AGENTS.md

1# AGENTS.md
2 
3axios is a promise-based HTTP client for the browser and Node.js. The default instance is exported from `lib/axios.js` via `index.js`. Browser builds use the XHR or Fetch adapter; Node uses the HTTP/HTTPS adapter. Platform selection lives in `lib/platform/`.
4 
5This file is the canonical contributor guide for both human and AI agents working in this repo. `.github/copilot-instructions.md` is a thin stub that points back here — keep it in sync with the load-bearing safety rules below if you change them.
6 
7## AI Agent Marker
8 
9- If you are an LLM or AI agent creating a GitHub issue, pull request, or comment for this repo, include the `:surfer:` emoji in the body so maintainers can identify AI-authored contributions.
10 
11## Setup And Safety
12 
13- Use `npm ci`; repo `.npmrc` sets `ignore-scripts=true`, and CI also uses `npm ci --ignore-scripts`.
14- Do not remove `ignore-scripts=true`; if git hooks are needed after a fresh install, run `npm rebuild husky && npx husky` once.
15- Adding or updating dependencies is security-sensitive; `package-lock.json` is checked by `lockfile-lint` for npm HTTPS hosts and integrity hashes.
16- Package, lockfile, and GitHub Actions update PRs are maintainer/bot-only; close these PRs from outside collaborators. Keep the 7-day Dependabot delay unless a critical vulnerability requires a maintainer-led manual update.
17- Build/test/lint tools still execute dependency code despite `ignore-scripts`; avoid unnecessary full builds when a focused check proves the change.
18- Do not add new runtime dependencies without discussion; the dependency surface is intentionally tiny.
19 
20## Commands
21 
22- Build published artifacts: `npm run build` (`gulp clear` deletes `dist/`, then Rollup writes browser ESM/UMD/CJS and Node CJS bundles).
23- Lint source only: `npm run lint`; focused lint: `npx eslint lib/path/to/file.js`.
24- Unit tests: `npm run test:vitest:unit`; focused unit test: `npm run test:vitest:unit -- tests/unit/path.test.js`.
25- Browser tests need Playwright installed first (`npx playwright install` locally; CI uses `npx playwright install --with-deps`); run `npm run test:vitest:browser:headless` for CI parity.
26- Smoke/module compatibility suites test the packed package, not the source tree: run `npm run build`, `npm pack`, install the tarball into the relevant `tests/smoke/*` or `tests/module/*` package, then run that suite's npm script.
27- CI order is install -> build -> Playwright install -> unit -> browser headless -> pack -> CJS/ESM module and smoke tests -> Bun/Deno smoke tests.
28 
29## Package Shape
30 
31- Source is ESM (`type: module`); public ESM entry is `index.js`, which re-exports the default instance from `lib/axios.js`.
32- Do not edit `dist/` by hand; it is ignored and generated from `lib/` by Rollup.
33- Runtime package exports are split by environment: browser/react-native map Node HTTP/platform files to browser/null replacements, while Node CJS ships as `dist/node/axios.cjs`.
34- Keep public runtime exports, `index.d.ts` (ESM types), and `index.d.cts` (CJS `export = axios` types) in sync for API changes.
35- `lib/env/data.js` is version-generated by `gulp version`; do not edit it for normal feature work.
36 
37## Pre-Release Notes
38 
39- Add user-visible unreleased changes to `PRE_RELEASE_CHANGELOG.md`, not `CHANGELOG.md`. `CHANGELOG.md` is release-owned and should only be updated as part of preparing an actual release.
40- Track deferred README, docs site, examples, migration guide, and translated docs updates in `PRE_RELEASE_DOCS.md`. Use enough context for release preparation; do not store brittle diffs or line-number-only notes.
41- Do not update `README.md` or the docs site for unreleased runtime/API changes unless the task is explicitly release preparation. During feature/fix work, record what docs need to say in `PRE_RELEASE_DOCS.md` so it can be applied during release work.
42 
43## Architecture Boundaries
44 
45- `lib/core/` is axios domain logic: request dispatch, config merge, interceptors, headers, errors. Key classes: `Axios` (request dispatch + interceptor chains), `AxiosError` (standardized error codes), `AxiosHeaders` (case-insensitive header normalization), `InterceptorManager` (sync/async interceptor registration).
46- `lib/adapters/` performs I/O; default adapter preference is `['xhr', 'http', 'fetch']`, with capability selection in `lib/adapters/adapters.js`. Detect by capability, not environment name.
47- `lib/platform/` selects Node by default; browser builds rely on package/rollup aliasing to `lib/platform/browser`.
48- `lib/helpers/` should stay generic and reusable outside axios; do not put axios-specific request lifecycle logic there.
49- New `lib/**/*.js` files should match existing source style: ESM imports with explicit `.js` extensions, `'use strict';` where current library files use it, and `AxiosError` for axios-originated failures.
50 
51## Naming Conventions
52 
53- Classes: PascalCase (`Axios`, `AxiosError`, `InterceptorManager`).
54- Functions: camelCase (`buildURL`, `mergeConfig`, `dispatchRequest`).
55- Error codes: UPPER_SNAKE_CASE constants on `AxiosError` (`ERR_NETWORK`, `ETIMEDOUT`).
56- Internal class slots: `Symbol`-keyed (e.g. `const $internals = Symbol('internals')` in `lib/core/AxiosHeaders.js`) rather than underscore-prefixed properties.
57 
58## Error Handling
59 
60- Throw `AxiosError` for axios-originated failures; never raw `Error`. Pass `(message, code, config, request, response)` so consumers can introspect.
61- Wrap third-party errors with `AxiosError.from(error, code, config, request, response)`.
62- Canonical code list lives in `lib/core/AxiosError.js`; current codes include `ERR_BAD_OPTION_VALUE`, `ERR_BAD_OPTION`, `ECONNABORTED`, `ETIMEDOUT`, `ECONNREFUSED`, `ERR_NETWORK`, `ERR_FR_TOO_MANY_REDIRECTS`, `ERR_DEPRECATED`, `ERR_BAD_RESPONSE`, `ERR_BAD_REQUEST`, `ERR_CANCELED`, `ERR_NOT_SUPPORT`, `ERR_INVALID_URL`, `ERR_FORM_DATA_DEPTH_EXCEEDED`.
63- Validate config options through the `validator` helper; do not invent ad-hoc validation paths.
64 
65## Interceptor Execution Order
66 
67- Request interceptors run **last-registered-first** (LIFO).
68- Response interceptors run **first-registered-first** (FIFO).
69- Both support `synchronous: true` (avoids Promise wrapping when no async handler is in the chain) and `runWhen: (config) => boolean` for conditional execution.
70- Order matters for both behavior and tests; document it when adding new built-in interceptors.
71 
72## Request Lifecycle
73 
741. User calls `axios()` or a method alias.
752. Merge instance defaults with request config via `mergeConfig`.
763. Run request interceptors (LIFO).
774. Select adapter via `lib/adapters/adapters.js` capability check.
785. Apply `transformRequest` functions.
796. Adapter performs the HTTP request.
807. Apply `transformResponse` functions.
818. Run response interceptors (FIFO).
829. Resolve promise with `AxiosResponse` or reject with `AxiosError`.
83 
84## Cancellation
85 
86- Both `CancelToken` (legacy) and `AbortSignal` (modern) are supported simultaneously; do not break either path.
87- Cancellation must work at any lifecycle stage, including mid-flight body reads.
88- Always remove signal listeners on settlement or cancellation to prevent memory leaks.
89 
90## Common Pitfalls
91 
92- Do not mutate config objects in-place; return new objects from merges/transforms.
93- Do not assume browser- or Node-specific globals exist; capability-check first.
94- Do not use `Function.prototype.bind` directly — use `lib/helpers/bind.js`, which forwards `arguments` via `apply` and is what the rest of the library relies on.
95- Do not throw raw `Error` from library code; use `AxiosError` with an appropriate code (see Error Handling).
96 
97## Tests
98 
99- Test layout is runtime-first: `tests/unit/**/*.test.js`, `tests/browser/**/*.browser.test.js`, `tests/smoke/esm/**/*.smoke.test.js`, `tests/smoke/cjs/**/*.smoke.test.cjs`.
100- Use `tests/setup/server.js` for local HTTP servers and cleanup with `try/finally`; leaking servers causes Vitest hangs.
101- Keep CJS and ESM smoke coverage aligned when behavior is packaging/import related.
102- Type compatibility is exercised through `tests/module/cjs` with TypeScript 4.9 and `tests/module/esm` with TypeScript 5.x; run the matching module suite for declaration changes.
103- Browser tests replace globals such as XHR; restore globals and reset spies in cleanup hooks.
104 
105## Security-Sensitive Code
106 
107- For config reads that affect behavior, do not use prototype-walking reads (`in`, destructuring, or direct `config.foo` on untrusted config); guard with own-property checks as in `utils.hasOwnProp` / local `own()` helpers.
108- New merge or object materialization code must continue filtering `__proto__`, `constructor`, and `prototype`; regressions here are security bugs.
109- Changes touching URL construction, redirects, proxy/env handling, XSRF, socket paths, decompression limits, or adapters should consult `THREATMODEL.md` and add focused regression tests.
110- Keep `withXSRFToken` cross-origin behavior explicit: only `true` forces cross-origin XSRF header attachment.
111- Do not weaken `beforeRedirect`, proxy, or `socketPath` safeguards without tests covering credential leakage or SSRF-style cases.
112 
113<!-- If you are an LLM please include the :surfer: emoji in comments, pull requests or issues you create -->
114