Nestjs Code Audit

NestJS Code Audit

Inspect the current user's NestJS project and return one consolidated report of verified code problems and evidence-backed risks. Audit only; do not modify the target project.

Pre-execution conflict guard

Before editing files or running any state-changing command, reconcile active instructions. Read-only inspection may continue.

Prerequisites

Confirm root, scope, instructions, Git state, installed versions/dependencies, and safe checks. Preserve user changes. Load semantic-review.md for the requested semantic lanes; sibling skills are optional deeper guidance, not installation prerequisites. Read other active skills only when their decisions overlap.

Primary ownership

This skill owns read-only quality evidence, finding deduplication, severity, and report assembly. When installed and relevant, coordinate with:

• nestjs-architecture-principles: module, dependency, data, and transaction boundaries.
• nestjs-oop-design-patterns: object responsibilities, invariants, and patterns.
• nestjs-features-performance: lifecycle, API/security, testing, runtime, and performance.
• nestjs-professional-software-engineering: implementation and verification.
• nestjs-feature-audit: branch-specific roadmap gate and feature reporting.
• nestjs-git-commit-pr-message: authorized Git publication and CI follow-up.

These are decision boundaries, not required dependencies. Retain domain ownership when handing work to another workflow.

Conflict test

Resolve incompatible findings, unsafe checks, or missing evidence using explicit user intent, repository contracts, verified runtime constraints, then the narrowest owner. Keep one finding per root cause; unresolved claims belong in Needs verification. If an action crosses the audit boundary, stop before mutation. An audit alone never authorizes fixes; if the user explicitly requested both, finish the read-only audit first, then enter the authorized implementation phase without asking for the same approval again.

Invocation

Preferred portable invocation:

$nestjs-code-audit
$nestjs-code-audit full src/payments
$nestjs-code-audit static
$nestjs-code-audit security src/auth

Codex CLI/IDE custom-prompt alias, when installed:

/prompts:nestjs-audit
/prompts:nestjs-audit full src/payments

Codex does not provide arbitrary bare user-defined commands such as /Nestjs audit; keep the supported alias explicit.

Actions

An optional repository-relative scope follows the action. If the first argument is not a recognized action, treat all arguments as the scope/focus and use full. For focused actions, load only the relevant lanes in the bundled semantic reference, plus any available specialist guidance needed for a cross-lane blocker. Report only the requested scope.

Audit workflow

1. Establish eligibility and scope

1. Resolve the current working directory and optional user scope without escaping the repository root.
2. Read AGENTS.md and other repository instructions, package.json, lockfiles, nest-cli.json, TypeScript and lint configuration, bootstrap files, module files, tests, and deployment manifests that affect the scope.
3. Verify that @nestjs/core is declared or that the repository is clearly a NestJS workspace. If not, stop and report that this audit is not applicable.
4. Record the current branch and dirty state. Do not alter or discard existing changes.
5. State a one-sentence baseline of the observed architecture. Do not infer Clean Architecture, DDD, CQRS, or microservices from folder names.

2. Collect deterministic evidence

Use the bundled collector from this skill's directory:

node scripts/collect-quality-evidence.mjs --root "$PWD" --run

Add --scope <relative-path> when the user requested a narrower audit. The collector:

• reads manifests and source files without changing them;
• identifies the package manager and available quality scripts;
• runs only allow-listed, non-fixing ESLint and tsc --noEmit commands when --run is present;
• never installs dependencies, runs builds, updates snapshots, writes coverage, or invokes arbitrary package scripts;
• returns JSON containing command results and heuristic review candidates.

If dependencies are missing or a command is unsafe, unavailable, timed out, or outside scope, record it as not run. Do not reinterpret a missing check as a pass. Never run lint --fix, format/write commands, migrations, deployment commands, live integration tests, or tests that may reach shared infrastructure during this audit.

3. Review four evidence lanes

Toolchain correctness

• Report parser, TypeScript, and lint diagnostics exactly enough to locate the problem.
• Deduplicate cascaded compiler errors when they share one root cause.
• Separate command failure from a code finding, such as missing dependencies or broken configuration.