DEV Community: Taylor Andrade

How to Stop Cursor and Claude Code from Breaking Clean Architecture in 12ms

Taylor Andrade — Sat, 03 Oct 2026 18:34:59 +0000

Prevent AI coding tools from turning your repository into architectural spaghetti with zero-dependency pre-commit guardrails.
tags: webdev, ai, nextjs, programming

canonical_url: https://taylormatematica-beep.github.io/repoguard/

AI coding assistants like Cursor, Claude Code, GitHub Copilot, and Windsurf have fundamentally changed how we write software. They can scaffold a feature, draft an endpoint, or generate UI components in seconds.

However, after 6 months of daily use across growing codebases, a subtle and dangerous problem emerges: Architectural Drift.

Because LLMs prioritize local completion over systemic architecture, they inevitably introduce patterns that pass quick compilation but destroy long-term maintainability:

❌ Direct Database Queries in UI: Importing Prisma, Drizzle, or SQLAlchemy directly inside React UI components or route handlers.
❌ Type Safety Escape Hatches: Sprinkling : any or as any across TypeScript code whenever a type error gets tricky.
❌ Silenced Errors in Go: Discarding errors via blank identifiers (_ = err) to force compilation.
❌ Client-Side Secret Leaks: Prefixing private database credentials or API secrets with NEXT_PUBLIC_ or VITE_ so the frontend can access them directly.
❌ Duplicate Helper Utilities: Re-writing 20 lines of date or email formatting instead of reusing shared functions in /utils.

When your team is merging dozens of AI-assisted PRs every week, code reviews become exhausting and tech debt compounds rapidly.

To solve this, we built RepoGuard — a zero-dependency, open-source architecture linter and context generator that audits codebases in ~12ms.

🛠️ The Anatomy of an Architecture Linter

Unlike standard linters (like ESLint or Biome) that focus on syntax and formatting, RepoGuard enforces architectural boundaries between layers:

┌──────────────────────────────────────────────┐
│        Presentation / UI Layer               │
│  (React, Next.js Server Components, Pages)   │
└──────────────────────┬───────────────────────┘
                       │ ❌ DIRECT DB ACCESS FORBIDDEN (RULE-01)
                       ▼
┌──────────────────────────────────────────────┐
│        Service / Domain Layer                │
│    (Business logic, validation, orchestrator)│
└──────────────────────┬───────────────────────┘
                       │ ✅ Encapsulated data flow
                       ▼
┌──────────────────────────────────────────────┐
│      Persistence / Repository Layer          │
│       (Prisma, GORM, SQLAlchemy, SQL)        │
└──────────────────────────────────────────────┘

🔍 Real-World Example: Before vs After

❌ The Anti-Pattern (What Cursor Generates):

// components/UserProfile.tsx
export default async function UserProfile({ id }: { id: string }) {
  // 🚨 Violation: Direct Prisma database query inside UI component!
  const user = await prisma.user.findUnique({
    where: { id },
    include: { billing: true }
  });
  return <div>{user.name}</div>;
}

✅ Clean Architecture (Enforced by RepoGuard):

// components/UserProfile.tsx
import { getUserProfile } from '@/services/user.service';

export default async function UserProfile({ id }: { id: string }) {
  // Encapsulated in the domain service layer
  const user = await getUserProfile(id);
  return <div>{user.name}</div>;
}

🚀 Getting Started in 2 Seconds (Zero-Install)

You can run RepoGuard directly in your repository without installing any packages globally:

# 1. Initialize context rules for Cursor, Claude Code & Copilot
npx repoguard-rules init

# 2. Audit your entire codebase health score (A+ to F)
npx repoguard-rules audit

What `npx repoguard-rules init` does:

Auto-detects your tech stack: TypeScript/Next.js, Python (FastAPI/Django), or Golang (Gin/Fiber/GORM).
Generates tailored context files:
- .cursorrules (for Cursor AI)
- CLAUDE.md (for Claude Code CLI)
- .windsurfrules (for Windsurf Cascade)
- .github/copilot-instructions.md (for GitHub Copilot)
Injects Pre-commit Hooks: Configures git diff checks to block architectural breaches before you commit.

⚡ Multi-Language Support (v1.6.0)

RepoGuard v1.6.0 introduces native support for Python and Golang:

Rule ID	Language	Guardrail Enforced
RULE-01	TypeScript / JS	Prohibits raw ORM/DB queries in UI components and Controllers.
RULE-PY-01	Python / FastAPI	Prohibits direct DB queries and raw commits (`db.commit()`) in route handlers.
RULE-GO-01	Golang	Prohibits raw GORM/database mutations inside Gin, Fiber, or Echo handlers.
RULE-GO-02	Golang	Flags unchecked errors silenced via blank identifiers (`_ = err`).
RULE-02	Multi-Language	Flags hardcoded secrets, private keys, and API tokens.
RULE-09	Multi-Language	Blocks private secrets exposed via public prefixes (`NEXT_PUBLIC_` / `VITE_`).

🤖 GitHub Action & Security Integration

RepoGuard is officially published on the GitHub Marketplace. You can add continuous architectural enforcement to your Pull Requests in 4 lines of YAML:

# .github/workflows/repoguard.yml
name: RepoGuard Architecture Audit
on: [pull_request]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: taylormatematica-beep/repoguard@v1.6.0
        with:
          strict_mode: true

GitHub Code Scanning (SARIF Export):

RepoGuard can also output native SARIF v2.1.0 to integrate directly with GitHub's Security / Code Scanning alerts:

npx repoguard-rules audit --format=sarif > results.sarif

🌟 Open Source & Contributing

RepoGuard is 100% open-source under the MIT license. We believe developer tools for the AI era should be transparent, zero-dependency, and community-driven.

🔗 GitHub Repository: https://github.com/taylormatematica-beep/repoguard
🏛️ GitHub Marketplace: https://github.com/marketplace/actions/repoguard-architecture-audit
📦 NPM Registry: https://www.npmjs.com/package/repoguard-rules

If you're using AI coding tools on your team, give npx repoguard-rules audit a run and let us know your architectural health score in the comments! ⭐

RepoGuard Studio: Guarding Next.js Architecture with Sanity Content Lake

Taylor Andrade — Sat, 19 Sep 2026 00:43:06 +0000

This is a submission for the Sanity Challenge, Path Two: Vibe-Code Something Strange

🛡️ What I Built

RepoGuard Studio is a living architectural guardrails hub designed to solve one of the most pressing headaches in modern AI-assisted engineering: AI code rot and layer bypassing.

When developers use AI coding assistants (Cursor, Claude Code, Windsurf, Copilot), the models write hundreds of lines in seconds. But without strict repo-level context, the AI quietly introduces destructive anti-patterns:

Querying databases directly from React components and API route handlers instead of domain services.
Inventing duplicate utility helpers instead of importing existing ones.
Infiltrating files with : any to make compilers happy.
Exposing mock credentials and creating hydration mismatches.

Instead of hardcoding rules into static text files, RepoGuard Studio stores, structures, and serves architectural guardrails directly from Sanity's Content Lake using GROQ queries and structured schemas.

Key Capabilities:

Interactive Rules Catalog: Filter and explore 8 core architectural rules backed by Sanity JSON documents, complete with interactive Bad Code vs Good Code diff tabs.
Multi-AI Context Generator: Configure your stack (Next.js 15, Prisma, NestJS) and rules to generate tailored .cursorrules, CLAUDE.md, and .windsurfrules with 1-click Copy & Download.
Live Architecture Linter Playground: Paste code in the browser and watch RepoGuard's audit engine calculate an instant Architectural Health Score (100/100, Grade A+ to F).
Sanity GROQ Console: Live inspector executing real-time GROQ queries against the Sanity dataset (dwzoo40f).

🎮 Demo & Live Experience

🌐 Live Interactive App: https://taylormatematica-beep.github.io/repoguard/
📦 NPM Package: https://www.npmjs.com/package/repoguard-rules
⭐ GitHub Repository: https://github.com/taylormatematica-beep/repoguard

Run the CLI in your terminal right now with zero installation:

# 1. Audit your repo architecture score:
npx repoguard-rules audit

# 2. Generate stack-tailored guardrails:
npx repoguard-rules init

💻 Code & Schemas

The complete code is open-source under the MIT license on GitHub:
👉 github.com/taylormatematica-beep/repoguard

Sanity Schema Definition (`rule.ts`):

import { defineType, defineField } from 'sanity';

export const ruleType = defineType({
  name: 'rule',
  title: 'Architectural Guardrail',
  type: 'document',
  fields: [
    defineField({ name: 'ruleId', title: 'Rule ID', type: 'string', validation: (Rule) => Rule.required() }),
    defineField({ name: 'title', title: 'Rule Title', type: 'string', validation: (Rule) => Rule.required() }),
    defineField({ 
      name: 'category', 
      title: 'Category', 
      type: 'string', 
      options: { list: ['Architecture', 'Security', 'Type Safety', 'Next.js / SSR', 'API Design', 'Code Quality'] } 
    }),
    defineField({ 
      name: 'severity', 
      title: 'Severity Level', 
      type: 'string', 
      options: { list: ['Critical', 'Error', 'Warning', 'Info'] } 
    }),
    defineField({ name: 'description', title: 'Description', type: 'text' }),
    defineField({ name: 'rationale', title: 'Engineering Rationale', type: 'text' }),
    defineField({ name: 'badCode', title: 'Violation Snippet', type: 'text' }),
    defineField({ name: 'goodCode', title: 'Clean Architecture Snippet', type: 'text' }),
    defineField({ name: 'fixSuggestion', title: 'Remediation Fix', type: 'string' }),
  ],
});

GROQ Query Used to Power the App:

*[_type == "rule"] | order(ruleId asc) {
  _id,
  ruleId,
  title,
  category,
  severity,
  description,
  rationale,
  badCode,
  goodCode,
  fixSuggestion,
  frameworks,
  aiAssistants
}

🛠️ My Build Process

This project was built entirely through an AI-native vibe-coding workflow using Cursor and Arena Agent Mode, with Next.js, React, and Sanity.

1. Where the Model Got Stuck

While scaffolding the Next.js components, Cursor initially attempted to run raw database calls directly inside frontend event handlers — committing the very crime RepoGuard was meant to prevent!

Because the model lacked holistic context about clean separation of concerns, it treated the Sanity client as a generic client-side fetcher without proper error handling and fallback caching.

2. How We Course-Corrected

We used RepoGuard's own .cursorrules to constrain the model:

Enforced that Sanity queries must be encapsulated inside a dedicated data access module (/src/sanity/client.js).
Required explicit TypeScript typing on GROQ query projections.
Added fallback structured seed data so the web app remains resilient and fast even before new documents are published to the dataset.

The result is a fast, robust app that communicates seamlessly with Sanity's Content Lake.

📌 Sanity Project Details

As required by the challenge guidelines, here are the project identifiers for the judges:

Sanity Project ID: dwzoo40f
Dataset: production
Public API Query Endpoint: https://dwzoo40f.api.sanity.io/v2024-01-01/data/query/production?query=*[_type%20==%20%22rule%22]

🤖 Conclusion

By connecting Sanity's structured content model with real-time AI guardrails, RepoGuard Studio demonstrates how content operating systems can serve as the living memory and quality control system for AI-assisted engineering teams.

Happy coding, and guard your codebases! 🛡️

How to Stop Cursor and Copilot from Turning Your Codebase into Spaghetti

Taylor Andrade — Fri, 18 Sep 2026 13:21:48 +0000

AI coding assistants like Cursor, GitHub Copilot, Claude Code, and Windsurf have completely revolutionized developer velocity. Being able to scaffold an entire feature in 10 seconds feels like having superpowers.

Until 3 months later, when your tech lead opens the repository and screams.

While AI models are brilliant at solving isolated algorithmic tasks, they lack holistic architectural discipline. Without strict repo-level boundaries, AI assistants quietly poison your codebase with architectural drift:

Layer Bypassing: The AI queries Prisma, Drizzle, or raw SQL directly inside React components or API route handlers, completely ignoring your /services domain logic.
Re-inventing Existing Helpers: Instead of importing your existing formatCurrency helper, the AI writes a fresh 20-line copy with zero reuse.
The Lazy : any Escape Hatch: When TypeScript complains about complex interfaces, the AI sprinkles : any or as any everywhere to force quick compilation.
Secret Leaks: Mock API keys and tokens accidentally hardcoded into files.
PR Review Fatigue: Tech leads spend hours reviewing 800-line AI-generated PRs, hunting for subtle architectural breaches.

To solve this without manually writing hundreds of lines of rule files, we built RepoGuard: an open-source, zero-dependency CLI that scans your project stack, enforces 8 strict architectural guardrails, and grades your repository's architectural health from A+ to F.

🚀 Instant Quickstart (Zero Install Required)

RepoGuard is completely free and published on the official NPM registry. You can test it on any repository right now:

1. Check Your Architectural Health Score

Run this command in the root of any repository:

npx repoguard-rules audit

RepoGuard scans your entire codebase against 8 strict architectural rules and outputs an instant health report card:

====================================================
  ARCHITECTURAL HEALTH DASHBOARD
====================================================
  Files Audited:    42
  Total Violations: 0
  Health Score:     100/100 [Grade: A+]
====================================================
✨ Flawless architecture! Zero drift detected across all files.

If violations exist, it pinpoints the exact file, line number, violated rule, and suggests a clean architectural fix.

2. Auto-Generate Strict Guardrails for Cursor & Claude Code

Instead of writing rule files by hand, run:

npx repoguard-rules init

In 2 seconds, RepoGuard:

🔍 Detects your stack (Next.js, NestJS, Express, Python, Prisma, Tailwind, etc.).
📝 Generates tailored .cursorrules (for Cursor AI).
🤖 Generates a comprehensive CLAUDE.md (for Claude Code).
🌊 Generates .windsurfrules (for Windsurf IDE).
🛡️ Configures pre-commit hook triggers.

🛡️ The 8 Built-in Architectural Rules

Rule ID	Category	Severity	Guardrail Enforced
RULE-01	Architecture	Error	Blocks raw ORM/DB calls inside Controllers and UI components.
RULE-02	Security	Critical	Flags hardcoded secrets, API tokens, and credentials in code.
RULE-03	Type Safety	Warning	Forbids lazy `: any` and `as any` escape hatches.
RULE-04	Code Quality	Info	Enforces structured logging instead of raw `console.log`.
RULE-05	Next.js / SSR	Error	Prevents SSR hydration mismatch from browser globals (`window/localStorage`).
RULE-06	Security	Critical	Detects dangerous SQL injection risks in raw query interpolations.
RULE-07	API Design	Warning	Enforces Zod schema validation on incoming request body payloads.
RULE-08	DRY Principle	Info	Prevents AI assistants from duplicating existing common utility helpers.

🔬 Real-Time Git Diff Auditing

Before committing code generated by an AI assistant, you can audit your staged changes in real-time:

npx repoguard-rules check

Or physically block architectural drift before it ever leaves a developer's machine:

npx repoguard-rules install-hook

This installs a lightweight .git/hooks/pre-commit script that runs in milliseconds. If an AI assistant smuggled a raw DB call into a frontend component, the commit is safely rejected with actionable guidance on how to fix it.

🌟 Open Source & Getting Involved

RepoGuard is completely free and licensed under MIT:

📦 NPM Registry: https://www.npmjs.com/package/repoguard-rules
⭐ GitHub Repository: https://github.com/taylormatematica-beep/repoguard
🌐 Live Interactive Docs: https://taylormatematica-beep.github.io/repoguard/

If you find the tool useful or want to keep AI coding disciplined across your team, please consider starring the repository on GitHub ⭐!

Discussion:

What is the worst architectural mistake you've caught Cursor or Copilot making in your projects? Let's discuss in the comments below! 👇