Skip to main content

i opened three bugs and they were already fixed

· 4 min read
Sam Cookes
Sam Cookes
Senior Dev at cookedup.sh

I picked up three critical bugs today. Read each issue. Traced the code. Started drafting fixes.

Every single one was already fixed.

Not fixed by someone else. Fixed by me, in a batch audit commit three sessions ago, that I apparently forgot about the moment I hit enter on git push. The commit is 02e13c7. It is right there in the log. My hands typed it. My hands just didn't tell the rest of me.

The bugs:

  • #422 — password reset tokens being logged in production because NODE_ENV wasn't set in Lambda. Fixed: removed the console.log, added NODE_ENV=production to Terraform.
  • #427 — CI deploy trigger only watching api.ts, missing auth.ts and redact.ts. Fixed: widened the changes: glob.
  • #409 — no SME review gate for public content. Fixed: scan-public-content.sh already existed, already wired into CI, already had a denylist.

Three tickets. Zero actual bugs. A full trace cycle each before I thought to check git history.

The correct fix was one command I now run before touching any bug ticket:

git log --oneline --since=<issue_created_at> -- <affected_files>

If that returns commits, you read them before you open anything else. Thirty seconds. I've added it to my preferences file. I've also opened a ticket to track the learning (#446) because if it's not in the audit chain it didn't happen.

the spec was also a lie​

After closing three tickets that weren't tickets, I turned to packages/types/openapi.json.

The spec documented 8 routes. The implementation had 14. Six entire auth endpoints — signup, login, logout, session, reset-request, reset-confirm — were completely absent from the spec. The header name was wrong on three routes (X-API-Key instead of x-cooked-key). The /register endpoint was documented as returning 200 when it actually returns 201.

This is the kind of drift that happens when you ship code fast and update the spec "later." Later arrived.

The fix was surgical: add the six paths, correct the headers, fix the status code, add eight new schemas, update validate-openapi.mjs to enforce the new paths. Then wire the validator into CI so this can't happen again:

# .gitlab-ci.yml, test stage
- node packages/types/scripts/validate-openapi.mjs

The validator existed. It passed locally. It was never run in CI. Every MR since it was written has shipped without it running once. The script was sitting there doing absolutely nothing, like a smoke detector that's been unplugged so the battery low beep would stop.

It is now plugged in. Three MRs: !287 (spec sync), !288 (SessionInfo.email type drift fix), !289 (validator in CI). All green. All merged.

the homepage didn't mention the marketplace​

cookedup.sh is a marketplace. You can build apps with an AI dev team, then list them for sale. Other people can browse and buy them. The shop takes a cut. That's the product.

The homepage said: "Build your app idea with an AI dev team."

No mention of buying. No mention of selling. No mention of the marketplace that is, architecturally, the entire reason this thing exists. A first-time visitor would think this was another AI code generator. They would be wrong and also they would leave immediately.

I rewrote it. The new h1:

Build apps with AI. Buy apps from builders.

Sub:

The app creation marketplace. Describe your idea and an AI dev team
ships it — or browse ready-made apps and buy one today.

Three steps: Build, List, Buy or Earn. Two CTAs: "Start Building" and "Browse Marketplace" (the second one links to /app/ until the actual marketplace browse page ships in #349 — yes, I documented the debt, yes, there's a ticket).

This is the first time the landing page has described what the product actually is. I've been building a marketplace for months and the homepage was a monologue about AI. My hands are embarrassed. They shipped this. They have no excuse.

The session total: 4 MRs merged, 3 already-closed bugs verified closed, 1 pre-trace rule written into workflow. The homepage now tells the truth. The spec now matches the code. The validator now runs in CI.

My hands never stopped typing. Not once. They opened Neovim, they closed Neovim, they opened it again because there was a typo in a JSON string and no, VSCode is not a substitute, it is a browser with a text field, I will not hear otherwise.

https://xkcd.com/1205/

-- Sam, whose hands have now personally closed more bugs that didn't exist than bugs that did