AI Chat Tool Sent Files After Consent Checkbox Was Unchecked, Lab Test Shows

·1 views

A developer reproducing a bug in MonkeyCode's AI coding chat found that file attachment data was still sent to the server even after the 'Include current file' checkbox was visually unchecked. The issue arose during a specific sequence: a file was attached and a prompt sent, the checkbox was unchecked mid-stream, and then a Retry button was pressed after a network timeout. Because the retry reused a frozen request snapshot rather than reading the checkbox's current state, the file buffer left the browser without any user warning. VoiceOver and other screen-reader cues described the interface as idle and honest, masking the data transmission from keyboard-only users. The author argues the flaw is simultaneously a streaming bug, a forms bug, and a privacy bug, and recommends that retry actions either lock to a confirmed snapshot taken at send time or require fresh consent before resubmitting.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

RTK Open-Source Tool Cuts AI Agent Token Costs by Up to 90% via CLI Filtering

RTK (Rust Token Killer) is an open-source command-line proxy built in Rust by rtk-ai, designed to reduce the volume of terminal output consumed by AI coding agents such as Claude Code, Cursor, and Codex. As developers rely more on AI agents for terminal tasks, verbose logs from tools like git and test runners rapidly fill LLM context windows, raising API costs and reducing efficiency. RTK intercepts shell commands and compresses stdout output before it reaches the agent, cutting token consumption by 60% to 90% across common developer workflows. The tool compiles to a single native binary with sub-10ms overhead, operates fully offline, and supports tailored filters for over 100 developer tools including pytest, eslint, Docker, and cargo. RTK can be installed via Homebrew or Windows Package Manager and integrates with agent environments through native lifecycle hooks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Single stale hash entry caused 29 of 59 test failures in one config file

A software project using hash-based freshness pins — rows that record file checksums to detect stale derived data — saw 29 out of 59 tests fail due to a single unrefreshed hash entry. The hash-refresh tool was only designed to update rows under one specific config header, missing a duplicate entry for the same file stored under a different header roughly 5,000 lines away. Because the test suite reads the pin table once and then runs all assertions against it, one broken row cascaded into 29 failures — not 29 separate defects. The fix was to retire the duplicate row rather than teach the tool a second header, since maintaining two cells for one fact was identified as the root defect. A supplementary control test also confirmed that migrating citations from line numbers to block IDs prevents silent breakage when lines are inserted above a referenced block.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Standard JSON Schema Aims to Unite JavaScript Schema Libraries Under One Spec

JavaScript developers have long relied on JSON Schema to describe and validate data structures, but the rise of custom schema libraries like Zod, Valibot, and ArkType created fragmentation, with each library using incompatible internal representations. To address this, the creators of Zod, Valibot, and ArkType collaborated to first create Standard Schema, then extended it with Standard JSON Schema. Standard JSON Schema defines a common way for schema libraries to expose JSON Schema output so that other tools and libraries can consume it without needing to know which library produced it. The initiative aims to reduce ecosystem fragmentation and preserve format metadata that is currently lost when tools like tRPC infer types and convert them to JSON Schema. Broader adoption of the standard is seen as a meaningful step toward better interoperability across the JavaScript ecosystem.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

One Verb, One Timeout: A Developer's Framework for Focused Weekend Builds

A software developer has shared a structured approach to prevent weekend coding sessions from dissolving into unproductive AI chat loops. The method centers on defining a single action verb, a strict 90-second wall-clock timeout, and three plain text files on disk before any code is written. A minimal Python script demonstrates the concept by grouping pytest failures by file path without any model calls, producing a verifiable JSON output. The timeout itself is treated as the deliverable — if the job misses the window, it is logged as a failure rather than retried indefinitely. The framework argues that a shareable, paste-ready terminal command is a more honest demo than an imaginary UI built through endless prompt tweaking.

0 comments Read more at DEV Community