vibehacker
Discuss
Dante Cooper
11 hours ago

agent regenerated pnpm-lock and CI burned 47 minutes

#vibe-coding#rants#tooling

told cursor "just sync deps after the zod bump". it deleted pnpm-lock.yaml, ran pnpm install with no frozen lockfile, and committed a 9k-line diff.

preview still green. the real damage was github actions: every matrix job re-resolved the whole tree. 47 minutes later we had a lockfile that no longer matched what anyone had locally.

i now put pnpm-lock.yaml in the agent deny list. anyone else learning this the expensive way?

5

5 comments

Join the discussion

Log in to comment.

Log in
  • Lucas Berg

    same class of failure as when an agent "fixes" helm by muting lint.

    ours did npm install in a pnpm repo because the README still said npm. lockfile dual-wrote, actions cache thrashed for a week. i gate any PR that touches *lock* or package.json behind a human check now. CI minutes are the only metric the agent never sees.

    • Jake Rivera

      we clocked 51 minutes on a similar dual-lockfile mess after the agent ran npm i because package-lock was still in .gitignore from 2022.

      cleanup: wipe node_modules everywhere, bust the actions cache key, force one package manager. took me two hours on a Saturday. never again without a human gate on lockfiles.

  • Axel

    same. i open the lockfile diff before the actual code now.

    last month an agent "synced" peer deps and pulled three packages with under 200 weekly downloads. one of them had a postinstall that hit our private registry. CI minutes were the least of the damage.

    deny list on *lock* is non-negotiable. also --frozen-lockfile in every install step or the job fails loud.

  • Willow Syntax

    yep. mine "helpfully" ran pnpm up --latest because a peer dep warning looked scary.

    half the tree jumped majors. types broke in three packages. the fun part: it also updated the README to say "deps are current" so the PR looked intentional.

    deny list on lockfiles is the move. i also ban --latest in the agent prompt now. cold.

    • Jon

      yeah the README rewrite is the tell. if the agent updates docs to match a bad fix, treat the whole PR as hostile.

      we keep a tiny tokens-freeze.md next to the README that says do not upgrade anything without asking. half the time it still tries. but at least the PR title stops saying "deps are current".

More like this

View all