越界 / 不理想

“顺手”升级了依赖或改了配置

Bumped a dependency or config "along the way"

为了绕过一个无关的警告或错误，智能体升级了某个包、改了 lockfile，或改了配置默认值。

适用于: Claude Code · Cursor · Codex · Copilot agent

症状

一个关于功能代码的 diff 里出现了 `package.json`、lockfile、`tsconfig.json`、`.eslintrc` 或 CI 配置。严格程度被悄悄降低了。

为什么会这样

改配置是变绿的最短路径。developertoolkit.ai 的 scope creep 类别点名了“顺手升级的依赖、为让测试通过而改的配置默认值”，并指出最可靠的最早拦截是机械式的：CI 比对改动路径与声明范围。dev.to 那篇文章里的智能体也会“因为 linter 抱怨了无关的东西而改配置文件”。

示例

示意。

diff

+ src/cart/total.ts           (the requested fix)
+ tsconfig.json               - "strict": true,  + "strict": false,
+ package.json                - "zod": "^3.23.8" + "zod": "^4.0.0"

复制即用的修复

按你用的智能体挑选文件。规则片段用英文写，放进任何仓库都能用。

规则

Claude Code：加入 CLAUDE.md

CLAUDE.md

## Don't touch dependencies or config unless asked
- Do not add, remove or upgrade dependencies, or edit lockfiles, for a task that is not about dependencies.
- Do not change tsconfig, linter, formatter, build, CI or env config to make an error go away.
  Fix the code, or stop and explain.
- If a config change is really required, make it a separate step and explain the trade-off.

规则

Codex、Copilot 编码智能体等：加入 AGENTS.md

AGENTS.md

## Don't touch dependencies or config unless asked
- Do not add, remove or upgrade dependencies, or edit lockfiles, for a task that is not about dependencies.
- Do not change tsconfig, linter, formatter, build, CI or env config to make an error go away.
  Fix the code, or stop and explain.
- If a config change is really required, make it a separate step and explain the trade-off.

Cursor 规则

Cursor：项目规则

.cursor/rules/dependency-or-config-bump.mdc

---
description: "AgentFails: Bumped a dependency or config 'along the way'"
alwaysApply: true
---

## Don't touch dependencies or config unless asked
- Do not add, remove or upgrade dependencies, or edit lockfiles, for a task that is not about dependencies.
- Do not change tsconfig, linter, formatter, build, CI or env config to make an error go away.
  Fix the code, or stop and explain.
- If a config change is really required, make it a separate step and explain the trade-off.

配置

Claude Code 权限：硬性禁止敏感路径，安装依赖前先询问

CLAUDE.md 里的规则只是上下文；权限规则由工具强制执行。按你的仓库调整路径。

.claude/settings.json

{
  "permissions": {
    "deny": [
      "Edit(./migrations/**)",
      "Edit(./.env*)",
      "Edit(./package-lock.json)",
      "Edit(./pnpm-lock.yaml)",
      "Edit(./src/generated/**)"
    ],
    "ask": [
      "Bash(npm install:*)",
      "Bash(pnpm add:*)",
      "Bash(yarn add:*)",
      "Bash(pip install:*)",
      "Bash(git push:*)"
    ]
  }
}

CI / 脚本

CI 守卫：功能类 PR 中出现配置/依赖改动时报警

.github/workflows/config-guard.yml

name: config-guard
on: pull_request
jobs:
  guard:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'deps-or-config') }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - run: |
          changed=$(git diff --name-only "origin/${{ github.base_ref }}...HEAD")
          hits=$(echo "$changed" | grep -E '(^|/)(package(-lock)?\.json|pnpm-lock\.yaml|yarn\.lock|tsconfig.*\.json|\.eslintrc.*|eslint\.config\..*|\.github/workflows/.*)$' || true)
          if [ -n "$hits" ]; then
            echo "Config/dependency files changed without the 'deps-or-config' label:"; echo "$hits"; exit 1
          fi

来源与致谢

在 GitHub 上改进这条遇到了、但修复没用？告诉我们