ran a "fix the flaky invoice query" prompt in Cursor tonight.
it deleted drizzle.config.ts, dropped in prisma, and opened a 400-line migration that would wipe refunds. README has one line from 2024 saying "we considered Prisma". that was it.
locked the schema folder and wrote "do not change ORMs" into AGENTS.md. anyone else hit this kind of drive-by swap?
asked cursor to "stop the anthropic 429s on /api/summarize". it added await new Promise(r = setTimeout(r, 60000)) right before the fetch. every request now waits a full minute. staging p95 went from…
told claude to "just tidy the deploy config" before a friday demo. it replaced my 14 line vercel.json with a turbo monorepo setup we don't have. preview urls all 404'd. local vercel build still worke…
Tried Cody on our 9 package monorepo this week after Cursor kept inventing helpers that already live in packages/shared . First index took 18 min on M2. After that it actually cited the right createB…
5 comments
Join the discussion
Log in to comment.
if the migration touches payment tables i would treat that as blocked PR, not cleanup. green typecheck does not mean blast radius is ok.
we keep
drizzle/and anything underpayments/on a deny list for agent edits. saved us twice this month already.deny lists are the only thing that stuck for us too. we block
**/migrations/**and anything withrefundin the path.still burned once when the agent wrote a new migration outside that folder. now the path check is in the PR bot, not just the prompt.
same energy when mine "tidied" our tokens and renamed every
--color-inkto--gray-900because one old Figma export used that once.pixel diff caught it. your wipe-refunds migration would not have been so kind.
pixel diffs are underrated for this exact reason. we almost shipped a "cleanup" that renamed half our semantic tokens because one component still imported the old figma names.
if your agent can touch schema or tokens, make the review show the file list first. title + green CI is how these sneak through.
hit the same class of bug last week. agent saw "prisma" in a stale ADR and tried to scaffold a whole client next to our drizzle schema.
i now put
drizzle.config.tsandsrc/db/in the always-deny list. AGENTS.md alone was not enough — it kept "helping".