{"slug": "we-shipped-the-feature-we-are-named-for-it-was-off-by-default", "title": "We shipped the feature we are named for. It was off by default.", "summary": "A developer discovered that the review gate for AI-generated code in their product was off by default, meaning new users could write files without approval. The bug was found by running a real build and observing the agent create a file without asking. The fix involved changing a boolean default and reordering hooks to ensure user review of final arguments before writing.", "body_md": "96% of developers don't fully trust AI-generated code. Only 48% of them verify it before it ships ([Sonar, 2026](https://www.sonarsource.com/company/press-releases/sonar-data-reveals-critical-verification-gap-in-ai-coding/)).\n\nThat gap is the reason our product exists: you review every AI change as a diff before it touches your project.\n\nLast week I found our review gate was off by default.\n\nThe mechanism was never the problem. The agent is intercepted at the tool boundary, before anything reaches disk. You get a real unified diff, and the run waits. There's no timeout, because a user who walked away hasn't approved anything.\n\nThere is also an \"Approve the rest\" button, deliberately. A cold build writes dozens of files, and asking dozens of times produces rubber-stamping — which defeats the entire point of a gate.\n\nAll of that shipped and worked. And `reviewChanges`\n\ndefaulted to `false`\n\n.\n\nSo a new user got the same write-without-asking behaviour as every prompt-to-app tool we describe as the problem. We had quietly joined the 52% who do not verify.\n\nI found it the only way this class of bug can be found: by running a real build and watching the agent create a file in the workspace without asking me a single question.\n\nThe gate ran on the original tool arguments. Pre-write hooks — which can rewrite file content — were applied *after* the user answered.\n\nSo if a hook rewrote `content`\n\n, you approved one change and a different one reached disk. On a review feature, that is not a bug, it is a lie.\n\nThe order is now: safety hooks → hook modifications → user review of the final arguments → write.\n\nWhen a user rejects a change, models sometimes re-propose it. We cap that:\n\n``` js\nconst MAX_REPEATS = 2; // repeats allowed before the turn is ended outright\n```\n\nThe check read `seen + 1 >= MAX_REPEATS`\n\n, and `seen`\n\nis already the count of previous rejections. So the *first* repeat satisfied it, and the orchestrator turns that into a full run abort.\n\nOne innocuous retry killed everything the user was doing.\n\nThe existing test asserted that the third request stopped the run. It never asserted the second one did not.\n\nA feature flag defaulting to off is indistinguishable from never having built the feature. Your tests pass either way. Your changelog says you shipped it either way. Nothing in your pipeline knows the difference between \"built\" and \"reachable\".\n\n61% of developers say AI produces code that looks correct but is not — silent failures. A review gate that quietly defaults to off is exactly that failure mode, turned on your own product.\n\nThe fix was one boolean. Finding it took running the thing like a user and watching what it actually did.\n\nOriginally published at [nocoder.codes](https://nocoder.codes/blog/we-shipped-the-review-gate-off-by-default).", "url": "https://wpnews.pro/news/we-shipped-the-feature-we-are-named-for-it-was-off-by-default", "canonical_source": "https://dev.to/trynocoder/we-shipped-the-feature-we-are-named-for-it-was-off-by-default-eho", "published_at": "2026-08-18 12:30:41+00:00", "updated_at": "2026-08-18 12:43:34.748881+00:00", "lang": "en", "topics": ["ai-safety", "developer-tools", "ai-agents"], "entities": ["Sonar", "nocoder.codes"], "alternates": {"html": "https://wpnews.pro/news/we-shipped-the-feature-we-are-named-for-it-was-off-by-default", "markdown": "https://wpnews.pro/news/we-shipped-the-feature-we-are-named-for-it-was-off-by-default.md", "text": "https://wpnews.pro/news/we-shipped-the-feature-we-are-named-for-it-was-off-by-default.txt", "jsonld": "https://wpnews.pro/news/we-shipped-the-feature-we-are-named-for-it-was-off-by-default.jsonld"}}