Stop Your Weekend Agent From Adding Libraries

You open the laptop at 9:12 Saturday.
The side project still has no public demo.
You paste a vague prompt into an agent.
The reply suggests three extra helper libraries.

That is how a whole weekend disappears.
New packages look cheap when generation is cheap.
They stop looking cheap during Sunday deploy.
You wanted one boring working request path.
You almost bought another package supply chain.

This post records a practical weekend workflow.
The article is not a product review piece.
You freeze dependencies for one full weekend.
You still ship a tiny public demo.
You skip every feature that needs libraries.

The Saturday failure mode

Your repo already contains Express and core Node.
The agent does not respect that existing inventory.
It reaches for a retry HTTP client next.
It reaches for a schema validation kit too.
It reaches for an ORM just in case.

Each add looks reasonable in isolation today.
Together they explode the lockfile by Sunday.
You spend the evening reading package changelogs.
The public demo still does not exist yet.

Cheap generation hides a real invoice later.
That invoice is dependency churn after merge.
You pay it when the agent goes quiet.
Agents also invent extra infrastructure in prose.
You do not need that argument on Saturday.

Write the freeze note first

Write the rule down before any prompt.
Keep the note in the repository root.
Name the file WEEKEND_FREEZE.md without debate.
The agent must read that file first.
You will score every plan against it.

Follow these five freeze rules without local exceptions:

1. Application source files may change freely.
2. package.json may not gain new names.
3. Lockfiles may not change this weekend.
4. New network services stay out of scope.
5. Required libraries mean you cut the feature.

Copy this freeze note into the repo root.

# WEEKEND_FREEZE.md

Goal: ship one demo path by Sunday 18:00.
Allowed paths: src/, README.md, tests/, data/.
Forbidden: package.json edits and lockfile edits.
Forbidden: new Docker services and new queues.
Demo path: POST /shorten and GET /:code.
Storage: local data/urls.json only.
If a task needs a new package, drop it.

This note is a proposal you can adapt.
Do not treat it as a security boundary.
It is only a scope tool for Sunday.

Scope you cut on purpose

The original sketch listed four extra features.
You keep a single request path only.
You park the rest on a later list.

Cut this list before generation starts:

1. OAuth because imaginary users might exist.
2. A metrics dashboard for later imagined scale.
3. Email sharing links for viral growth theater.
4. Redis because memory feels more official.

What remains is ugly and still shippable.
One POST handler writes a JSON file.
One GET handler reads that same file.
There is no dedicated uniqueness server here.
There is also no click analytics pipeline.

That cut is the actual design work.
The agent is usually bad at cutting.
You perform the cut before generation starts.

Artifact: a freeze checker script

Do not trust the model to obey English.
Trust a script that diffs manifest files.
Save this file as scripts/check-freeze.sh.
Treat it as sample code until you run it.

#!/usr/bin/env bash
set -euo pipefail

BASE="${1:-HEAD}"
PLAN="${2:-}"
FAIL=0

changed="$(git diff --name-only "$BASE" -- \
  package.json package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null || true)"

if [[ -n "$changed" ]]; then
  echo "FREEZE FAIL: manifest or lockfile changed:"
  printf '%s\n' "$changed"
  FAIL=1
fi

if git diff "$BASE" -- package.json | grep -E '^\+\s*"' >/dev/null 2>&1; then
  echo "FREEZE FAIL: package.json entries were altered."
  FAIL=1
fi

if [[ -n "$PLAN" && -f "$PLAN" ]]; then
  if grep -Ei 'npm install|npm i |yarn add|pnpm add|pip install' "$PLAN" >/dev/null; then
    echo "FREEZE FAIL: plan installs packages."
    FAIL=1
  fi
fi

if [[ "$FAIL" -ne 0 ]]; then
  echo "Reject the plan. Cut the feature instead."
  exit 1
fi

echo "FREEZE OK: no new dependencies in this diff."

Make the script executable on your machine.

chmod +x scripts/check-freeze.sh

Run it against last night's commit and plan.

./scripts/check-freeze.sh HEAD~1 agent-plan.md

If it fails, you do not negotiate terms.
You delete the blocked feature from the plan.
Then you generate a narrower plan again.

A demo that survives the freeze

You need a path the script cannot block.
Use Node built-ins plus existing Express only.
Label this as sample code for a brownfield repo.
Wire it only when Express already exists there.

// src/shorten.js
const fs = require("fs");
const path = require("path");
const express = require("express");

const DATA = path.join(__dirname, "..", "data", "urls.json");
const app = express();
app.use(express.json());

function load() {
  if (!fs.existsSync(DATA)) return {};
  return JSON.parse(fs.readFileSync(DATA, "utf8"));
}

function save(map) {
  fs.mkdirSync(path.dirname(DATA), { recursive: true });
  fs.writeFileSync(DATA, JSON.stringify(map, null, 2));
}

app.post("/shorten", (req, res) => {
  const url = String((req.body && req.body.url) || "");
  if (!/^https?:\/\//.test(url)) {
    return res.status(400).json({ error: "url must be http(s)" });
  }
  const code = Math.random().toString(36).slice(2, 8);
  const map = load();
  map[code] = url;
  save(map);
  res.json({ code, url });
});

app.get("/:code", (req, res) => {
  const map = load();
  const target = map[req.params.code];
  if (!target) return res.status(404).json({ error: "not found" });
  res.redirect(target);
});

app.listen(3000, () => {
  console.log("demo on :3000");
});

Use this manual test plan after server startup.

1. Start the server with node src/shorten.js.
2. POST a valid https URL to /shorten.
3. Open the returned code in your browser.
4. POST a non-http value and expect 400.
5. Confirm package.json is still unchanged.

That is the entire weekend demo surface.
It is enough for a short screenshot.
It is not a production shortening product.

Score the plan before you apply it

Agents hide installs inside friendly prose.
"Pull in a small UUID helper" means install.
You want a boring local scoring script.
Save this file as scripts/score-plan.js.

#!/usr/bin/env node
const fs = require("fs");

const file = process.argv[2] || "plan.md";
const text = fs.readFileSync(file, "utf8");

const rules = [
  [/npm i(nstall)?|yarn add|pnpm add/i, "package install"],
  [/package\.json/i, "manifest mention"],
  [/redis|rabbitmq|kafka|elasticsearch/i, "new infrastructure"],
  [/docker-compose|new service/i, "new service"],
  [/uuid|lodash|axios|prisma|mongoose/i, "popular extra library"],
];

let score = 10;
const hits = [];
for (const [re, label] of rules) {
  if (re.test(text)) {
    score -= 3;
    hits.push(label);
  }
}

console.log(JSON.stringify({ score, hits }, null, 2));
if (score < 7) process.exit(1);

A plan that mentions Axios should fail.
A plan that edits one route should pass.
Keep the threshold harsh on weekend nights.
Run the scorer before any git apply step.

node scripts/score-plan.js agent-plan.md

How the weekend actually runs

Use this sequence and do not reorder it.

1. Write WEEKEND_FREEZE.md before opening the agent.
2. Paste the freeze note into the first prompt.
3. Save the model plan as agent-plan.md locally.
4. Run node scripts/score-plan.js agent-plan.md first.
5. Run ./scripts/check-freeze.sh HEAD agent-plan.md next.
6. Apply source changes only after both pass.
7. Execute the five HTTP checks on port 3000.
8. Record skipped features in README.md before sleep.

If any numbered step fails, stop generation.
Cut scope again instead of adding packages.
The demo gets smaller and more honest then.

Draft the plan, then run the checker

You still need a model to draft plans.
You still need a machine to run checks.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

MonkeyCode's free model access can draft the plan.
The free server option can run check-freeze.sh.
Do not hand the model a blank weekend.
Hand it the freeze note and demo path.
Ask for files, not packages, in the plan.
Score that plan on the server next.
Only then apply a bounded source diff.

Paste a prompt with this exact shape.

Read WEEKEND_FREEZE.md before you answer.
Propose a patch for POST /shorten validation only.
Do not add packages or new services.
List every file you will touch.
If the freeze blocks the idea, reply SKIP.

If the reply contains an install, reject it.
The script remains the source of truth.
The model remains a draft engine only.

This article does not claim latency numbers.
It does not claim quotas or model names.
Those details change and stay unverified here.
Use free model access you already have.
Keep the checker local if that is simpler.

What you skipped on purpose

You skipped pretty HTML for the landing page.
You skipped login and session cookies.
You skipped rate limits on POST /shorten.
You skipped unique codes under collision risk.
You skipped extra test matchers from new packages.
You skipped deploy automation for this weekend.

Write the skip list into the README now.
Future you will thank present you later.
The agent will try to finish skipped items.
The freeze note is how you refuse that.

Add this fragment to README.md today.

## Out of scope this weekend
- auth
- unique codes
- analytics
- custom domains
- new npm dependencies

If it is not the demo path, skip it.
A skip list is part of the working demo.
Readers should see what you refused.

Limitations

This workflow fails closed on purpose tonight.
It will block legitimate library needs too.
That is the point for forty-eight hours.
It is wrong for a framework upgrade weekend.

The grep rules stay crude by design.
They can flag a harmless comment line.
They can miss a vendored copy-paste tree.
A copied node_modules folder still burns you.

The JSON file store corrupts under parallel writes.
You accepted that trade for a demo.
A weekend demo is not a multiplayer system.

Do not treat the freeze as license review.
It does not scan licenses or CVEs.
It only stops accidental dependency adds.

Who should not use this

Skip this during a production on-call shift.
Skip this when the task upgrades Express itself.
Skip this when compliance needs a new client.
Skip this if you cannot read the diff.
Skip this if uniqueness must be guaranteed.

People learning package managers should not freeze yet.
They still need to feel a real install.
This note is for repos with too many already.

Sunday checklist

Work through these five checks in order.

1. Re-run ./scripts/check-freeze.sh HEAD~20 on the branch.
2. Re-run the five manual HTTP checks again.
3. Paste the skip list into the README file.
4. Commit application files and data fixtures only.
5. Stop before adding just a little logging.

If step one fails, revert the diff.
If step two fails, fix code, not dependencies.
If you still want Redis, wait until Monday.

Close

Weekend agents optimize for looking complete fast.
You optimize for a demo you can explain.
A frozen lockfile is a design decision.
The script makes that decision visible locally.

If you try this, keep the note tiny.
Keep the demo path to two routes.
Let the skip list do the talking.