codingbuddy copilot-instructions.md

Copilot Code Review Instructions

Review Priority Levels

• 🔴 CRITICAL (Block merge): Security vulnerabilities, logic errors, breaking changes, data loss risks
• 🟡 IMPORTANT (Requires discussion): Code quality issues, missing tests, performance bottlenecks, architectural deviations
• 🟢 SUGGESTION (Non-blocking): Readability improvements, minor optimizations, best practice refinements

Security Review

• Check for hardcoded secrets, API keys, or credentials
• Look for SQL injection and XSS vulnerabilities
• Verify proper input validation and sanitization
• Check for command injection in shell executions
• Ensure authentication/authorization is properly implemented
• Verify dependencies don't have known vulnerabilities

TypeScript Standards

• No any type usage — use unknown or specific types with strict mode
• Prefer const over let, never use var
• Use explicit return types for public functions
• Ensure proper null/undefined handling with strict null checks
• Prefer pure functions over impure ones (separate files for pure/impure)

Code Quality

• Functions should follow Single Responsibility Principle (10-20 lines max)
• No deeply nested code (max 3-4 levels)
• No magic numbers — use named constants
• Remove dead code and unused imports
• DRY: No duplicated logic across files
• Keep methods small and focused

Testing Standards

• Core logic (entities, shared/utils, hooks) MUST have tests (TDD approach)
• UI components (features, widgets) should have test-after coverage
• Target 90%+ test coverage
• No mocking — test real behavior with actual implementations
• Use Arrange-Act-Assert pattern
• Test edge cases and error paths

Architecture

• Layer dependency: app → widgets → features → entities → shared
• No circular dependencies between modules
• Server Components as default, Client Components only when necessary
• Pure/impure function separation (different files)

NestJS Patterns (MCP Server)

• Follow NestJS module pattern (Module → Controller/Gateway → Service)
• Use dependency injection properly
• Validate DTOs with class-validator decorators
• Handle errors with proper NestJS exception filters