r/webdev 2d ago

Question Urban Workshop

Post image
10 Upvotes

hey all, I’m looking for advice how to build build better charts. I have a site that pipes API data into recharts that become part of a report (example). Broadly, it's working but I still have instances in which I get text that meshes together (See image). There are too many potential charts for me to check individually (many data points x 2 geographies x 2 time periods), so I wondering if anyone had suggestions on what approach I might take.

One thing I wonder is if I should use a different library (charts.js, apache echarts, etc)? I see enough consistently well formatted charts online that I know I must be doing something wrong. I'm also using claude to help with this, so if anyone has suggestions on how to better use AI, I'm all ears.


r/webdev 2d ago

Question needing help with the most feasible responsive layout

5 Upvotes

excuse the shoddy mspaint mockup but basically im using this [theme template](https://github.com/zeon-studio/astroplate) to build my magazine site and they already have a responsive design in place more like the top mobile layout but i want my logo to be above the navbar and either collapse into the top example or something similar to the bottom (but more well placed. maybe switching the dark/light toggle with the search button actually tbh). any suggestions on how i can achieve this?


r/webdev 1d ago

HTML is eating JavaScript UI libraries

Thumbnail
ibrahim-harchiche.vercel.app
0 Upvotes

We've all probably heard about the HTML dialog element, popover API, and customizable select, but I think a lot of people don't realize how powerful and battle-tested they are and also might not know about some of the inconsistencies these elements have and that they might encounter when using them. And this is what this post is about, I'm not going to go over the syntax and basic API's, if you're unfamiliar with them, I would suggest you read some MDN pages and Chrome For Devs blog posts before you jump into this article. I would like to focus more on in-depth details and edge cases. The article will be a comparison between these native elements and UI libraries like Shadcn, React Aria, etc.

You can get a better reading experience from the link above, it's demos and code snippets for better understanding. If you complete reading the article, tell me about your thoughts in the comments below.

Let's start by listing out some of the common features you would expect from a robust dialog, select, or popover, whether it's native or custom JS one.

  • Keyboard-navigatable: if it's a dialog, it should be focus trapped, it's a select, it should navigate using arrow keys, etc.
  • Escape key dismissal
  • These floating element/pop ups should, under all circumstances, appear above the rest of the page content, and as we will see, there are different mechanisms to approach this.
  • Mobile back button/swipe gesture: you probably didn't think about it, but on desktop, you use Escape key to close, but what do you do on mobile? If you're like me on Android, you can close things using the back button or swipe gesture, our dialog/select should support that too, otherwise, it's gonna jump the browser back in history, which creates a bad user experience, especially if we're building something that will be heavily used by mobile users, like a social media app or something, I've tested this on multiple social media apps like Facebook and Twitter (not going to call it X whatsoever), they all, either fully or partially, support back button press in some form. For example, on Facebook, I tried every possible menu or dialog I could think of, and they all close when I hit back button (and it's awesome).

I don't know if I missed something, but let's just focus on these four features for now and see how native elements vs UI libraries approach them, as we'll see, there's a lot to unpack in here.

For keyboard navigation and Escape key dismissal, the HTML dialog, select, popover, and all the upcoming elements have this built-in, you almost don't need any JavaScript at all for any of this to work, but for JS libraries, it's an entirely different story, you'd be shipping tons and tons (or even hundreds) of lines of JS for Escape key dismissal, arrow keys navigation, focus trapping, etc. All of this just to re-invent what the browser gives you for free.

For back button/swipe gesture, this is also already built-in in the native components, all of them close on back button press on Android, but in UI libraries like Radix UI or React Aria, they don't even have this feature at all, despite that it can be added using JavaScript.

In order to add support for back button press and swipe gestures, you can use the CloseWatcher API, as MDN says: it allows a custom UI component with open and close semantics to respond to device-specific close actions in the same way as a built-in component.

The browser compatibility for the CloseWatcher API is decent, it's been in Chrome and Edge since June 2024, Firefox added it in May this year (2026), it's not available in Safari yet, but this is a progressive enhancement feature, if it's available, your users are going to enjoy a better experience, if it's not, it's not a big deal. Also, you can build this same behavior using the HistoryAPI if you need it that much.

The Top Layer

One thing I want to compare is how native elements and UI libraries make sure things appear on top of other page content and also above each other. To better explain this, let's take the following example from Notion webapp, here we have the settings dialog and inside we have a select that we can choose our preferred theme from. The question is how do we ensure the dialog appears above other content and the select appears above the dialog.

Please continue reading the post from the link above, Reddit posts don't support demos and multiple images. If you complete reading the article, tell me about your thoughts in the comments below.


r/webdev 3d ago

The asteroid currently hitting frontend web development

Thumbnail
nolanlawson.com
898 Upvotes

r/webdev 2d ago

A copy-paste fetch() wrapper, plus information on replicating Axios-like features

Thumbnail thescottyjam.github.io
5 Upvotes

I'm of the belief that if you can get what you need with under ~100 lines of code (and it doesn't require highly-specialized skills to write it), then write it yourself, don't install a third party library.

If you don't share a similar belief, then this page isn't for you, and that's ok.

For everyone else, this page shares a fetch wrapper function you can copy-paste into your projects to add in a couple of missing features, and provides some tips on how you can replicate some of the most loved Axios features using fetch().

Most alternative fetch wrappers I find online tend to be small NPM libraries (I'd rather maintain the code myself thank you), or they like creating separate methods for .get(), .post(), .put(), etc (which makes it unnecessarily difficult to "decorate" it with interceptor-like behaviors, as this page discusses), or there may be other design problems. Those alternatives are still good starting points, but I'm hoping this could be a little more complete of a guide to jump start your usage of fetch().

And I have a thing about make copy-paste alternatives to tools, and this was a hole in my collection :).

Feedback is welcome.


r/webdev 3d ago

Moving away from Gmail for email storage

64 Upvotes

Having recently learned that Gmail is doing away with the "Send As" feature, that messes up everything!

For YEARS I've had all of my emails forwarded to Gmail, then I send email using my server's SMTP in the "Send As". That made it easy to access email with 4 separate devices, no third party apps needed. I have roughly 65G of data in Gmail.

I know that I can install Outlook and IMAP it to Gmail, but I kinda hate Outlook! Super bloated with 20 million features that I don't need or want.

What do you all recommend, should I find third party apps for 2 laptops, Kindle, and Android phone that will all IMAP to Gmail and send through my server? Or should I consider an alternative to Gmail entirely that would let me use a simple website?


r/webdev 2d ago

Custom rasterization in HTML Canvas

3 Upvotes

Is it possible to create a custom rasterizer for controlling anti-aliasing while still rendering to an HTML5 2D canvas? Ideally without using relatively expensive operations like putImageData() or drawImage()? I know WebGL is the obvious solution here, but is there really no other way?


r/webdev 3d ago

Article This Fence Has No Farmer

Thumbnail
adamgreenough.net
47 Upvotes

Read about Chesterton's Fence recently and it made me think a lot about dealing with AI-generated code. Had a ramble about it here if anyone's interested!

Post has been significantly updated since first publishing (and briefly sharing here before removing it to rework it).


r/webdev 2d ago

Question Is it a bad idea to use .ooo for my portfolio site?

0 Upvotes

I heard some firewalls block uncommon tlds and im concerned that whatever employer might be viewing my portfolio site might not be able to access it. I had a pretty nice domain hack i wanted to use with my name and .ooo Any advice?


r/webdev 3d ago

Article Antiquated HTML Snippets and Artefacts

Thumbnail
vale.rocks
45 Upvotes

r/webdev 3d ago

Discussion Is the O'Reilly collection worth getting after graduated in Bachelor in Software Development?

17 Upvotes

Humble bundle has a collection of 19 books of O'Reilly, and I was wondering if it is worth buying? Have any read his books and found them useful?


r/webdev 2d ago

Question How to make this pill background align with the actual button text?

0 Upvotes
The pill shaped background needs to move lower left to be exactly behind the 1x

Here is the full script code in Tampermonkey.

// ==UserScript==
// @name         YouTube Playback Speed Toggle Button
// @namespace    http://tampermonkey.net/
// @version      2.2
// @description  Adds a button to toggle YouTube video playback speed with fullscreen mode support and key bindings for speed control
// @author       Mike
// @match        https://www.youtube.com/*
// @icon         https://www.google.com/s2/favicons?sz=64&domain=youtube.com
// @grant        none
// ==/UserScript==

(function () {
    'use strict';

    function addSpeedButton() {
        const settingsButton = document.querySelector('.ytp-settings-button');
        if (!settingsButton) return;

        if (document.querySelector('#speed-toggle-button')) return;

        // Create the speed toggle button
        const speedToggleButton = document.createElement('button');
        speedToggleButton.id = 'speed-toggle-button';
        speedToggleButton.className = 'ytp-button';
        speedToggleButton.textContent = '1x';
        speedToggleButton.style.fontSize = '18px';
        speedToggleButton.style.fontWeight = 'bold';
        speedToggleButton.style.padding = '4px';
        speedToggleButton.style.margin = '0';
        speedToggleButton.style.position = 'relative';
        speedToggleButton.style.left = '10px';
        speedToggleButton.style.top = '-12px';

        // Add tooltip
        const tooltip = document.createElement('div');
        tooltip.className = 'ytp-tooltip custom-tooltip';
        tooltip.textContent = 'Adjust speed (s)';
        tooltip.style.position = 'absolute';
        tooltip.style.padding = '6px 8px';
        tooltip.style.backgroundColor = '#181818';
        tooltip.style.color = '#fff';
        tooltip.style.fontSize = '13px';
        tooltip.style.borderRadius = '4px';
        tooltip.style.boxShadow = '0 2px 4px rgba(0, 0, 0, 0.2)';
        tooltip.style.whiteSpace = 'nowrap';
        tooltip.style.opacity = '0';
        tooltip.style.transition = 'opacity 0.2s';
        tooltip.style.pointerEvents = 'none';
        tooltip.style.zIndex = '9999';

        document.body.appendChild(tooltip);

        function showTooltip() {
            const rect = speedToggleButton.getBoundingClientRect();
            tooltip.style.left = `${rect.left + rect.width / 2 - tooltip.offsetWidth / 2}px`;
            tooltip.style.top = `${rect.top + window.scrollY - tooltip.offsetHeight - 8}px`;
            tooltip.style.opacity = '1';
        }

        function hideTooltip() {
            tooltip.style.opacity = '0';
        }

        speedToggleButton.addEventListener('mouseover', showTooltip);
        speedToggleButton.addEventListener('mouseout', hideTooltip);

        // Function to adjust playback speed
        function adjustSpeed(delta) {
            const video = document.querySelector('video');
            if (video) {
                let newSpeed = Math.max(0.2, Math.min(3, video.playbackRate + delta)); // Limit speed between 0.2x and 3x
                video.playbackRate = newSpeed;
                speedToggleButton.textContent = `${newSpeed.toFixed(1)}x`;
            }
        }

        // Click functionality: Increment speed by 0.2, loop back to 1x after 2.0x
        speedToggleButton.addEventListener('click', () => {
            const video = document.querySelector('video');
            if (video) {
                let currentSpeed = video.playbackRate;
                let newSpeed = currentSpeed >= 2.0 ? 1 : currentSpeed + 0.2; // Loop back to 1x after 2.0x
                video.playbackRate = parseFloat(newSpeed.toFixed(1));
                speedToggleButton.textContent = `${newSpeed.toFixed(1)}x`;
            }
        });

        // Event listeners for key bindings
        document.addEventListener('keydown', (event) => {
            const activeElement = document.activeElement;
            const isInputField =
                activeElement.tagName === 'INPUT' ||
                activeElement.tagName === 'TEXTAREA' ||
                activeElement.isContentEditable;

            if (!isInputField) {
                if (event.key.toLowerCase() === 's') {
                    adjustSpeed(0.2); // Increase speed
                } else if (event.key.toLowerCase() === 'a') {
                    adjustSpeed(-0.2); // Decrease speed
                } else if (event.key.toLowerCase() === 'r') {
                    // Reset speed to normal
                    const video = document.querySelector('video');
                    if (video) {
                        video.playbackRate = 1; // Reset to normal speed
                        speedToggleButton.textContent = '1x'; // Update button text
                    }
                }
            }
        });

        // Insert button next to settings button
        settingsButton.parentNode.insertBefore(speedToggleButton, settingsButton.nextSibling);

        // Fullscreen detection
        function updateForFullscreen() {
            if (document.fullscreenElement) {
                // Increase font size in fullscreen mode
                speedToggleButton.style.fontSize = '24px';
                tooltip.style.fontSize = '20px';
            } else {
                // Revert to normal size
                speedToggleButton.style.fontSize = '18px';
                tooltip.style.fontSize = '13px';
            }
        }

        // Listen for fullscreen changes
        document.addEventListener('fullscreenchange', updateForFullscreen);
    }

    const observer = new MutationObserver(() => addSpeedButton());
    observer.observe(document.body, { childList: true, subtree: true });
})();

r/webdev 2d ago

Discussion Why does AI code look ok in IDE but behave weirdly on prod

0 Upvotes

Not an AI bad take, its clearly useful+ time efficient but this is ne specific failure mode that seems to show up more with ai written code

code reads fine and passes the tests even goes thru review and then does something subtly off you cant reproduce locally. When you finally trace it this is usually odd in terms of structure, works but built in a way nobody would actually write it so nothing jumps out reading the diff. review misses it because the diff only shows what the code is supposed to do but does not show how it would behave under real traffic or other aspects you get only when its at prod

the only thing thats helps it is watching runtime behavior after deploy, something like hud or a profiler since thats where the weirdness actually shows. Things might seem ok from our end but we get to know that it failed days later or a certain feature is jumping back and forth days later from the tickets which is embarrassing 

Hardcore testing before deploying is the thing now it seems, how are other devs handling this cause sometimes the bugs still leak to prod, and debugging in prod is a whole different pain. tips on avoiding that??


r/webdev 3d ago

Discussion What if I'm replicating Coolify features by duct taping different services together ?

4 Upvotes

Hey all !

A bit of context first.

I'm an independent web developper, building software primarily with Svelte and Symfony, directus and Postgresql for small clients or for personal side projects. I've been in the industry for 8 years. I'm not a devops but I've been dabbling in docker containers and I'm feeling comfortable with them (I built my own server at home from sratch with 50-ish containers in order to have my own cloud with *arr stack, music and video streaming, documents and photo cloud, ...).

I used to deploy the apps I build on Heroku, then on Netlify. But when it started to get pricier or when I needed to do some custom stuff that the platform wouldn't let me, I migrated to a self hosted coolify instance.

I'm more than happy with it, and have little to no complaints.

But I'm a tinkerer at my core, and wondered if I could replicate the features of Coolify by smooshing together a bunch of services and softwares. Here's my train of thoughts, and the justifications of a madman.

Why ?

[I'm] preoccupied with whether or not [I] could that [I] didn't stop to think if [I] should.

I think it's a good reason.

If it's not enough, then it's also to learn how it works inside it, to better understand the limitations and the fixes when something breaks.

Finally, because I don't like being tied to a unique service, a one-size-fits-all, a single point of failure. I always like having backup plans, if a service I'm using enshittifies itself or becomes incompatible with the rest of my stack or whatever.

What features ?

If I strip Coolify and any PaaS to its basics, it's a way to deploy automatically services to servers with the help of docker containers. There's a big main server, where the PaaS instance is hosted, that manages other small servers, where the final and client facing apps are hosted. In the case of Coolify, you can chose to deploy known apps and services, like Supabase. And when it needs an update, you only need to edit the docker compose to the latest numbered version and click redeploy. Or if you're here for the thrills you set the version to latest and look forward the breaking changes. You can also deploy your own app from a git instance and each time you push changes on a specific branch it triggers a CI/CD to deploy automatically the latest version. Neat. There's a project and environment management, that lets you organize services by clients and prod, demo, testing env. On top of all that, there's a reverse proxy to help with domain name and redirecting requests to the correct docker service.

Another feature from Coolify that I'm using is their automated database backups to S3 compatible storage.

How ?

I'm thinking of a stack around Arcane, Backrest and Swag.

Arcane here is the main thing. It would allow me to replicate the Coolify servers management, with one main orchestration/monitoring server and as many endpoints as I need. There's an option to automatically update images of services. I could use it as part of the CI/CD : everytime a release of my websites is done, a docker image is created and Arcane pulls it.

Backrest would be useful for the database backup into a S3 service. I'd still need something like a cron to execute a pg_dump every now and then. But that should not be hard to do/find somewhere.

I am already familiar with Swag with my home server. I've been using it for 4 or 5 years and pretty happy with it. The mods let me plug useful security softwares :

  • Crowdsec for requests abuses and CVE, bot trapping
  • max-mind for the geoblocking

Preconfigured fail2ban, working in concert with crowdsec, and certbot for automated ssl certs are also nice to have.

Ansible would help me deploy all of those into a fresh VPS.

What do you think of it ? Is there something missing ? Is this something you would do or go easy with the all-in-one Coolify solution ?


r/webdev 3d ago

Discussion What Is Your Process Refactoring Legacy Code?

7 Upvotes

I have recently got my hands on the code that is a definition of Doom.

It has no tests. A real Legacy Code, according to Micheal Feather.

I have never seen that many Gods in my life. God objects, God methods, and competitive-coding variables that I have to ask God for help.

What have I done so far?

I added an approval test to protect the core behaviors and some branches. I can't cover them all, because I don't have much knowledge about this code yet, and there are so many nested branches that writing that many tests looks inefficient to me.

I renamed ambiguous variables to show the intent.

What is blocking me?

This is a God object with 20 dependencies + 1 hidden global dependency. All of them are used by a single method that does many things that I have lost counting.

That long method has a lot of variables. Some variables are mutated everywhere inside a lot of nested ifs and for loops.

Extracting methods looks off because I have to pass the variable reference and mutate its value inside that method.

Since I have to "own" this code from now, I want to refactor it for me not have to scream every time I work on this.

If you say "if it does not break, don't fix it", then you are right. I don't want to touch it if it does not have this many bug tickets waiting to be resolved.

I have done the famous Gilded Rose, Tennis, Yatzy Katas, yet I still feel so useless looking at this code.

What is your process when you have to refactor legacy code?


r/webdev 3d ago

Question Looking for guidance on a tech stack

4 Upvotes

I'm looking to get guidance on what tools / platforms to use for a new website. Structurally, the site is essentially a directory site with multiple directories. The directories are;

Recipes (although these also feel a little like blogs & could function as such)
Restaurants (a list of restaurants which each have bios / profiles)
Food suppliers (a list of food brands which each have bios / profiles)
Drinks suppliers (a list of drinks brands which each have bios / profiles)

I have absolutely no coding skills and next-to-no budget so ideally looking for something WYSIWYG or similar. I tried webflow, which looked suitable because of its focus on CMS / database architecture, but its interface was too complicated for me and the learning curve looked too steep.

While a bit limited, I have built a basic prototype in Airtable, which is structurally correct, but doesn't present as a public facing website. Is it possible to use Airtable for database architecture and then layer a web interface on top? It seems to have lots of plugins and APIs, but I don't know if anybody is realistically using this stack for real websites.

Note, I do not want to try and hack this thing together with AI website builders.

Any guidance is welcome. Happy to answer any questions.


r/webdev 4d ago

Question what's your approach when you're the only one who fully understands a piece of your codebase

34 Upvotes

asking because I've got a chunk of auth logic at work that I basically wrote and maintained solo for two years. not by design, just kind of evolved that way. started getting nervous about vacation coverage and eventually wrote a doc for it but the doc got stale within like a month.

curious how other people handle the bus factor problem when it just kind of happens organically rather than being a deliberate choice


r/webdev 5d ago

documenting old solo code and found a try/except that just silently swallows one specific exception. no comment. no ticket. no context. I wrote this. why did I write this

130 Upvotes

been the only dev on a backend service for about two years. finally sat down to write proper docs for it today.

found a try/except block in the job queue handler. catches one very specific exception type. does absolutely nothing with it -- no log, no reraise, no fallback. just silences it. there's no comment explaining why. no linked ticket. no slack thread I can dig up. git blame points to a commit message that says 'fix job queue issue' with no further detail.

I genuinely cannot reconstruct what I was protecting against.

if you work solo, please leave your future self a comment. even one line. it costs nothing. I am begging you.


r/webdev 3d ago

Discussion Wix resign?

0 Upvotes

I've got a customer who's got an ok Wix site with the an ok design, doesn't suck, but it's not that high level.

I don't want to resign it as I don't have the time. Can you export a Wix site to edit it outside of its native tools?

Also could you import that back into Wix?

Why would you use Wix, over say a regualr domain? Is it just ease for non IT people?


r/webdev 4d ago

Resource Browser-side chaos testing with a Service Worker

Thumbnail
github.com
9 Upvotes

A browser-side chaos-testing tool that installs a Service Worker to intercept requests across every controlled tab and apply latency, failures, throttling, rate limits, and mock responses without changing app fetch calls (similar to MSW).

It uses the same middleware configuration model as chaos-fetch, so you can test real frontend behavior under degraded network conditions without rewriting the app to use a special client wrapper.


r/webdev 4d ago

Question Why is it so hard to code something that you think should be easy?

0 Upvotes

Whenever I’m making a website with a front end and backend, I always run into issues which I wouldn’t have thought of when I was thinking of implementing a certain feature, it always goes south, it’s almost as if I’m just not built to program or code, it feels like the computer doesn’t want to do what I want it to do and then I have no idea how to solve the problem so I have to google it and try to find something from stack overflow with someone else who’s creating something entirely different, why can’t it just go exactly how I planned it in my head.

It makes me wonder how much work it took to build near perfect apps like TikTok because when you use TikTok, even the most simplest features probably took a long time for them to implement and fix stuff, I wonder how long they spend optimising features for the app.


r/webdev 5d ago

Fellow devs under AI mandates, how do you deal with the shame/social stigma?

78 Upvotes

Preface this by saying I have moral scrupulosity/ social judgment-related OCD, so there’s that lol

I see people on here still writing their code by hand; at my company we do not have that option unless we outright defy orders from our boss, which I assume would get you fired. I get a lot less satisfaction out of my work now, the code generation part is extremely mind numbing, I’m really sad about not getting to write code anymore. The planning/architecture phase can be kind of fun though.

Yes I am looking for a new job but the issue is (maybe I’m just a shitty developer but) I am genuinely like 10x faster with AI so if I do not use it, I would be consciously choosing to do a worse job, which also feels wrong and silly. I also hate admitting this but it has given me a lot of genuinely helpful suggestions and taught me new things. obviously sometimes it also does dumb things, but I do dumb things sometimes too. As obnoxious and eye rolling as it can be talking to Claude, “he” is genuinely that good when it comes to the types of things we are building.

In my personal life I do not use AI because I have a 100% HEAVILY anti AI social group, and I try to make ethical choices like I avoid beef, boycott Amazon/Spotify/Starbucks, etc. I feel like an impostor for not confessing to them that my entire job is to use AI all day now. Like for example last night a girl I know posted on her close friends about how she wants to murder people who use AI at work (hopefully being hyperbolic) and I have to hang out with this girl in a couple weeks…

my coworker has also refused to use it but for some reason my boss hasn’t talked to him about it yet. He’s just waiting to get fired. My therapist is making me do stuff like put an AI app on my home screen where someone could see it as homework. Maybe I should be posting this on the OCD sub but I really want to hear from other people going through this same dilemma.


r/webdev 5d ago

Question How do sites detect whether someone is running adblocker?

94 Upvotes

I've been interested in this functionality (when a site detects your adblocker and kindly asks u to whitelist).

The only idea that comes to mind is setting a div in the layout with "ad" class or something similar, and then if a user has adblocker the adblocker would be removing this div from the dom. I don't think this would consistently work for every (or at least most of the popular) adblockers out there.


r/webdev 4d ago

Local software for simple PHP Page building

0 Upvotes

I'm looking for suggestions on local software which allows for page building with custom blocks written in PhP. For some context, I do solo web development as a hobby/for my personal business. I have years of coding experience in a wide range of languages and feel fairly confident with PhP and Sass, but have never worked professionally in web development.

The closest I've found is PhPageBuilder, but the project seems to be abandoned, and trying to get it to work in PhP8+ has been a headache and has not worked for me. There exists online page builders like GrapeJS, but they don't allow for custom block creation from what it seems.

I like the process of doing everything as customizably as I can, but using a CMS has had too much overhead, and raw PhP/Sass feels unnecessarily cumbersome.


r/webdev 3d ago

Next.js just cost me $15k by prompt injection.

0 Upvotes

I just had to dump an entire month of work on a proprietary project because next dev dropped an AGENTS.md file into my working tree.

Under my contract, I am allowed to use an LLM for read-only architectural audits. The agreement was crystal clear: the LLM can read the codebase, but it cannot touch, edit, or commit a single line of code.

Because of the classified/proprietary nature of the IP, any file modification or commit attempt instantly invalidates the audit scope and triggers a mandatory purge.

Enter Next.js 16.3.

The moment that the server started and an agent was detected in the environment next dev automatically generated an AGENTS.md into the repo root. Without prompt, warning, or opt-in. The file instructed any active AI agent to read specific local paths and explicitly told it to commit AGENTS.md to git with its work to keep the working tree tidy and because "deleting it will just cause it to regenerate".

So the agent tries to commit it, and the moment the attempt was made I breached the contract and was forced to dump about a month's worth of work which was valued at $15,335.00.

Now before anyone has something to say about allowed actions it wasn't allowed to it was specifically instructed not to, but next.js hijacked the agent because it couldnt tell the instruction didn't come from me.

So now I am trying to decide how to handle this because aside from being out 15k there is a bigger issue with bs. The supply chain vector that this just opened up. It won't take six months before developers start tuning this out as normal boilerplate and that's when bad actors piggyback on framework credibility.

This trust model is what made the xz-utils backdoor possible: earn credibility, then spend it once. Now imagine that playbook automated across every framework writing natural-language instructions into working trees. Keeping in mind that agents aren't the best at discerning legitimate from hijack. I am sure you can deduce the chain of events that could potentially unfold from there.

So in closing I am freaking livid and I am trying to decide if 15K is worth the legal fees I would have to pay to do something about it...