Wave Code product guide

Review and test an AI-generated code change

A repeatable review process for checking correctness, scope, and sensitive data before using an agent result.

Start with the requirement

An answer that sounds complete is not proof that a change works. Write down the behavior you requested and the evidence that would demonstrate it. For a bug fix, reproduce the original failure before reviewing the proposed solution. For a new feature, identify the normal case, an empty input, and a failure case.

Read the diff before running it

Look at changed files, not just the final chat response. Check for unexpected dependency updates, deleted validation, broad exception handling, or hard-coded paths. Confirm that authentication and permission checks still protect the same operations. If a command would deploy, delete, migrate, or write to an external account, understand its effect before approving or executing it.

Run a meaningful check

Use your repository's documented commands. A typical JavaScript project might use these commands, but they are examples rather than universal instructions:

npm run typecheck
npm test
npm run build

If a script does not exist, inspect package.json or the project README instead of inventing a passing result. A successful build checks a different property from a functional test. For a UI change, also exercise the affected screen in a browser, including a narrow viewport and keyboard navigation.

Check the failure paths

Test a rejected input, a disconnected service, and a user without the required permission where relevant. Ask what happens if a request is submitted twice. For a change that calls an external service, use a test environment or a mocked response where possible. Do not trigger real purchases, messages, or destructive actions just to check a layout.

Record what was actually verified

A useful review note states the changed behavior, checks run, and remaining limits. For example: “The duplicate-item check now trims and compares case-insensitively. Existing unit tests pass. I checked the add-item form on mobile. Offline sync has not been tested.” This is more useful than an unsupported claim that everything is production-ready.

Protect sensitive information

Remove credentials, private keys, and personal data from prompts and screenshots unless the task requires them and you have permission. Review tool output before sharing it publicly. If a secret is exposed, rotate it; deleting it from a chat or commit does not invalidate the original credential.