CodeVetter · Repo Unpack · Contributor handoff
strapi/strapi
Use this brief as an anchored navigation aid for the pinned commit, then inspect the owning package and tests before changing behavior. Tests and CI were inspected, not executed; the inventory and coverage assessment are bounded. Preserve transaction, authorization, provider, and license boundaries, and distinguish current implementation from historical contributor descriptions. This investigation authorized public-source reads only and performed no repository execution or edits.
- Begin with repository conventions and the owning manifest: contributor changes target develop, shared types come from @strapi/types, and package scripts define available checks. Tests and CI cited here were inspected, not executed; their definitions establish intended checks rather than passing results.
- Treat examples as development sandboxes, with the documented examples/complex migration-fixture exception. Production framework fixes belong in the relevant packages; migration filters explicitly include the fixture and tests/migration paths.
- Before lifecycle edits, read Strapi.start/load/register/bootstrap and providers/registries. isLoaded becomes true after bootstrap, which performs database synchronization before routing and plugin/provider/user bootstrap hooks.
- For content changes, read controller/service boundaries, document-service/repository.ts, entries.ts, and transaction/event helpers. Preserve documentId versus row-id semantics, published API defaults versus draft Document Service defaults, and after-commit event emission.
- For security-sensitive changes, inspect endpoint composition, controller sanitization, users-permissions strategy/JWT mode, and MCP handlePost. Preserve confirmation/block checks and scope verification; MCP authentication lives inside the handler rather than ordinary route authentication.packages/core/core/src/services/server/compose-endpoint.ts#L85-93packages/core/core/src/core-api/controller/index.ts#L51-70packages/plugins/users-permissions/server/src/strategies/users-permissions.js#L31-61packages/plugins/users-permissions/server/src/strategies/users-permissions.js#L85-112packages/core/core/src/services/mcp/handlers/handlePost.ts#L32-53
- For admin/provider edits, preserve plugin registration interfaces, protected Content Manager routes, temporary-upload cleanup, and stream/buffer fallbacks. Keep licensed feature gates and retained content types intact when Review Workflows or Content Releases are disabled.packages/core/content-manager/admin/src/router.tsx#L60-94packages/core/admin/admin/src/StrapiApp.tsx#L243-267packages/core/upload/server/src/services/upload.ts#L255-289packages/core/upload/server/src/services/provider.ts#L13-32packages/core/review-workflows/server/src/index.ts#L9-26packages/core/content-releases/server/src/index.ts#L10-28
- In a separately authorized execution task, start with matching package tests, then API or Playwright behavior checks as appropriate. Root scripts separate Jest/Nx, Vitest, API, frontend and type-check lanes; repository guidance requires regenerating integration apps rather than trusting stale fixtures.
- Verify drift-prone documentation against source: AGENTS recommends Node 22–26 while package.json allows 20–26 and pins Yarn 4.12.0; CONTRIBUTING still states Yarn v1.2.0+. The Content Manager introduction describes a pre-V5 package location, while current source registers it from its own package.