CodeVetter · Repo Unpack · Contributor handoff
pallets/werkzeug
Start with the public WSGI contract, then inspect the relevant protocol, adapter, and test layers together. Preserve stream ownership, cleanup, route-building parity, and documented compatibility behavior. Tests and CI were inspected, not executed; the brief establishes neither passing checks nor exhaustive coverage. Future implementation work should use the existing locked tooling only when execution is separately authorized.
- Read README's callable example and docs/levels before editing public APIs: the project explicitly supports both Request/Response wrappers and lower-level utility functions.
- For body changes, inspect Request, FormDataParser, MultipartDecoder, and get_input_stream together; multipart limits and server-terminated stream handling are separate controls.
- Preserve upload cleanup and cached-body reparsing: Request.close closes parsed file objects, cached input is re-exposed through BytesIO, and MultiPartParser closes created streams on errors.
- Routing edits must account for both matcher state and endpoint builders: Rule.compile installs generated build functions, while Map.update sorts matcher and endpoint rules under its remapping lock.
- Keep Werkzeug 3.2 compatibility paths explicit: parser hooks and configurable storage classes emit deprecation warnings, and tests treat warnings as errors unless deliberately handled.
- When execution is authorized, use the configured uv/tox pytest workflow with the smallest relevant test-file positional argument first; tests and CI were inspected here, not executed, and test existence supplies no passing result.
- Follow existing style and verification configuration: Ruff uses single-line imports and excludes examples, mypy is strict over src, pre-commit runs repository hooks, and the docs tox environment builds Sphinx with warnings as errors.
- Distinguish runnable demonstrations from supported library boundaries: Shortly requires Redis/Jinja and enables development debugging, while deployment docs require production WSGI hosting; bounded example inspection does not establish persistence integration coverage.