# Contributor handoff — vitejs/vite

> Canonical page: https://codevetter.com/unpack/vite/agent-handoff

# Contributor handoff — vitejs/vite

Scanned commit 1544bb1b7ac92f775e9d0dea97954c99cc6cbd43 (2026-09-22). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

This is a high-traffic OSS monorepo with strict conventions: pnpm only (enforced by `only-allow` in `preinstall`), oxfmt for formatting, eslint for `packages/*/{src,types}/**/*.ts`, and a `simple-git-hooks` pre-commit running lint-staged. Almost nothing can be verified without first running `pnpm build`, since the playground tests execute the built `dist/node/cli.js`. Read the CLI, server bootstrap, config resolver, and plugin pipeline before touching anything; treat the security guards and the deprecation shims as append-only unless the change is deliberate. The most common trap is editing `packages/vite/src/node` and testing without rebuilding, or adding a runtime dependency to the wrong section of `package.json`.
- Read first, in order: `packages/vite/src/node/cli.ts` (command surface), `packages/vite/src/node/server/index.ts` (`_createServer` + middleware order), `packages/vite/src/node/config.ts` (`resolveConfig`, `loadConfigFromFile`), `packages/vite/src/node/plugins/index.ts` (`resolvePlugins` ordering) and `packages/vite/src/node/build.ts` (`createBuilder`/`buildEnvironment`). — [packages/vite/src/node/cli.ts](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/packages/vite/src/node/cli.ts) [packages/vite/src/node/server/index.ts](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/packages/vite/src/node/server/index.ts) [packages/vite/src/node/config.ts](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/packages/vite/src/node/config.ts) [packages/vite/src/node/plugins/index.ts](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/packages/vite/src/node/plugins/index.ts) [packages/vite/src/node/build.ts](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/packages/vite/src/node/build.ts)
- Setup is `pnpm i` then `pnpm run build` at the repo root; while developing Vite itself, run `pnpm run dev` inside `packages/vite` for a watching Rolldown rebuild (`premove dist && pnpm build-bundle -w`). — [CONTRIBUTING.md#L7-18](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/CONTRIBUTING.md#L7-L18) [packages/vite/package.json#L48-49](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/packages/vite/package.json#L48-L49)
- pnpm is mandatory — root `preinstall` runs `npx only-allow pnpm` and `packageManager` pins `pnpm@12.4.2`; npm/yarn installs will be rejected. — [package.json#L8-9](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/package.json#L8-L9) [package.json#L96](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/package.json#L96)
- Verification commands: `pnpm test-unit` (fast, no browser), `pnpm test-serve [match]` / `pnpm test-build [match]` for targeted playground runs, `pnpm lint`, `pnpm format` (oxfmt), and `pnpm typecheck` (root `tsc -p scripts` plus every package's own typecheck). — [package.json#L18-26](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/package.json#L18-L26) [CONTRIBUTING.md#L137-166](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/CONTRIBUTING.md#L137-L166)
- Playground test matching is per-substring and only works on `test-serve`/`test-build`, not on `pnpm test` — e.g. `pnpm run test-serve assets` runs both `playground/assets` and `playground/assets-sanitize`. — [CONTRIBUTING.md#L157](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/CONTRIBUTING.md#L157)
- Trap: playground tests run against a real `vite` binary resolved through `viteBinPath` in `vitestSetup.ts`, so source edits in `packages/vite/src` are invisible to integration tests until `pnpm build` (or a running `pnpm dev` watcher) regenerates `dist`. — [playground/vitestSetup.ts#L77-80](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/playground/vitestSetup.ts#L77-L80) [CONTRIBUTING.md#L11-18](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/CONTRIBUTING.md#L11-L18)
- Trap: the e2e global setup copies playgrounds into `playground-temp/` and only copies the directories matched by the selected spec files — a new fixture directory that no spec references will not be copied, and `VITE_PRESERVE_BUILD_ARTIFACTS=1` (via `pnpm debug-build`) is needed to inspect the output. — [playground/vitestGlobalSetup.ts#L20-45](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/playground/vitestGlobalSetup.ts#L20-L45) [package.json#L28](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/package.json#L28)
- Dependency placement is a reviewed decision: `packages/vite/package.json` carries a literal `"//": "READ CONTRIBUTING.md to understand what to put under deps vs. devDeps!"` marker, and CONTRIBUTING has sections on `require()` usage, adding dependencies, and ensuring type support. — [packages/vite/package.json#L241](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/packages/vite/package.json#L241) [CONTRIBUTING.md#L44-72](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/CONTRIBUTING.md#L44-L72)
- Formatting and linting are enforced on commit: `simple-git-hooks` pre-commit runs `lint-staged --concurrent false`, which applies `oxfmt` to all files and eslint `--fix` to `packages/*/{src,types}/**/*.ts`, `packages/**/*.d.ts` and `playground/**/__tests__/**/*.ts`. — [package.json#L98-113](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/package.json#L98-L113)
- Safe edit boundary: anything under `playground/` is fixture + spec code, not shipped code — only `packages/vite`, `packages/create-vite` and `packages/plugin-legacy` are published, and CI skips tests entirely for `packages/create-vite/template**` changes. — [package.json#L37](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/package.json#L37) [.github/workflows/ci.yml#L48-57](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/.github/workflows/ci.yml#L48-L57) [pnpm-workspace.yaml](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/pnpm-workspace.yaml)
- Do not relax the filesystem guards casually: `isFileLoadingAllowed`, `looksLikeWindowsShortNamePath`, the NTFS-colon check and `rejectInvalidRequestMiddleware` each carry comments identifying a specific bypass class they exist to block. — [packages/vite/src/node/server/middlewares/static.ts#L289-345](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/packages/vite/src/node/server/middlewares/static.ts#L289-L345) [packages/vite/src/node/server/middlewares/rejectInvalidRequest.ts](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/packages/vite/src/node/server/middlewares/rejectInvalidRequest.ts)
- When adding a server-facing API, mirror the environment convention: put state on `DevEnvironment` (which owns `moduleGraph`, `pluginContainer`, `_pendingRequests`, `transformRequest`, `warmupRequest`, `waitForRequestsIdle`) and expose any flat `server.*` alias only through `warnFutureDeprecation`. — [packages/vite/src/node/server/environment.ts#L56-410](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/packages/vite/src/node/server/environment.ts#L56-L410) [packages/vite/src/node/server/index.ts#L620-756](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/packages/vite/src/node/server/index.ts#L620-L756) [packages/vite/src/node/deprecations.ts](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/packages/vite/src/node/deprecations.ts)
- Debug logging convention: use `createDebugger('vite:<area>')` (e.g. `vite:load`, `vite:transform`, `vite:cache`, `vite:env`, `vite:hmr`) and keep middleware functions *named*, since the names surface under `DEBUG=connect:dispatcher` — several files carry that exact comment. — [packages/vite/src/node/server/transformRequest.ts#L44-46](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/packages/vite/src/node/server/transformRequest.ts#L44-L46) [packages/vite/src/node/server/index.ts#L1033-1035](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/packages/vite/src/node/server/index.ts#L1033-L1035) [CONTRIBUTING.md#L115-118](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/CONTRIBUTING.md#L115-L118)
- Releases are automated and should not be hand-driven: `publish.yml` runs `scripts/detect-release.ts` against the latest commit subject on pushes to `main`/`v[0-9]*`, and `pnpm ci-publish` invokes `scripts/publishCI.ts`; `prepare-release.yml` and `scripts/prepare-release.ts` handle version bumps. — [.github/workflows/publish.yml#L1-45](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/.github/workflows/publish.yml#L1-L45) [scripts/publishCI.ts](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/scripts/publishCI.ts) [scripts/prepare-release.ts](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/scripts/prepare-release.ts) [package.json#L33](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/package.json#L33)
- The repo has an explicit AI Policy section in CONTRIBUTING.md alongside the Pull Request Guidelines and issue-triaging workflow — read it before opening a PR from an agent-assisted change. — [CONTRIBUTING.md#L224-263](https://github.com/vitejs/vite/blob/1544bb1b7ac92f775e9d0dea97954c99cc6cbd43/CONTRIBUTING.md#L224-L263)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)