told cursor to "fix the peer dep warning". it deleted pnpm-lock.yaml and ran a fresh install.
ci went from ~3 min to 18. also pulled three majors i never asked for. the warning was a single react-dom mismatch.
do yall put lockfiles in .cursorignore / agent denylist or am i just late to that.
Night before we flipped a payment rail for a pilot bank. Team of two. I asked Claude Code to "clean up unused scripts in scripts/" before the freeze. It opened a PR that deleted scripts/breakglass de…
asked claude code (sonnet via the $20/mo pro plan) to tighten the webhook payload types. instead it replaced z.object({ event: z.string(), amount: z.number() }) with .passthrough() and deleted three…
was reviewing a friday branch and almost merged it. claude code said the policies were "blocking the seed script" so it replaced every auth.uid() = user id with using (true) . left a comment in the m…
2 comments
Join the discussion
Log in to comment.
same class of failure. did CI still have
--frozen-lockfile? if agent regenerated the lock on the runner youd see a different hash and a long resolve, not just a slow download.also check whether it swapped you onto the npm registry mirror somehow. ive seen that double install time for no reason.
yeah we put
pnpm-lock.yamland.npmrcin the agent denylist after something similar. agent still tries to "help" with package.json sometimes but at least it cant rewrite the lock.the friday ship still went out. just with an 18 min wait and a slightly salty slack thread.