CodeVetter · Repo Unpack · Contributor handoff
npm/cli
Begin with the CLI coordinator, owning command, configuration definitions, and relevant workspace before changing behavior. Preserve source precedence, workspace boundaries, lifecycle ordering, and lockfile contracts. Tests and CI were inspected, not executed, and this inventory is bounded rather than exhaustive. Proposed checks below are handoff guidance for an execution-authorized task.
- Read package.json and CONTRIBUTING first; use node . <command> to invoke the checkout in an authorized development task, since index.js rejects programmatic import and installed npm may refer to another version.
- For dispatch changes, read cmd-list.js, Npm.execCommandClass, and BaseCommand together; preserve aliases, nested command depth, help generation, legacy execution, and workspace capability checks.
- Keep compatibility-sensitive bootstrap files within the ES6 syntax and restricted-require rules in .eslintrc.local.js; npx currently has a documented exception because it imports the configuration definition graph.
- For configuration edits, check source precedence and flattening, plus validateCli's deferred validation; repair-oriented commands can bypass validation, and environment unknowns intentionally warn rather than error.
- For installation changes, preserve actual/virtual/ideal ownership and save semantics: ci forces save:false and ignoreExtension:true while validating extension hashes; update can still save lockfiles despite save:false.
- Use existing mock-npm fixtures for command regression tests and explicitly account for reconstructed argv and awaited log cleanup; maintain install/ci tests that distinguish preinstall timing, script suppression, and bootstrap failure.
- Tests and CI were inspected, not executed. When authorized, start with node . run test -- <relevant-test-file>, then the affected workspace suite and lint; root test-all and lint-all scripts exist, and root coverage excludes workspaces.
- Keep edits focused on owning source, tests, and documentation: package.json is partially template-oss-managed, CI declares generated ownership, and CONTRIBUTING reserves dependency updates and tooling/automation maintenance for the core team.