ignored.

package manager

build/test commands

How to run

Two separate pieces: the kickoff prompt starts the loop, while the downloaded Markdown carries the complete reference page.

1. Copy or download

Use the kickoff for a fast agent run. Download the full Markdown when you need source, context, and attribution in one file.

2. Paste into the agent

Start a fresh agent session in the target repo and provide the requested project context if the loop asks for it.

3. Let it self-pace

The agent should act, check evidence, retry only when the gate fails, and stop at the stated exit condition.

manual triggerMaintenance Step flow

Manual start

Inspect install scripts

Pick a small batch

Update and verify

Document risk

Feedback gate

Goal complete with evidence

not done → return to next actiondone → exit condition met

Action checklist

The diagram shows the order. This checklist keeps only the action, command, and failure handling needed during a real pass.

1. Inspect install scripts

Review package scripts before installing or updating dependencies.

cat package.json

2. Pick a small batch

Group patch/minor updates separately from major upgrades.

3. Update and verify

Apply updates and run build/tests.

pnpm build

4. Document risk

List remaining major upgrades and migration notes.

Kickoff prompt

This is the text copied by Use loop. It is intentionally shorter than the Markdown export.

Upgrade dependencies in small safe batches, review install-time scripts, run build/tests after each batch, and document remaining breaking changes.
Goal: Upgrade dependencies without breaking the app or ignoring supply-chain risk.
Check command: pnpm build
Exit condition: Selected dependency batch is upgraded and validation passes.
Max iterations: 5
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Do not blindly install packages without reviewing install/postinstall/prepare scripts.

Quality

87/100

Safety

92/100

Expected output

A batch upgrade report with validation evidence and remaining risky packages.

Related loops

Browse all

Securitymanual trigger Hardened

npm Audit Fix Loop

Review npm audit findings, apply safe upgrades, and verify the app still builds and tests.

Claude CodeCodexGemini CLIOpenCode

npm-auditdependenciessecurity

Kickoff preview

Run audit, review safe remediation paths, update targeted dependencies, verify build/tests, and report remaining vulnerability risk.
Goal: Remediate actionable vulnerabilities without unsafe forced upgrades.
Check command: npm audit --audit-level=high
Exit condition: No high/critical audit findings remain, or remaining findings are documented with blockers.
Max iterations: 5
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Do not run force upgrades without explaining breaking-change risk and receiving approval.

View

Testingmanual trigger Hardened

Build Until Passing

Run the production build, fix compile/runtime bundling failures, and stop only when the build succeeds.

CursorClaude CodeCodex

buildproductionvitenextjs

Kickoff preview

Run the production build, fix root causes while preserving project architecture, and repeat until the build passes.
Goal: Make the production build succeed for the target runtime.
Check command: pnpm build
Exit condition: The production build command exits successfully.
Max iterations: 6
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Do not hide build failures with dynamic imports or environment checks unless that is the correct runtime boundary.

View

Securityevent trigger Hardened

Pre-Commit Guard

Before committing, run diff hygiene, secrets checks, and the closest validation command.

Claude CodeCodexGemini CLIOpenCode

pre-commitsecuritygit

Kickoff preview

Before committing, inspect the staged diff, scan for secrets/debug flags, run relevant validation, and only commit if the guard passes.
Goal: Block commits that contain secrets, debug switches, or unverified broken code.
Check command: git diff --cached --check
Exit condition: Staged diff is clean, no obvious secrets/debug flags are present, and relevant validation passes or is explained.
Max iterations: 3
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Do not commit secrets, local env files, debug flags, or generated private artifacts.

View

CImanual trigger Hardened

Ship PR Until Green

Implement a scoped change, open or update a pull request, inspect CI, and continue until all required PR checks pass.

CursorClaude CodeCodex

pull-requestcigithub-actionsverification

Kickoff preview

Take this branch to a green pull request. Implement the requested change, run local verification, open or update the PR, run `gh pr checks`, inspect failures, fix root causes, and repeat until every required check passes or you hit the iteration cap.
Goal: Open or update a pull request and stop only when all required PR checks are green.
Check command: gh pr checks
Exit condition: All required pull request checks are successful and the PR is ready for review or merge.
Max iterations: 10
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Do not disable required checks, edit loops to skip jobs, or remove tests to make CI green.
- Do not merge the PR unless the user explicitly asked for merge authority.

View