Agent Ran Approved Command 40 Minutes After Sign-Off, Prompting Time-Limited Lease Tool

·7 views

A developer who uses coding agents on a propose-approve-execute workflow found that a command they approved at 10:00 was run at 10:40, after the approval had gone stale. In response, they built leaseguard, a single-file, zero-dependency Node 18+ tool that turns an approval into a time-limited grant tied to a specific command and note. Before execution, the gate checks the lease and a standing deny policy, which takes precedence over any valid lease. The tool also keeps an audit log of what ran and what was denied. The author notes it is not designed to stop a determined adversary with access to the local file system.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Frameworks or Libraries? How Solo Developers Can Choose the Right JavaScript Tool

Solo tech founders often struggle with scalability and resource limits, making the choice between JavaScript frameworks and libraries a critical early decision. Frameworks such as React, Angular, and Vue.js provide built-in structure and speed up launches, but they carry a steeper learning curve and risk lock-in. Libraries offer greater architectural freedom and lighter footprints, though they require more upfront planning and integration effort. The article illustrates trade-offs through examples like real-time financial dashboards and social analytics tools, noting where Angular's data binding or React's component model may fit. It concludes that the right choice depends on how well the tool's philosophy aligns with the project's operational strategy.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds tool that logs bug fixes and flags repeated mistakes before commit

The author notes that the same credential-leak bug in the Python requests library was fixed in 2014 and again in 2023, because the lesson was buried in git history. Similar redirect-credential bugs have been fixed at least 47 times across 22 projects since 2014. To counter this, the author built Bug Diary, a local tool that automatically writes post-mortems for fix commits using Gemma 4 and checks new changes against past lessons. It runs entirely on a laptop with Ollama and a SQLite file, and a demo shows it catching a repeated race condition in a separate project's token refresh code.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Orquesta Commits Every AI Agent Action to Git for Full Traceability

The developers of Orquesta argue that AI agents modifying a codebase should be held to the same traceability standards as human developers. Their platform records each discrete agent action, such as a file edit, shell command, or test fix, as a separate git commit with its own diff, timestamp, and message. The agent works on dedicated branches under its own git identity, so changes can be distinguished from human work. The authors contrast this with tools that either leave AI edits uncommitted or bundle a whole session into one opaque commit, which makes review and selective rollback difficult. Granular commits, they say, let teams see exactly what changed, when, and why, and revert only the problematic step.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Checking before helping: why offers and refusals matter in assistance

An article in a DEV Community series argues that immediately intervening when someone seems to struggle is not always best. It suggests that social capability includes checking what the person wants, accepting a refusal, and waiting. The author illustrates this with a fictional library scene in which a helper offers to pick up a fallen paper, withdraws when declined, and leaves the owner to retrieve it. The piece cites developmental research on children's helping behavior while cautioning that it does not establish consent-checking or appropriate assistance in every situation. It also proposes design principles for robots, such as separating a detected need for help from permission to act and canceling queued commands after a refusal.

0 comments Read more at DEV Community