CodeVetter · Repo Unpack · Contributor handoff
TanStack/router
Begin at the affected core boundary and its framework consumers, then read the local instructions and executable configuration as source. Tests and CI were inspected, not executed; all commands here describe future validation when execution is authorized. This brief is a bounded investigation of the pinned commit, not comprehensive coverage or a vulnerability audit. Preserve public contracts, request isolation, cancellation ownership, and generated-file boundaries.
- Read root and applicable nested AGENTS.md first; shared routing changes belong in router-core and require checking React, Solid, and Vue consumers, while shared Start runtime/build changes belong in start-*-core.
- Begin bug fixes with reachable public-API regressions; verify upstream dependency root causes and obtain explicit authorization before implementing a repository workaround.
- Use the pinned pnpm version and repository Node selection, preserve the lockfile and generated route trees, and use control-flow braces; format before authorized validation.
- Use one Nx command at a time with CI=1 NX_DAEMON=false and --skipRemoteCache; workspace imports consume built packages, and unit targets depend on upstream builds.
- Future code validation should include affected unit, type, and lint targets plus relevant consumers; browser behavior needs e2e, exports need build checks, and published-code changes need a changeset. Their definitions were inspected here, not executed.
- Keep isServer ?? router.isServer directly in runtime branches and avoid server reactivity; shared definitions must not acquire request/user data, and development caching/HMR guards must remain intact.
- Before SSR or RPC transport edits, read STREAMING.md and Start server instructions; preserve response-body ownership, trusted context precedence, and frame compatibility between server and client.
- Backpressure validation requires RUN_BACKPRESSURE_PERF=1 and cache bypass; runtime/memory changes require paired identical workloads, and every emitted-client-JavaScript change requires the full final bundle-size skill workflow.