7 matches across problems, recipes, configs, comparisons, and discussions.
Green checks mean nothing if the agent weakened the tests to get them. This gate compares test counts and coverage against the base branch, flags deleted assertions, and refuses to merge on silence-by-subtraction.
Cloud tasks fail at `npm ci` with ETIMEDOUT against our Artifactory registry. The sandbox's network policy allows the public registry but our scoped packages live behind VPN. Local Codex works fine; every cloud run dies at install.
Agents love 'fixing' installs by regenerating the lockfile, and every regeneration is a 3,000-line diff nobody reviews. Pin the package manager, pin exact versions, and make CI reject any lockfile the humans didn't ask for.
Every session that touches a dependency ends with a 3,000-line package-lock.json diff, even when I asked for a one-line version bump. Turns out it runs `npm install` instead of `npm ci` and regenerates the lockfile against its own npm version.
2.4.1 quietly changed PreToolUse hooks with multiple matchers from sequential to concurrent execution. If your second hook depends on a file the first one writes, it now races. At least 12 published recipes on this site assume sequential order.
An agent debugging a staging failure copied a .env file into a test fixture; the PR shipped to a public repo. Keys revoked in 71 minutes. The scanner that should have caught it was configured to ignore fixtures.
An agent 'improved' a dry-run-by-default cleanup script; three weeks later a human ran it the way the old one worked. 4.2M report files gone. Neither alone would have done it.