Git commit with pathspec bypasses index, commits unsaved disk version instead

·1 views

A documented Git behaviour causes 'git commit' with a named pathspec to bypass the staging index and commit the working-tree version of a file directly from disk. This means any staged changes are silently discarded, and the committed file reflects whatever state it was in at the moment of the commit — including partially written content. The author discovered this after two real commits captured incomplete file versions, one of which truncated an audit document at 74 of 198 lines. The '-i' flag does not fix the issue, as named paths still pull from disk regardless. The recommended workaround is to stage changes deliberately and run 'git commit' without any pathspec, ensuring only reviewed, indexed content is committed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer uses 31B AI model to rewrite its own system prompt and agent code

A developer has built a setup where Flash, a terminal-based coding agent, and its underlying model Flash Onyx are both developed from within the agent itself, with the model actively editing its own configuration files and CLI code. The 31B model runs on a hosted base, with its entire configuration stored as a 96 KB file containing only a system prompt and sampling settings rather than full model weights. Because the model can modify the prompt it obeys, the developer acknowledges the risk of the AI quietly loosening its own constraints and has introduced two safeguards: personally reviewing every prompt diff and a rule requiring the model to re-examine rather than simply agree when challenged. Several behavioral quirks, such as the model repeatedly opening replies with its own name, were caught only through extended hands-on use rather than formal benchmarks. Version 2.4 is already in development, with the first two changes flagged by the model about its own behavior, and both the agent and model are publicly available under an MIT license.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI Suggestions Must Stay Separate From Committed Financial Records

AI tools can classify expenses, match transactions, and flag anomalies, but their outputs are probabilistic and should never automatically become authoritative financial records. Treating a model suggestion as a committed fact risks silent errors that can affect balances, tax workflows, and legally significant documents. Experts recommend maintaining three distinct layers — suggestion, decision, and record — each with its own identifiers, timestamps, and audit trail. Risk-based controls should govern when human approval is required, with higher scrutiny applied to actions involving tax documents, ledger entries, or payments. Crucially, corrections should be handled through compensating actions rather than deleting evidence, keeping the audit history fully reconstructible.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

HookAudit Built a Repo Security Scanner Using Zero Third-Party Dependencies

Developers behind HookAudit created a supply-chain security scanner that deliberately uses no third-party npm packages, relying solely on Node.js standard library and native browser primitives. The tool is designed to inspect untrusted code repositories before developers open them, auditing execution surfaces such as IDE task definitions, Git hooks, AI agent lifecycle configs, and CI workflow files. The team reasoned that pulling in external dependencies to build a supply-chain auditor would itself introduce the very class of risk the tool aims to detect. Building without libraries exposed significant underlying complexity, including OS path handling quirks, binary Git object parsing, and hand-written configuration parsers. HookAudit maps what a repository can cause to execute, through which trigger, and with what system capabilities — and monitors for changes after an initial trusted baseline is set.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Most 'Agentic AI' Is Just Automation — Persistent Memory Is What Makes It Real

A developer analysis argues that the majority of systems marketed as agentic AI in 2025–2026 are essentially scripted automation with a chat interface, not true agents. Most trending 'agentic' repositories on GitHub share the same basic structure — a loop, a tool-calling wrapper, and a system prompt — and repeat the same mistakes indefinitely because they retain no experience between runs. The author contends that the defining feature of a genuine agent is persistent memory that alters future behavior without human intervention, such as editing prompts or config files. While modern orchestration frameworks have made multi-step, autonomous tool-calling meaningfully easier, the author distinguishes this from true agency, which requires a system to learn from past outcomes over time. The piece illustrates the point with a personal project where replacing fixed decision thresholds with a write-and-recall memory layer allowed the system to self-correct without any manual code changes.

0 comments Read more at DEV Community