Reference
Data models & lifecycle
Field and enum names below match the actual database schema — this is documentation of what exists, not an aspirational API design.
Repository model
Each connected repository tracks its GitHub identity, default branch, whether it's private, a coverage status, and when it was last scanned.
API change model
A detected upstream change records its provider, a deduplication fingerprint, change type, severity, whether it's breaking, the affected resource/operation/field, effective and deprecation dates, its source and confidence, and its own lifecycle status:
| DETECTED | Persisted, not yet analyzed against any repository. |
| CONFIRMED | At least one repository was confirmed affected. |
| ANALYZED | Impact analysis has completed for this change. |
| ACTION_REQUIRED | At least one impact scored High or Critical risk. |
| MIGRATION_IN_PROGRESS | A migration attempt has been queued. |
| RESOLVED | Every current affected impact has post-merge proof or fresh evidence that its source is no longer affected. A Draft PR alone does not resolve the change. |
| IGNORED | Manually dismissed by a human — never set automatically. |
Finding model
A finding is a specific, actionable call site: the file, line, symbol, the detected and target SDK versions, a description of the breaking change, and a status — open, patched_by_shim (legacy), pr_opened, or resolved.
Migration lifecycle
| QUEUED | Accepted into the migration worker's queue. |
| SCANNING | Cloning and re-scanning the repository. |
| GENERATING | Generating the migration patch. |
| VALIDATING | Running deterministic AST, safety, and re-scan gates; repository commands run only in an explicitly enabled isolated sandbox. |
| BLOCKED | Validation failed, or a safety constraint stopped it. |
| PR_CREATED | Manual mode: a validated Draft pull request is open and waiting for human review in GitHub. |
| WAITING_FOR_CHECKS | Automatic mode: the migration PR is waiting for required GitHub CI checks. |
| CI_REPAIRING | Automatic mode: required CI failed and Shimpilot is running a bounded autonomous repair cycle before rechecking CI. |
| READY_TO_MERGE | Automatic mode: every current merge gate passed and the PR is ready for the guarded merge step. |
| MERGED | GitHub reports the migration merged; source-level verification has not finished yet. |
| POST_MERGE_VERIFYING | Shimpilot is rescanning the merged default branch and proving the original breaking usages are gone. |
| COMPLETED | The merged migration passed post-merge verification. |
| FAILED | An unrecoverable error occurred. |
Provider support
See the provider matrix on the homepage for current support status by provider and category.
Current adapters cover specific Stripe JavaScript/TypeScript, OpenAI Node.js/Python, reviewed Supabase JavaScript/TypeScript v1→v2 auth, returned-row mutation, and Realtime patterns. Automatic mode may draft simple literal createClient option moves, but a human must merge. Other Supabase rules remain Manual-only: auth response shapes, SELECT RLS policies, and subscription workflows need application review. Anthropic support detects retired literal Claude model IDs in Node.js and Python and can prepare a validated Manual Draft PR with the officially recommended replacement. It always requires human review because model behavior, token limits, tools, prompts, and response handling can change. Release feeds are informational until a reviewed rule and a current repository scan confirm impact. Findings and migration eligibility depend on implemented, reviewed rules. Other calls can appear in the dependency map without a compatibility classification; absence of a finding does not prove complete provider compatibility.
AWS JavaScript SDK coverage
Connected and public scans detect declaration-backed AWS SDK v2 client usage for S3, DynamoDB, DynamoDB DocumentClient, SQS, SNS, SES, Lambda, CloudWatch Logs and STS. Findings include the client location, observed operations, SDK/lockfile evidence and possible downstream paths. AWS ended SDK v2 support on September 8, 2025; that does not mean existing service calls have stopped working. Service-specific v3 dependencies are separate packages, not an upgrade to an imaginary aws-sdk v3 package.
Manual and eligible Automatic workflows use a deterministic, source-only converter for recognized immutable ES-module clients and allowlisted operations consumed through .promise(). It preserves exported names and explicit region, credential, endpoint and retry settings, fetches exact modular package releases, regenerates the lockfile, and uses the normal validation and workspace re-scan gates before opening a human-reviewed Draft PR. Every AWS migration requires human merge. Callback/event/lazy-request flows, global or dynamic config, pinned service API versions, custom timeout/agent options, S3 streaming/multipart, Lambda response contracts and DocumentClient marshalling stop with specific review reasons. Lambda and DocumentClient are detection-only and are not advertised as ready for a generated patch. Reviewed no-argument list/quota/identity calls receive an explicit empty v3 input; callback overloads still require manual migration.
AWS runtime behavior, IAM permissions and actual cloud integrations are not verified by a source scan or typecheck. SDK v3 release notes are informational until a reviewed rule exists. Other AWS services, boto3/Python, Java/Go SDKs, Terraform, CloudFormation and AWS-wide service deprecations are not covered in this release. No AWS account access, deployment, resource creation/deletion, policy editing or credential changes are performed.