# Behavior traces — meteor/meteor

> Canonical page: https://codevetter.com/unpack/meteor/behavior-traces

# Behavior traces — meteor/meteor

Scanned commit ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e (2026-09-22). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Four concrete flows were followed through implementation: development startup, application creation, collection insertion, and password login. Startup orders proxy binding, compilation, Mongo readiness, and application listening through promises rather than a single synchronous chain. The persistence and authentication traces preserve material local/remote, permission, and optional-2FA branches.
- Startup begins at meteor → tools/index.js → continueSetup → cli/main; binary commands may exit this chain early, while ordinary commands load Babel and the CLI command modules. — [meteor#L148-153](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/meteor#L148-L153) [tools/index.js#L1-25](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/tools/index.js#L1-L25) [tools/cli/main.js#L294-298](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/tools/cli/main.js#L294-L298)
- doRunCommand parses targets/server options → constructs ProjectContext → reads metadata → optionally initializes Cordova → calls runAll.run; runAll creates Runner and awaits init before scheduling or awaiting start. — [tools/cli/commands.js#L482-507](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/tools/cli/commands.js#L482-L507) [tools/cli/commands.js#L558-606](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/tools/cli/commands.js#L558-L606) [tools/runners/run-all.js#L411-419](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/tools/runners/run-all.js#L411-L419)
- Runner.start binds the proxy → starts Mongo asynchronously with up to three attempts → starts updater/HMR when enabled → starts AppRunner; _runOnce prepares and bundles the project, waits for the first-run Mongo promise, starts AppProcess, and switches proxy mode on listening. — [tools/runners/run-all.js#L174-223](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/tools/runners/run-all.js#L174-L223) [tools/runners/run-app.js#L669-709](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/tools/runners/run-app.js#L669-L709) [tools/runners/run-app.js#L829-870](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/tools/runners/run-app.js#L829-L870)
- Application creation's setup selects a skeleton from explicit flags or interactive prompts → resolves the destination → rejects nesting inside another Meteor app → checks existing contents before deciding what skeleton files to copy. — [tools/cli/commands.js#L938-1051](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/tools/cli/commands.js#L938-L1051) [tools/cli/commands.js#L1241-1246](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/tools/cli/commands.js#L1241-L1246)
- Creation copies a local skeleton when available/prototype/release-selected, otherwise attempts Git cloning with local-copy fallback; setupMessages then reads metadata, writes the release, records completed upgraders, prepares packages, and installs npm dependencies including development dependencies. — [tools/cli/commands.js#L1292-1326](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/tools/cli/commands.js#L1292-L1326) [tools/cli/commands.js#L1063-1084](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/tools/cli/commands.js#L1063-L1084) [tools/cli/commands.js#L1089-1117](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/tools/cli/commands.js#L1089-L1117)
- A remote insert follows insertAsync → _insertAsync → _callMutatorMethodAsync → connection.applyAsync; simulation mutates the local collection, while the server chooses restricted validation, insecure mutation, or a 403 rejection. — [packages/mongo/collection/methods_async.js#L82-105](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/mongo/collection/methods_async.js#L82-L105) [packages/allow-deny/allow-deny.js#L473-490](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/allow-deny/allow-deny.js#L473-L490) [packages/allow-deny/allow-deny.js#L162-224](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/allow-deny/allow-deny.js#L162-L224)
- Restricted insertion runs deny validators first, requires an allow validator to accept, adds a generated ID after validation, and calls underlying insertAsync; MongoConnection then performs insertOne → observer refresh → write.committed, while cursor observers feed subscription updates into client replication. — [packages/allow-deny/allow-deny.js#L290-315](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/allow-deny/allow-deny.js#L290-L315) [packages/mongo/mongo_connection.js#L242-262](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/mongo/mongo_connection.js#L242-L262) [packages/mongo/collection/collection.js#L111-138](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/mongo/collection/collection.js#L111-L138) [packages/mongo/collection/methods_replication.js#L97-143](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/mongo/collection/methods_replication.js#L97-L143)
- Password login follows internalLoginWithPassword → callLoginMethod → server methods.login → _runLoginHandlers → password handler/checkPasswordAsync → optional 2FA → _attemptLogin validation → _loginUser token insertion and setUserId. — [packages/accounts-password/password_client.js#L10-29](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/accounts-password/password_client.js#L10-L29) [packages/accounts-base/accounts_server.js#L712-720](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/accounts-base/accounts_server.js#L712-L720) [packages/accounts-password/password_server.js#L313-356](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/accounts-password/password_server.js#L313-L356) [packages/accounts-base/accounts_server.js#L469-493](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/accounts-base/accounts_server.js#L469-L493) [packages/accounts-base/accounts_server.js#L524-554](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/accounts-base/accounts_server.js#L524-L554) [packages/accounts-base/accounts_server.js#L627-675](https://github.com/meteor/meteor/blob/ac3f471f4af5c8aec737e20ccd168bfc7cc1a49e/packages/accounts-base/accounts_server.js#L627-L675)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)