codebase-audit

name	codebase-audit
description	Systematic multi-phase codebase audit for technical debt, architecture mapping, and defect detection. Read-only scanning before any modifications. Supports Vue/uni-app, JS/TS projects.
domain	software-development

Codebase Audit Skill

Systematic, phased codebase auditing with progressive scan → diagnose → repair workflow.

When to Use

• User requests full project review/architecture mapping
• Before major refactoring or onboarding to a new codebase
• User wants technical debt assessment with prioritization

Phased Approach

Phase 1: Architecture Mapping (Read-Only)

1. Scan pages.json / router config for page hierarchy
2. Map directory structure (main package vs sub-packages/modules)
3. Identify framework stack (Vue version, state management, UI libraries)
4. Identify infrastructure (HTTP layer, i18n, storage, utilities)
5. Count files by size — flag files >500 lines
6. Output: Architecture Audit Report with page tree + infrastructure table

Phase 2: Deep Diagnostic (Read-Only)

Use Python execute_code scripts for parallel multi-dimensional scanning:

Scan 1: File Scale & API Style

# Walk project, parse Vue files, detect:
# - Mixed API styles (setup + data/methods)
# - Files >500/1000/2000 lines
# - v-for without :key, v-if+v-for on same element
# - data() with >10 properties

Scan 2: HTTP/Network Layer

# Check: config.js for hardcoded env/test flags
# Check: auth.js for token expiry handling
# Check: client.js for timeout, retry, abort mechanisms
# Check: interceptors for 401 handling
# Find direct uni.request/wx.fetch calls bypassing HTTP client

Scan 3: Lifecycle & State

# Detect onShow+mounted, onLoad+mounted mixing
# Find onShow triggering API calls (duplicate requests)
# Track uni.$emit/$on usage patterns
# Check uni.$on without corresponding uni.$off (memory leaks)
# Find pages with API calls but no login guard

Scan 4: UI/UX Consistency

# Detect hardcoded colors not using CSS variables
# Find px+rpx mixed usage in same file
# Check list components missing empty/loading states
# Count inline style="..." attributes (>5 is suspicious)
# Find console.log/warn in production code
# Detect font-size < 24rpx
# Find complex template expressions (>{{50+ chars}})

Phase 3: Auto-Repair (Write Mode)

• Only after explicit [EXECUTE] command from user
• One-step commit: one fix at a time
• Logic guard: never change core business logic
• Verification note after each fix

Prioritization Framework

Priority	Criteria	Examples
P0 Critical	Memory leaks, security, data corruption, production config leaks	uni.$on without $off, hardcoded prod URLs, missing 401 handling
P1 High	Giant files (>1000 lines), missing auth guards, broken lifecycle	3000-line component, unguarded API pages, onShow+mounted duplicate
P2 Medium	Missing UX states, style inconsistency, event bus overuse	No empty state, inline styles, hardcoded colors
P3 Low	Architecture improvements, optimization suggestions	Add Pinia, extract composables, request cancellation

Key Vue/uni-app Specific Checks

1. Lifecycle mixing: onShow/onLoad (小程序) vs onMounted (Vue) — they fire at different times
2. Event leaks: uni.$on in onMounted without uni.$off in onUnmounted
3. Mixed API: <script setup> + data()/methods() causes reactivity issues
4. onShow duplicate: onShow fires on every return from background — avoid heavy API calls
5. Hardcoded env: config.js with isTest = true without .env files
   • ⚠️ uni-app 微信小程序端不支持原生 process.env 注入，需在 vite.config.js 中配置 define 或使用条件编译 #ifdef

Output Format

Always produce structured reports with:

• Specific file paths and line numbers
• Exact code snippets showing the issue
• Impact analysis
• Concrete fix recommendation
• Priority tag (P0-P3)