CodeVetter · Repo Unpack · Behavior traces
remix-run/remix
The investigation followed three concrete flows across implementation boundaries: scaffolding, template startup/rendering/hydration, and external login with persistence. Additional traces explain frame reloads and asset inspection. These are ordered source walkthroughs, not observed executions. Failure branches are included where they materially change the result.
- Scaffold entry: cli-entry.ts → runRemix → extractGlobalOptions → resolveCliContext → runCommand('new') → dynamically imported runNewCommand → parseNewCommandArgs → bootstrapProject.
- Scaffold writes: bootstrapProject → ensureTargetDirectory → resolveTemplateDirectory → copyTemplateDirectory → replaceTemplateValues → writeScaffoldPackageJson; a nonempty target fails unless force is enabled.
- Template startup: the start/dev command loads remix/node-tsx and server.ts; router module initialization creates static/render middleware and maps the controller; server.ts creates the HTTP listener and calls listen(port).
- Home request: createRequestListener → createRequest → router.fetch → createRequestContext → dispatchRouter → dispatchMatches → dispatchMatch → controller.home → context.render.
- HTML output: renderWith installs context.render; the render function calls renderToStream with frame/client-entry resolvers and the request signal, then wraps the stream using createHtmlResponse.
- Browser activation: template entry calls run → createStyleManager → createScheduler → createFrame(document) → startNavigationListener → topFrame.ready; hydrated exports are obtained through the entry's importModule loader.
- OAuth login: GitHub controller.login → startExternalAuth → getSession → createOAuthTransaction → sanitizeReturnTo → provider runtime createAuthorizationURL → session.set('__auth') → redirect response.
- OAuth callback persistence: controller.callback → finishExternalAuth → provider runtime handleCallback → resolveExternalAuth(db,result) → completeAuth → session.regenerateId(true) → session.set('auth') → redirect; enclosing session middleware subsequently saves the session.
- OAuth failure: finishExternalAuth rejects callback errors, missing/wrong-provider transactions, or invalid state and clears transaction data on failure; the demo controller catches errors, flashes a message, and redirects home.
- Browser frame reload: defaultResolveFrame creates HTML/frame headers, encodes submitted form data, calls fetch with mode='same-origin' and an abort signal, and rejects 5xx or non-HTML error/redirect responses.
- Server nested frame: resolveFrame resolves src against the current frame URL, prepares headers, follows redirects through context.router.fetch, requires HTML, and pipes the returned stream with the outer request's abort signal.
- Asset inspection: runAssetsCommand parses arguments → context.loadConfig → createAssetServer(watch:false) → getAssets or getAssetDetails → formatted stdout; finally it closes the asset server.