Sharing a report

A scan can write part of its result as JSON, so a teammate reads the parts that matter without the whole report. You pick the sections, and the file carries those and nothing else.

Write one from the command line:

npx nestjs-doctor@latest . --share-sections score,findings:security

The file lands at nestjs-doctor-shared.json beside the scanned project. That path is fixed: --share-sections refuses --output and exits 2, because the two would write over each other.

Sections

SectionCarries
scoreThe score and the project info behind it
findings:<category>Findings in one category: security, performance, correctness, architecture, schema
endpointsThe traced HTTP routes, one entry per handler
schemaThe entities extracted from your ORM and their relations
modulesThe module graph: modules, edges, cycles, and bootstrap roots

schema and findings:schema are different sections. The first is the relational schema, the second is what the schema rules reported about it.

An unknown section, an unknown category, or an empty list exits 2 and lists what is valid. A section with nothing behind it is skipped instead, and a run whose sections are all empty warns on stderr and writes no file.

Code snippets

A shared finding carries its file, line, rule and message, never the source around it, unless you ask for it:

npx nestjs-doctor@latest . --share-sections findings:security --share-code

Each finding then carries a few lines of context. --share-code on its own is inert and silent, because there is no share for it to add them to.

From the menu and the report

A console scan in a terminal ends on the score screen, whose Share the report action opens the same picker: one checkbox per section with its count, one for code snippets, enter to save. It writes the same nestjs-doctor-shared.json beside the project. See The menu.

The HTML report carries a share button in its nav. The dialog builds the file in the browser and downloads it, so a report someone mailed you shares without a scan and without a network request.

What the file holds

KeyPresent
version, generator, generatedAtAlways
sectionsAlways. The ids you picked
summaryAlways. Totals across the shared categories only
findings, schemaIssuesAlways, possibly empty
includeCodeAlways. True only when code snippets were asked for and a finding carried them
project, scoreOnly with the score section
scopeOnly when the scan was narrowed, so a thin share reads as narrowed
endpoints, schema, modulesOnly with that section, and only when it had content

File paths inside are relative to the scanned directory, so the file names no absolute path from your machine. The module graph is stripped of boot timings.

Both gates run after the file is written, so a run that fails --min-score or --blocking still leaves the share behind.

Which findings reach the file

--share-sections and the menu share every finding the console reported, meaning every finding on the cli surface. The report's share button is stricter: it drops any finding that does not also carry the score surface, and offers no row for a category whose findings are all dropped.

Three built-in rules differ between the two, along with anything a surfaces override narrows:

RuleSurfaces
correctness/no-async-without-awaitcli
correctness/prefer-readonly-injectioncli
security/no-advisory-nestjs-packagescli, prComment

A project whose only correctness findings come from those two rules offers no correctness row in the report's dialog, while --share-sections findings:correctness writes them. See Findings that do not score and Surfaces.

What it does not combine with

FlagResult
--outputExits 2. The path is not configurable
--reportExits 2. --report writes HTML instead of a payload
--scoreWarns on stderr, writes nothing, continues at 0
--format report-jsonWarns on stderr, writes nothing, continues at 0

Every other format runs the share alongside its own output. The notice naming the written file goes to stderr, so a piped payload stays parseable:

npx nestjs-doctor@latest . --format json --share-sections score | jq .score