santoshyadavdev · Oct 10, 2026 · coderabbitai · Oct 10, 2026
@@ -0,0 +1,36 @@
+---
+name: monorepo-doctor
+description: Use when a user asks for a JS/TS monorepo audit, monorepo health check, Nx/Turborepo cache issues, affected tests not running, circular dependencies, package boundary drift, or test code shipped to production. Read-only; writes Markdown and JSON reports.
+---
+
+# Monorepo Doctor
+
+Audit a JS/TS monorepo for five classes of problems that teams routinely miss, and produce an evidence-backed report.
+
+Prerequisites: Node ≥ 22.5. The work dir is `$W` = `$(node -p 'require("os").tmpdir()')/monorepo-doctor` (see detection.md).
+
+## Rules
+
+- **Read-only.** Never install dependencies, build, run tests, or edit project files. Allowed writes: `monorepo-doctor-report.md`, `monorepo-doctor-report.json` (workspace root or a user-given dir) and `$W`.
+- Allowed commands: the snippets in the reference files, `npx --yes knip@6.41.0`, `npm_config_ignore_scripts=true npx --yes publint@0.3.25` (exact pinned versions — never unpinned or `@latest`; bump only after review), `npm pack --dry-run --json --ignore-scripts`, and `npx nx` / `npx turbo` **only if** detection reports them `installed` (graph / `--dry=json` / `boundaries` only — never real task runs, with read-only env vars from the references).
+- **Never abort a check.** If a tool fails, mark the check `partial` or `skipped` with a reason and continue.
+- **Every finding needs evidence** (config snippet, file:line, or command output). No evidence → no finding.
+- Use only the finding ids defined in the reference files.
+
+## Workflow
+
+1. **Detect** — follow [references/detection.md](references/detection.md). Stop if `NO_WORKSPACE`.
+2. **Scan** — follow [references/scan.md](references/scan.md).
+3. **Check** — run all five unless the user asked for a subset (write `{"status":"not-run","reason":"not requested","findings":[]}` to `$W/findings/<check>.json` for the others):
+   - [references/boundaries.md](references/boundaries.md) — package split & public API
+   - [references/circular-deps.md](references/circular-deps.md) — package and file cycles
+   - [references/caching.md](references/caching.md) — Nx / Turborepo cache correctness
+   - [references/ci-coverage.md](references/ci-coverage.md) — tests that silently don't run in CI
+   - [references/prod-leakage.md](references/prod-leakage.md) — test code shipped to production
+     The checks are independent; if you can run sub-agents, run them in parallel.
+4. **Report** — follow [references/report-format.md](references/report-format.md): validate each `findings/<check>.json`, render, then show the user the summary line and the top 5 findings.
+5. **CI mode** (only if asked, or when invoked non-interactively with a threshold) — run the exit-code snippet from report-format.md.
+
+## Tracking
+
+Create a todo per phase/check and mark each done as its findings file is written.
@@ -0,0 +1,43 @@
+# Check 1 — Package boundaries
+
+Question: are packages split along real seams, and is each package's public API respected?
+Inputs: `workspace.json`, `scan.json`. Output: `findings/boundaries.json`.
+
+## Rules
+
+| id                                             | severity | detect                                                                                                                                                         | evidence                                               |
+| ---------------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------ |
+| `boundaries/oversized-package`                 | low      | `scan.packages[p].sourceFiles > 500` or `loc > 50000`                                                                                                          | counts                                                 |
+| `boundaries/deep-import`                       | medium   | each `scan.imports` entry with `deep && (declared \|\| fromSource === "project.json")` (undeclared package.json importers are reported by ci-coverage instead) | file:line + import specifier + target's `exports` keys |
+| `boundaries/unlisted-dependency`               | medium   | knip `unlisted` entries                                                                                                                                        | knip output line                                       |
+| `boundaries/unused-dependency`                 | low      | knip `dependencies` / `devDependencies` entries                                                                                                                | knip output line                                       |
+| `boundaries/nx-missing-module-boundaries-rule` | medium   | Nx detected and no ESLint config in the root mentions `@nx/enforce-module-boundaries`                                                                          | list of ESLint config files checked                    |
+| `boundaries/nx-permissive-module-boundaries`   | low      | the rule exists but `depConstraints` contains `{ sourceTag: '*', onlyDependOnLibsWithTags: ['*'] }`                                                            | the config snippet                                     |
+| `boundaries/nx-untagged-project`               | low      | Nx detected, rule absent or permissive, and a project has empty `tags`                                                                                         | project.json path                                      |
+| `boundaries/turbo-boundaries-violation`        | medium   | each violation printed by `turbo boundaries`                                                                                                                   | output line                                            |
+
+Group `deep-import` findings: one finding per (from, target) pair, listing up to 5 locations in `evidence`; `location` is the first occurrence.
+
+## Steps
+
+1. Load `workspace.json` and `scan.json`. Apply the size and deep-import rules directly.
+2. **knip** — only if `hasNodeModules`:
+   ```bash
+   W="$(node -p 'require("os").tmpdir()')/monorepo-doctor"
+   npx --yes knip@6.41.0 --reporter json --include dependencies,unlisted --no-progress --no-exit-code
-   npx --yes knip@6.41.0 --reporter json --include dependencies,unlisted --no-progress --no-exit-code
+   npx --yes knip@6.41.0 --reporter json --include dependencies,devDependencies,unlisted --no-progress --no-exit-code
-   npx --yes knip@6.41.0 --reporter json --include dependencies,unlisted --no-progress --no-exit-code
+   npx --yes knip@6.41.0 --reporter json --include dependencies,devDependencies,unlisted --no-progress --no-exit-code
+   ```
+   Parse stdout as JSON. Its shape varies by version; look for per-file `dependencies`, `devDependencies` and `unlisted` arrays of `{ name }`. Map the file to its package via `workspace.json`. If knip fails or the output can't be parsed, mark the check `partial` with reason `knip unavailable: <first line of error>`. Do **not** report `unused-dependency` for `@types/*` packages or for tools only referenced in scripts.
+3. **Nx** — only if Nx is an orchestrator: read ESLint configs in the root (`eslint.config.{js,mjs,cjs,ts}`, `.eslintrc{,.json,.js,.cjs}`) and every package dir. Apply the three `nx-*` rules. A config that contains `@nx/enforce-module-boundaries` or legacy `@nrwl/nx/enforce-module-boundaries` anywhere counts as present. Group `nx-untagged-project` consistently as one finding per untagged project found from the root and package-dir project configs.
+4. **Turborepo** — only if turbo is an orchestrator **and installed**:
+   ```bash
+   W="$(node -p 'require("os").tmpdir()')/monorepo-doctor"
+   TURBO_TELEMETRY_DISABLED=1 npx turbo boundaries
+   ```
+   One finding per reported violation. If the command errors with an unknown-command message (turbo < 2.4), skip this sub-step and note it in `reason`.
+5. Write `findings/boundaries.json`.
+
+## Fix guidance
+
+- deep-import: add the subpath to the target's `exports`, or re-export from its entry point, then import from the package root.
+- oversized-package: identify clusters by directory and by which consumers import which files (`scan.imports` subpaths); propose 2–3 candidate splits.
+- nx-missing-module-boundaries-rule: add `@nx/enforce-module-boundaries` with `depConstraints` based on `scope:*`/`type:*` tags.