Codebase Doctor

THE PROBLEM: Major dependency upgrades get put off. A bot can open the version bump, but a developer still has to find every place the package is used, work out which breaking changes actually apply, change the code, fix the tests, run lint, tests and build, and explain it all in a pull request. AI assistants can edit code quickly, but teams rarely trust an unsupervised change across dozens of files. So the upgrade waits until a security fix or a deadline forces it. WHAT IT IS: Codebase Doctor is an IBM Bob 2.0 skill (migration-doctor) and a local MCP server with 12 tools. It is for developers and engineering leads who maintain JavaScript and TypeScript codebases and want upgrades that are fast, supervised and provable. Today's golden path is React 17 to 18. HOW YOU USE IT: In IBM Bob you type one sentence: "Upgrade react to 18.3.1 in [your repo]". Codebase Doctor then: •⁠ ⁠scans the whole package family (react, react-dom and their subpaths) with an AST, listing every import and API call with file and line, and checks peer ranges before installing; •⁠ ⁠keeps only the breaking changes that apply to this code, and ranks files by risk from concrete API evidence; •⁠ ⁠writes an ordered plan in Bob's Plan mode, and stops; •⁠ ⁠after you type "approved", applies one commit per step: codemods where they are safe, judgement calls marked for you, failed steps rolled back; •⁠ ⁠runs your repository's own lint, test and build scripts, keeps every run, and loops on failures; •⁠ ⁠opens a pull request only when the checks pass on the pushed commit, with the full report as its description. Bob shows the report as an artifact throughout. WHAT MAKES IT DIFFERENT: •⁠ ⁠The human gate is enforced by the server, not requested in a prompt. The branch, patch and pull-request tools refuse to run until you approve, and the approval is bound to a hash of the plan's content: change the plan and it needs a new "approved". •⁠ ⁠Proof, not promises: success means your own checks passed on the new versions, not that the model says so. •⁠ ⁠Honest reporting. Every number is labelled measured, estimated or not measured, and session files are HMAC-sealed, so a hand-edited "passed" result is shown as untrusted. •⁠ ⁠It runs on your machine. Only the verified branch is pushed. DOES IT WORK? In a recorded end-to-end run on a React 17 app, with real npm install, ESLint, Jest and esbuild runs: 11 files used react, 9 needed attention and 4 were high-risk; a peer conflict was caught before install; the first verification failed on a deprecated call and a batching-sensitive test, and the second passed after the fixes; the pull request went to a local GitHub sandbox. 241 automated tests cover the server. Demo and step-by-step replay: codebase-doctor-bob2.vercel.app