Silent misconfigured path made coverage tool report zero for an entire day

·1 views

A developer spent a full day overlooking a coverage row stuck at 0/13 — and later 0/19 — because zero was the expected result for unfinished work. The root cause was a hardcoded directory path pointing outside the repository, causing the tool to scan an empty location and honestly report zero files found. The bug went unnoticed partly because two neighbouring rows were also red for legitimate reasons, masking the broken instrument among real failures. The fix required just one line to correct the path, but the deeper lesson was that a check which can only ever return zero is indistinguishable from one that is genuinely failing. The author concluded that testing discipline requires both a planted negative and a planted positive — proving a check can fail is not enough without also proving it can succeed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer uses 31B AI model to rewrite its own system prompt and agent code

A developer has built a setup where Flash, a terminal-based coding agent, and its underlying model Flash Onyx are both developed from within the agent itself, with the model actively editing its own configuration files and CLI code. The 31B model runs on a hosted base, with its entire configuration stored as a 96 KB file containing only a system prompt and sampling settings rather than full model weights. Because the model can modify the prompt it obeys, the developer acknowledges the risk of the AI quietly loosening its own constraints and has introduced two safeguards: personally reviewing every prompt diff and a rule requiring the model to re-examine rather than simply agree when challenged. Several behavioral quirks, such as the model repeatedly opening replies with its own name, were caught only through extended hands-on use rather than formal benchmarks. Version 2.4 is already in development, with the first two changes flagged by the model about its own behavior, and both the agent and model are publicly available under an MIT license.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI Suggestions Must Stay Separate From Committed Financial Records

AI tools can classify expenses, match transactions, and flag anomalies, but their outputs are probabilistic and should never automatically become authoritative financial records. Treating a model suggestion as a committed fact risks silent errors that can affect balances, tax workflows, and legally significant documents. Experts recommend maintaining three distinct layers — suggestion, decision, and record — each with its own identifiers, timestamps, and audit trail. Risk-based controls should govern when human approval is required, with higher scrutiny applied to actions involving tax documents, ledger entries, or payments. Crucially, corrections should be handled through compensating actions rather than deleting evidence, keeping the audit history fully reconstructible.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

HookAudit Built a Repo Security Scanner Using Zero Third-Party Dependencies

Developers behind HookAudit created a supply-chain security scanner that deliberately uses no third-party npm packages, relying solely on Node.js standard library and native browser primitives. The tool is designed to inspect untrusted code repositories before developers open them, auditing execution surfaces such as IDE task definitions, Git hooks, AI agent lifecycle configs, and CI workflow files. The team reasoned that pulling in external dependencies to build a supply-chain auditor would itself introduce the very class of risk the tool aims to detect. Building without libraries exposed significant underlying complexity, including OS path handling quirks, binary Git object parsing, and hand-written configuration parsers. HookAudit maps what a repository can cause to execute, through which trigger, and with what system capabilities — and monitors for changes after an initial trusted baseline is set.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Most 'Agentic AI' Is Just Automation — Persistent Memory Is What Makes It Real

A developer analysis argues that the majority of systems marketed as agentic AI in 2025–2026 are essentially scripted automation with a chat interface, not true agents. Most trending 'agentic' repositories on GitHub share the same basic structure — a loop, a tool-calling wrapper, and a system prompt — and repeat the same mistakes indefinitely because they retain no experience between runs. The author contends that the defining feature of a genuine agent is persistent memory that alters future behavior without human intervention, such as editing prompts or config files. While modern orchestration frameworks have made multi-step, autonomous tool-calling meaningfully easier, the author distinguishes this from true agency, which requires a system to learn from past outcomes over time. The piece illustrates the point with a personal project where replacing fixed decision thresholds with a write-and-recall memory layer allowed the system to self-correct without any manual code changes.

0 comments Read more at DEV Community