Cross-cutting frontend topics, tooling, and DX Compiled for immediate developer deployment.
calendar_todaysummarizeWeek 6-2026
article
Agentic Engineering
TAG: AI
Addy Osmani argues that the term "vibe coding" has been stretched to cover two fundamentally different activities: reckless, review-free prototyping and disciplined AI-assisted engineering. He proposes Andrej Karpathy's new coinage "agentic engineering" — where humans orchestrate AI coding agents while owning architecture, code review, and correctness — as the more precise label for professional workflows. The practice demands writing design docs before prompting, reviewing every diff with the rigor applied to a teammate's PR, and maintaining comprehensive test suites so agents can iterate reliably. Osmani warns that agentic engineering disproportionately benefits senior engineers who can evaluate AI output; juniors who skip fundamentals risk developing a dangerous skill atrophy where they can generate but not reason about what they've shipped. His O'Reilly book "Beyond Vibe Coding" expands on practical frameworks for this transition.
A Web Performance Analysis Of Consent Management Platforms | DebugBear
TAG: PERFORMANCE
DebugBear tested eleven Consent Management Platforms across five sites each, measuring Interaction to Next Paint (INP) scores after a cookie-accept click on a 4× CPU-throttled desktop. Sourcepoint was the clear winner at a median 6ms INP — 50ms ahead of second-place Usercentrics at 56ms — because it renders the consent modal inside an iframe, keeping click handling off the main thread entirely. Google Funding Choices was the worst performer at a median 468ms INP (none of the tested sites hit the "good" threshold), driven by Google conversion scripts blocking the main thread; asahi.com recorded an extreme 1,549ms. Osano was the second-worst at 225ms, with Chrome DevTools revealing 448ms of main-thread blocking from JavaScript rendering logic and forced reflow. Mid-tier performers like Cookiebot, TrustArc, and Termly landed in the 57–69ms range, all generally within the Core Web Vitals "good" band below 200ms.
READ_TIME: 7_MIN|BY: Conor McCarthy Customer Support Engineer
Debugging with AI: Can It Replace an Experienced Developer?
TAG: DEEP DIVE
Nadia Makarevich tests Claude Opus on three real React/Next.js bugs in a public study project using TanStack Query and Zod, scoring each attempt on whether the LLM fixed the problem, identified the root cause, and applied the correct fix. For a straightforward Zod schema mismatch (missing phone/address fields), the AI scored full marks on problem and root-cause identification but applied a band-aid data-mock fix instead of relaxing the schema — earning half credit. On a double-loading-skeleton bug caused by RSC payload download during SPA navigation, the AI proposed useSuspenseQuery, which fixed the visual glitch but introduced hydration mismatches on refresh. The third bug — a "rendered more hooks than during the previous render" error caused by a Server Action called from useEffect on a page with a Suspense boundary and a redirect — completely defeated the AI after many confident but wrong attempts. Makarevich concludes that AI excels at pattern-matching known error types but fails on novel system-behavior reasoning, and that "the skill isn't knowing how to prompt better — it's knowing when to stop prompting and start thinking."
The importance of artifacts in AI-assisted programming - Human Who Codes
TAG: GUIDE
Nicholas Zakas argues that AI's lack of persistent memory makes traditional software artifacts — PRDs, Architectural Decision Records, Technical Design Documents, and granular task lists — more essential than ever in professional codebases. Unlike human developers who recall why decisions were made months ago, an AI pair programmer has no memory beyond its current context window, making traceability impossible without structured documentation. Zakas illustrates the stakes with a concrete "save for later" feature postmortem: the AI-generated TDD omitted a read-through cache fallback from Redis to PostgreSQL, a gap that human reviewers also missed because it was implied but never explicit. He advocates storing all artifacts in source control, using one AI to draft and a second to review for inconsistencies, and enriching each task with acceptance criteria, dependency links, and explicit "out of scope" clauses to constrain AI implementation. The article frames documentation not as overhead but as the investigative trail that lets teams quickly diagnose 3 a.m. production incidents.
In praise of the stacked pull request | Swizec Teller
TAG: WORKFLOW
Swizec Teller frames code review throughput as the single leading indicator of team velocity, then makes the case for stacked pull requests as the antidote to the big-PR antipattern. A stacked PR is a chain of small, independently reviewable branches that build on each other: once one segment is done, development continues on a new branch off the tip, so work never stalls waiting for review. The author describes the combinatorial explosion cost of large PRs — one monster diff took him two full workdays just to read — and contrasts it with the manageable review surface of stacked PRs. He recommends Graphite to manage rebasing automatically; after an initial learning curve of about a day, it handles ~80% of rebases without conflict, shows reviewers where each PR sits in the stack, and handles merge ordering. The post treats commits as throwaway save-points and squash-merge as the canonical history-cleaning step.
Secure npm package publishing in 2026: A Complete Guide
TAG: SECURITY
Ulises Gascón — Node.js Core Collaborator and OpenJS Foundation CNA Coordinator — chronicles the Shai-Hulud malware that self-propagated across ~700 npm packages in September–October 2025 by compromising maintainer credentials and auto-publishing to every package the token could reach, with attackers creating 25,000 GitHub repos to exfiltrate secrets. As of December 9, 2025, npm began revoking classic tokens with a hard deadline of ~February 3, 2026. Gascón evaluates three replacement strategies: local publishing with hardware-key 2FA (YubiKey or passkey; SMS is now insufficient); CI/CD pipelines using granular tokens scoped per-package with 90-day rotation, plus a GitHub Actions "publish" environment requiring manual human approval; and Trusted Publishing via OIDC — promising but not yet recommended for critical packages due to the absence of a stage-publishing checkpoint. The new --allow-git=none CLI flag is highlighted as a critical mitigation, blocking git-sourced dependencies that can execute arbitrary code even under --ignore-scripts.
The third golden age of software engineering – thanks to AI, with Grady Booch
Grady Booch — co-creator of UML, IBM Fellow, and one of the founding figures of modern software engineering — argues that we are already several years into the "third golden age" of software engineering, which began around the turn of the millennium, not with AI. He traces the industry through two prior golden ages: algorithmic abstraction (1940s–70s) and object-oriented abstraction (1980s–2000s), showing that each generational shift elevated developers to a new level of abstraction rather than eliminating them. On Dario Amodei's prediction that software engineering will be fully automatable in 12 months, Booch calls it "utter" and argues that AI tools today primarily automate well-trodden patterns in web-centric systems — a small slice of computing. He contends that the forces software engineers actually balance (ethics, economics, physics, human organization) are nowhere near automation, and urges developers to strengthen systems-theory fundamentals, citing Minsky's "Society of Mind" and subsumption architectures as guides for the multi-agent era ahead.
Addy Osmani argues that the term "vibe coding" has been stretched to cover two fundamentally different activities: reckless, review-free prototyping and disciplined AI-assisted engineering. He proposes Andrej Karpathy's new coinage "agentic engineering" — where humans orchestrate AI coding agents while owning architecture, code review, and correctness — as the more precise label for professional workflows. The practice demands writing design docs before prompting, reviewing every diff with the rigor applied to a teammate's PR, and maintaining comprehensive test suites so agents can iterate reliably. Osmani warns that agentic engineering disproportionately benefits senior engineers who can evaluate AI output; juniors who skip fundamentals risk developing a dangerous skill atrophy where they can generate but not reason about what they've shipped. His O'Reilly book "Beyond Vibe Coding" expands on practical frameworks for this transition.
The third golden age of software engineering – thanks to AI, with Grady Booch
Grady Booch — co-creator of UML, IBM Fellow, and one of the founding figures of modern software engineering — argues that we are already several years into the "third golden age" of software engineering, which began around the turn of the millennium, not with AI. He traces the industry through two prior golden ages: algorithmic abstraction (1940s–70s) and object-oriented abstraction (1980s–2000s), showing that each generational shift elevated developers to a new level of abstraction rather than eliminating them. On Dario Amodei's prediction that software engineering will be fully automatable in 12 months, Booch calls it "utter" and argues that AI tools today primarily automate well-trodden patterns in web-centric systems — a small slice of computing. He contends that the forces software engineers actually balance (ethics, economics, physics, human organization) are nowhere near automation, and urges developers to strengthen systems-theory fundamentals, citing Minsky's "Society of Mind" and subsumption architectures as guides for the multi-agent era ahead.
A Web Performance Analysis Of Consent Management Platforms | DebugBear
DebugBear tested eleven Consent Management Platforms across five sites each, measuring Interaction to Next Paint (INP) scores after a cookie-accept click on a 4× CPU-throttled desktop. Sourcepoint was the clear winner at a median 6ms INP — 50ms ahead of second-place Usercentrics at 56ms — because it renders the consent modal inside an iframe, keeping click handling off the main thread entirely. Google Funding Choices was the worst performer at a median 468ms INP (none of the tested sites hit the "good" threshold), driven by Google conversion scripts blocking the main thread; asahi.com recorded an extreme 1,549ms. Osano was the second-worst at 225ms, with Chrome DevTools revealing 448ms of main-thread blocking from JavaScript rendering logic and forced reflow. Mid-tier performers like Cookiebot, TrustArc, and Termly landed in the 57–69ms range, all generally within the Core Web Vitals "good" band below 200ms.
Debugging with AI: Can It Replace an Experienced Developer?
Nadia Makarevich tests Claude Opus on three real React/Next.js bugs in a public study project using TanStack Query and Zod, scoring each attempt on whether the LLM fixed the problem, identified the root cause, and applied the correct fix. For a straightforward Zod schema mismatch (missing phone/address fields), the AI scored full marks on problem and root-cause identification but applied a band-aid data-mock fix instead of relaxing the schema — earning half credit. On a double-loading-skeleton bug caused by RSC payload download during SPA navigation, the AI proposed useSuspenseQuery, which fixed the visual glitch but introduced hydration mismatches on refresh. The third bug — a "rendered more hooks than during the previous render" error caused by a Server Action called from useEffect on a page with a Suspense boundary and a redirect — completely defeated the AI after many confident but wrong attempts. Makarevich concludes that AI excels at pattern-matching known error types but fails on novel system-behavior reasoning, and that "the skill isn't knowing how to prompt better — it's knowing when to stop prompting and start thinking."
The importance of artifacts in AI-assisted programming - Human Who Codes
Nicholas Zakas argues that AI's lack of persistent memory makes traditional software artifacts — PRDs, Architectural Decision Records, Technical Design Documents, and granular task lists — more essential than ever in professional codebases. Unlike human developers who recall why decisions were made months ago, an AI pair programmer has no memory beyond its current context window, making traceability impossible without structured documentation. Zakas illustrates the stakes with a concrete "save for later" feature postmortem: the AI-generated TDD omitted a read-through cache fallback from Redis to PostgreSQL, a gap that human reviewers also missed because it was implied but never explicit. He advocates storing all artifacts in source control, using one AI to draft and a second to review for inconsistencies, and enriching each task with acceptance criteria, dependency links, and explicit "out of scope" clauses to constrain AI implementation. The article frames documentation not as overhead but as the investigative trail that lets teams quickly diagnose 3 a.m. production incidents.
In praise of the stacked pull request | Swizec Teller
Swizec Teller frames code review throughput as the single leading indicator of team velocity, then makes the case for stacked pull requests as the antidote to the big-PR antipattern. A stacked PR is a chain of small, independently reviewable branches that build on each other: once one segment is done, development continues on a new branch off the tip, so work never stalls waiting for review. The author describes the combinatorial explosion cost of large PRs — one monster diff took him two full workdays just to read — and contrasts it with the manageable review surface of stacked PRs. He recommends Graphite to manage rebasing automatically; after an initial learning curve of about a day, it handles ~80% of rebases without conflict, shows reviewers where each PR sits in the stack, and handles merge ordering. The post treats commits as throwaway save-points and squash-merge as the canonical history-cleaning step.
Secure npm package publishing in 2026: A Complete Guide
Ulises Gascón — Node.js Core Collaborator and OpenJS Foundation CNA Coordinator — chronicles the Shai-Hulud malware that self-propagated across ~700 npm packages in September–October 2025 by compromising maintainer credentials and auto-publishing to every package the token could reach, with attackers creating 25,000 GitHub repos to exfiltrate secrets. As of December 9, 2025, npm began revoking classic tokens with a hard deadline of ~February 3, 2026. Gascón evaluates three replacement strategies: local publishing with hardware-key 2FA (YubiKey or passkey; SMS is now insufficient); CI/CD pipelines using granular tokens scoped per-package with 90-day rotation, plus a GitHub Actions "publish" environment requiring manual human approval; and Trusted Publishing via OIDC — promising but not yet recommended for critical packages due to the absence of a stage-publishing checkpoint. The new --allow-git=none CLI flag is highlighted as a critical mitigation, blocking git-sourced dependencies that can execute arbitrary code even under --ignore-scripts.
The featured item for the week — Addy Osmani's piece on agentic engineering — drew a sharp line between reckless AI-assisted prototyping and disciplined professional practice. His argument: calling everything "vibe coding" obscures the fact that real agentic engineering demands design docs before prompting, rigorous diff review, and test suites that give agents stable ground to iterate on. Senior engineers benefit disproportionately; juniors who skip fundamentals risk a skill atrophy where they can generate but not reason about what they shipped. Grady Booch's Pragmatic Engineer interview offered a longer historical frame, tracing three golden ages of software and arguing that AI automates well-trodden patterns in a narrow web-centric slice of computing — nowhere near the ethics, physics, and organizational reasoning that engineers actually navigate.
Nicholas Zakas made the complementary case that software artifacts — PRDs, ADRs, technical design documents — are more essential than ever precisely because AI has no persistent memory. A detailed postmortem of a missed Redis-to-Postgres cache fallback (implied but never written down, so the AI omitted it and reviewers missed it) illustrated the cost of assuming shared context. Nadia Makarevich's controlled study of Claude Opus debugging three real React/Next.js bugs reinforced the same point: the model excels at pattern-matching known error types but fails on novel system-behavior reasoning, and the critical skill is knowing when to stop prompting and start thinking.
The week's practical items were equally strong. Swizec Teller made a thorough case for stacked pull requests — smaller, chained, independently reviewable branches — as the antidote to the big-PR antipattern that tanks review throughput. Ulises Gascón's npm security guide documented the Shai-Hulud supply-chain attack that compromised ~700 packages in 2025, explained the npm classic token deprecation, and evaluated granular tokens, hardware-key 2FA, and OIDC Trusted Publishing as replacement strategies. DebugBear's Consent Management Platform INP benchmark showed Sourcepoint's iframe-isolated approach achieving a median6ms — 50ms ahead of the nearest competitor — while Google Funding Choices hit a catastrophic 468ms median.
Key Takeaways
Agentic engineering demands design docs, rigorous diff review, and comprehensive tests — without these artifacts, AI has no persistent context and reviewers miss gaps the model silently introduces.
The Shai-Hulud attack compromised ~700 npm packages by harvesting classic tokens; npm classic tokens were hard-deprecated as of February 2026 — migrate to granular scoped tokens or hardware-key 2FA immediately.
Your consent banner may be destroying your Core Web Vitals: Google Funding Choices hit a 468ms median INP while Sourcepoint's iframe-isolated approach clocked 6ms — a 78x performance gap from the same required UI.
