Claude Code built the app. I refused to let it publish itself.

Description and use

Claude Code can rapidly build and preview an app, but publishing is a human‑initiated step to prevent accidental releases and protect secrets.

Problem

Ensuring that an AI coding agent can iterate on app development without automatically publishing the app, preserving human control over the release process.

Outcome

The author achieved a workflow where AI can rapidly iterate on code and preview results, while the decision to make the app public remains under human control, preventing accidental releases and protecting secrets.

Workflow

• 1. Agent calls create_app to get a starter and environment rules.
• 2. Agent calls write_files to apply changes and run esbuild, receiving compile.ok or error details.
• 3. Agent iterates on code based on compiler feedback, preserving failed builds as versions.
• 4. Developer reviews preview at https://<slug>--preview.drobek.app.
• 5. When satisfied, developer instructs agent to publish the selected compiled version via publish tool.
• 6. Agent publishes only upon explicit request, using OAuth scopes that separate read/write/publish rights.
• 7. Published app becomes available at https://<slug>.drobek.app; older compiled versions can be published to rollback code but not data.

Evidence

The coding agent should be fast inside the build loop. Publishing should remain an explicit human decision.

Source

The agent gets a loop, not a magic deploy button

Source

That final request matters. The Drobek agent instructions say to call publish only when the user asks.

Source

The OAuth grant also separates read, write, and publish scopes, so a client does not need deployment access just to inspect an app.

Source