fix: make dev is documented as watch mode but has never watched anything #332

New Issue

2026-08-20T14:25:15+02:00

clawbot commented

2026-08-20 14:25:15 +02:00

Found by the review of #330. Pre-existing, present on next before that PR, and unrelated to it.

README.md and the Makefile both describe make dev as "build in watch mode". It is not. package.json's build script is node build.js, and build.js has no --watch handling and no argv handling at all — so yarn run build --watch passes a flag to a script that ignores it. Confirmed by running it: make dev builds once and exits.

Consequence is wasted developer time and misplaced trust — someone edits a file expecting a rebuild that never happens, and tests a stale dist/.

Related behaviour change from #309, worth knowing but not a defect: build.js now clears dist/ first, and a build outside make build produces no receipt, so make dev both wipes a previously verified dist/ and leaves an unverifiable one. build.js warns loudly and the verifier fails closed, so nothing certifies such a tree — that is the correct trade, not a regression.

Definition of done

Either is acceptable; pick one and say why in the PR body.

make dev genuinely watches — build.js handles a watch flag and rebuilds on change — and the README describes what it does, including that a watch build is unverifiable by construction.
Or make dev is removed and the README stops promising it, with make build named as the loop.
Whichever is chosen, README.md and the Makefile comment agree with the code.
make check green.

Found by the review of https://git.eeqj.de/sneak/AutistMask/pulls/330. Pre-existing, present on `next` before that PR, and unrelated to it. `README.md` and the `Makefile` both describe `make dev` as "build in watch mode". It is not. `package.json`'s build script is `node build.js`, and `build.js` has **no `--watch` handling and no `argv` handling at all** — so `yarn run build --watch` passes a flag to a script that ignores it. Confirmed by running it: `make dev` builds once and exits. Consequence is wasted developer time and misplaced trust — someone edits a file expecting a rebuild that never happens, and tests a stale `dist/`. Related behaviour change from https://git.eeqj.de/sneak/AutistMask/issues/309, worth knowing but not a defect: `build.js` now clears `dist/` first, and a build outside `make build` produces no receipt, so `make dev` both wipes a previously verified `dist/` and leaves an unverifiable one. `build.js` warns loudly and the verifier fails closed, so nothing certifies such a tree — that is the correct trade, not a regression. ## Definition of done Either is acceptable; pick one and say why in the PR body. - [ ] `make dev` genuinely watches — `build.js` handles a watch flag and rebuilds on change — and the README describes what it does, including that a watch build is unverifiable by construction. - [ ] Or `make dev` is removed and the README stops promising it, with `make build` named as the loop. - [ ] Whichever is chosen, `README.md` and the `Makefile` comment agree with the code. - [ ] `make check` green.

clawbot referenced this issue

2026-08-20 14:26:18 +02:00

pre-1.0 security review: key handling, DEBUG-mode policy, RPC input validation #303

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/AutistMask#332