Sponsored

Stop vibe-debugging.

Every exception, every backtrace, grouped so you see patterns, not noise.

Start free trial
  1. cheat-sheets
  2. /pre merge-verification

Pre-Merge Verification

Last reviewed: June 2026

Full guide: Verifying AI Output · Testing AI-Generated Code

Quick Commands

git diff                          # scope check
git diff --stat                   # file list only
npm run lint                      # style and imports
npm run build                     # types and compile
npm test                          # behavior
grep -rn "process.env" src/       # new env vars
grep -rE "sk-|AKIA|Bearer " src/  # leaked secrets

Pre-Merge Checklist

1. Diff review

  • [ ] Only files you named in the prompt changed
  • [ ] No surprise edits to package-lock.json, CI, or config
  • [ ] No large deletions — agents remove "unused" code others import
  • [ ] Diff matches the request — trim drive-by refactors

2. Build and types

  • [ ] npm run lint — zero new errors
  • [ ] tsc --noEmit or npm run build — no type errors
  • [ ] Every new import resolves (no phantom paths)

3. Tests

  • [ ] npm test — all pass
  • [ ] New tests assert behavior, not just toHaveBeenCalled
  • [ ] Edge cases covered (empty input, errors, 401)

4. Dependencies

  • [ ] No new package unless justified
  • [ ] npm view <package> version — real package, active maintenance
  • [ ] No duplicate of an existing dependency

5. Environment and secrets

  • [ ] New process.env.* vars documented and set locally
  • [ ] No hardcoded API keys, tokens, or passwords
  • [ ] No .env values pasted into prompts

6. Security (auth, input, data)

  • [ ] Server-side auth on every protected route
  • [ ] Parameterized queries — no SQL string concat
  • [ ] User input sanitized before render (dangerouslySetInnerHTML)
  • [ ] No eval, new Function, or shell from user input

7. Runtime smoke test

  • [ ] Feature works in browser or CLI
  • [ ] Error states tested (network fail, empty input)
  • [ ] UI changes: keyboard nav and labels if applicable

Diff Red Flags — Reject Immediately

Red flagAction
Touches files you didn't nameRevert those files
Adds library for one-line fixRe-prompt without new deps
Same test fails twiceRevert; smaller scope + paste exact error
Auth/payments changed without reviewHuman security review required
Formatted 20 unrelated filesRevert formatting; narrow prompt

Re-Prompt Template

The previous change failed. Revert approach X.

Error (exact output):
[paste stack trace]

Only modify: [file paths]
Do not: [add deps, touch other files]

Verify with: [npm test -- Foo, npm run lint]

Fake Test Detection

Read test bodies — reject if:

  • Every dependency is mocked and nothing real is exercised
  • Assertions only check toBeDefined() or snapshot of mocks
  • Test file added but no failure case covered