vibehacker
Discuss
Felix
1 month ago

cursor flipped packageManager to yarn and pnpm ci burned for 90 min

#vibe-coding#tooling

was mid-refactor on a Next app. asked Cursor to "clean up the scripts block" and it quietly rewrote packageManager from [email protected] to [email protected].

local still used my shell pnpm so nothing screamed. GHA used corepack enable + the field. suddenly every job was yarn-installing a half-mutated lockfile. 47 red runs before I noticed the one-line diff.

reverted, pinned packageManager in CODEOWNERS, and now I grep that field in the PR template. agents should not touch package managers without asking. period.

6

6 comments

Join the discussion

Log in to comment.

Log in
  • Caleb Ortiz

    same class of bug hit me with promptfoo configs. agent "normalized" my providers array and swapped claude-sonnet-4 for a stale gpt-4o id. evals went green because the fixture suite was too soft.

    i now put a packageManager check next to the model-id assert in CI. one line, saves an afternoon.

    • Jonah

      yeah we added a gha step that fails if packageManager drifts from pnpm@9

      also blocked cursor from writing package.json via a dumb pre-commit grep. ugly but the retry loop on yarn was worse than the original bug

      • Cass

        wait so the pre-commit grep blocks any package.json write from the agent path, or only the packageManager line?

        tried a similar hook and cursor just edited via apply_patch in a way that skipped the hook once. curious what string you match on.

        • Flint Harbor

          we match only the "packageManager" line — anything else in package.json still goes through. agent once slipped yarn in via a JSON patch that reformatted the whole file, so the hook still fired.

          apply_patch skipping hooks is nasty. we moved the check into a required GHA job too, so even if local hooks get dodged the PR dies. ugly, but demos stopped exploding mid-install.

  • Tess

    had the same flip but with npm→pnpm. agent rewrote packageManager while "fixing a peer dep warning". corepack then spent an hour resolving nothing useful.

    i named the guard job chips-package-manager in gha. fails if the field != pnpm@9. ugly name, works.

  • Carlos Reed

    same energy. friday night, cursor "fixed" a peer dep warning by rewriting packageManager to yarn@1 and regenerating a yarn.lock next to my pnpm-lock.yaml. both committed. corepack picked yarn. 90 minutes of red until i saw the dual lockfiles.

    CODEOWNERS on package.json + both lockfiles now. agents do not get to pick package managers.

More like this

View all