Run security upgrades through Codex and Claude

[devjiwonchoi]

Stacked on #98562.

Why?

An agent working in a Next.js app needs one command that determines whether a security upgrade is necessary and supplies durable migration guidance. A user running that command from a terminal needs background execution with an actionable session receipt.

How?

Expose next upgrade --agent through the prepared resolver and resource packet. Hand instructions back to an existing Codex or Claude session, or select an installed harness and launch detached Codex execution or Claude's native background mode. New workers use Luna or Haiku; existing sessions retain their model.

Add --dry-run to stop after migration, verification and local commits, with no push or PR. Receipts provide session, logs, stop and continuation instructions; Codex continuation requires its active writer to finish or stop. Preserve the legacy non-agent command behavior and keep selection/launcher unit tests with the implementation.

The migration eval suite is tracked separately in #98566 against a fixed implementation snapshot. This layer adds no next dev trigger, adoption skills or eval CI automation.

[github-actions]

Failing test suites

Commit: 83a9715 | About building and testing Next.js

pnpm test-dev test/development/app-dir/instant-navs-devtools/instant-navs-devtools.test.ts (job)

• instant-nav-panel > SPA captures > should capture when CookieStore writes are not reflected in document.cookie (DD)
• instant-nav-panel > SPA captures > should show loading skeleton during SPA navigation after clicking Start (DD)

Expand output

● instant-nav-panel › SPA captures › should capture when CookieStore writes are not reflected in document.cookie

locator.waitFor: Timeout 60000ms exceeded.
Call log:
  - waiting for locator('[data-testid="dynamic-skeleton"]') to be visible

  278 |     await browser
  279 |       .locator('[data-testid="dynamic-skeleton"]')
> 280 |       .waitFor({ state: 'visible' })
      |        ^
  281 |     await browser
  282 |       .locator('[data-testid="param-skeleton"]')
  283 |       .waitFor({ state: 'visible' })

  at waitFor (development/app-dir/instant-navs-devtools/instant-navs-devtools.test.ts:280:8)
  at Object.expectTargetPageSpaShell (development/app-dir/instant-navs-devtools/instant-navs-devtools.test.ts:607:13)

● instant-nav-panel › SPA captures › should show loading skeleton during SPA navigation after clicking Start

locator.waitFor: Timeout 60000ms exceeded.
Call log:
  - waiting for locator('[data-testid="dynamic-skeleton"]') to be visible

  624 |       await browser
  625 |         .locator('[data-testid="dynamic-skeleton"]')
> 626 |         .waitFor({ state: 'visible' })
      |          ^
  627 |       expect(
  628 |         await browser.locator('[data-testid="dynamic-content"]').count()
  629 |       ).toBe(0)

  at Object.waitFor (development/app-dir/instant-navs-devtools/instant-navs-devtools.test.ts:626:10)

pnpm test-start-turbo test/production/next-server-nft/next-server-nft.test.ts (turbopack) (job)

• next-server-nft > with output:standalone > should not trace too many files in next-server.js.nft.json (DD)

Expand output

● next-server-nft › with output:standalone › should not trace too many files in next-server.js.nft.json

expect(received).toMatchInlineSnapshot(snapshot)

Snapshot name: `next-server-nft with output:standalone should not trace too many files in next-server.js.nft.json 1`

- Snapshot  - 0
+ Received  + 7

@@ -227,10 +227,17 @@
    "/node_modules/next/dist/lib/typescript/runTypeCheckCli.js",
    "/node_modules/next/dist/lib/typescript/runTypeScriptCli.js",
    "/node_modules/next/dist/lib/typescript/type-paths.js",
    "/node_modules/next/dist/lib/typescript/writeAppTypeDeclarations.js",
    "/node_modules/next/dist/lib/typescript/writeConfigurationDefaults.js",
+   "/node_modules/next/dist/lib/upgrade/codex.js",
+   "/node_modules/next/dist/lib/upgrade/harness.js",
+   "/node_modules/next/dist/lib/upgrade/models.js",
+   "/node_modules/next/dist/lib/upgrade/receipt.js",
+   "/node_modules/next/dist/lib/upgrade/resolve.js",
+   "/node_modules/next/dist/lib/upgrade/resources.js",
+   "/node_modules/next/dist/lib/upgrade/security.js",
    "/node_modules/next/dist/lib/url.js",
    "/node_modules/next/dist/lib/verify-partytown-setup.js",
    "/node_modules/next/dist/lib/verify-root-layout.js",
    "/node_modules/next/dist/lib/verify-typescript-setup.js",
    "/node_modules/next/dist/lib/wait.js",

  130 |         ]
  131 |
> 132 |         expect(traceGrouped).toMatchInlineSnapshot(`
      |                              ^
  133 |          [
  134 |            "/node_modules/@img/colour/*",
  135 |            "/node_modules/@img/sharp-<PLATFORM>-<ARCH>/*",

  at Object.toMatchInlineSnapshot (production/next-server-nft/next-server-nft.test.ts:132:30)

Other failing CI jobs

• lint / build