vitest-auto-spy 5.48.0 → 5.50.0

package/CHANGELOG.md

@@ -10,6 +10,42 @@ The latest released version here must always match the one published on
 
 ## [Unreleased]
 
+## [5.50.0] - 2026-09-29
+
+### Changed
+
+- **`doctor` and `perf` color their findings by severity** — the `error` label red, `warn` yellow,
+  `info` plain — and the `perf --gate` verdict line turns red when something fails the run. The
+  same switch as the `perf` tables decides it (`NO_COLOR`, `FORCE_COLOR`, `TERM=dumb`, a terminal);
+  `--format json`, `--format markdown` and `--code-quality` stay free of escapes.
+- **Color in GitLab CI and GitHub Actions logs.** Both render ANSI color although the job's stdout
+  is a pipe, so the CLI now paints when `GITLAB_CI` or `GITHUB_ACTIONS` is set; `NO_COLOR`,
+  `FORCE_COLOR=0` and `TERM=dumb` still turn it off.
+
+### Documentation
+
+- **`returns` vs `overrides` has a page of its own**, with a landing card and a sidebar entry: one
+  table of what each seeds, whether the member stays a spy, how it behaves under `strict` and which
+  wins when a member is named in both. `agent-docs/configuration.md` gains the two rows its option
+  table was missing.
+
+## [5.49.0] - 2026-09-28
+
+### Added
+
+- **`no-real-component-provider`** in `vitest-auto-spy/eslint-plugin`, `error` in `recommended`:
+  `fixture.debugElement.injector.get(X)` / `fixture.componentRef.injector.get(X)` for a token nothing
+  in the file replaced with a double. That read is how a spec reaches a component-level provider, and
+  when nothing swapped it the fixture hands back the production class — the component spec then
+  drives the real store through HTTP and repeats the store's own spec. The message names the repair,
+  `overrideComponentProvider(Component, X)`. Tokens from `@angular/*`, classes the file renders
+  (`createComponent`, `imports`, `declarations`, `hostDirectives`), reads wrapped in `asSpy(…)` and
+  files that call `createWithAutoSpies` are left alone; `{ ignoreTokens }` keeps an intended
+  integration test real. Only the fixture's own injector is read, never a child's. Measured on three
+  consumers, 1078 spec files: 5 reports, all of them real. The plugin now ships fifty-one rules.
+  `vitest-auto-spy/eslint-plugin` is +0.78 kB min+gzip (+1.8 %) for the rule module and its
+  messages; no module is added to the entry's graph.
+
 ## [5.48.0] - 2026-09-28
 
 ### Added
@@ -6076,7 +6112,9 @@ moved under 1 %: `/angular` +192 B (+1.0 %) for the override queue and the HTTP
 This copy ships with the package and carries 5.x only. Releases before 5.0.0 are in the
 [full changelog](https://github.com/ASDAlexey/vitest-auto-spy/blob/master/CHANGELOG.md).
 
-[Unreleased]: https://github.com/ASDAlexey/vitest-auto-spy/compare/v5.48.0...HEAD
+[Unreleased]: https://github.com/ASDAlexey/vitest-auto-spy/compare/v5.50.0...HEAD
+[5.50.0]: https://github.com/ASDAlexey/vitest-auto-spy/compare/v5.49.0...v5.50.0
+[5.49.0]: https://github.com/ASDAlexey/vitest-auto-spy/compare/v5.48.0...v5.49.0
 [5.48.0]: https://github.com/ASDAlexey/vitest-auto-spy/compare/v5.47.0...v5.48.0
 [5.47.0]: https://github.com/ASDAlexey/vitest-auto-spy/compare/v5.46.0...v5.47.0
 [5.46.0]: https://github.com/ASDAlexey/vitest-auto-spy/compare/v5.45.0...v5.46.0

package/README.md

@@ -81,7 +81,7 @@ faster at suite scale ([benchmarks](#benchmarks)) — and for
 - 🧩 Module mocks that prove they applied — `assertMocked`, `moduleNamespace`, for a `vi.mock()` a bundler quietly ignored; `moduleNamespace(await importOriginal(), { passthrough: true })` is Vitest's `{ spy: true }` with `calledWith` on top, on any runner
 - 🧾 Fixtures without casts — deep-partial `createMock`, `createFixture` / `createFixtureFactory`, `narrow()`, `withOverrides()`, `asInstances()`, `captureArg()`, and `outOfType()` for the fixture that is outside its type on purpose
 - 🚚 A migration you can verify — `vitest-auto-spy/diagnostics`: `compareTestRuns` on the two JSON reports, `summarizeTestRun` / `formatTestRunComparison` to read the answer, `diffByField` for the assertion the reporter collapses, `explainSpy` for a double that answered something you did not configure
-- 📏 Lint rules and one-line test-run hygiene — fifty rules in `vitest-auto-spy/eslint-plugin` (eight `--fix`, nineteen suggestions, four of them for a suite mid-migration off jasmine), `setupAutoSpy()` — with `preset: 'strict'` for every guard at its strictest grade, and under `isolate: false` `strayListeners` / `restoreGlobals` for the listeners and raw global assignments a file leaves the next one, `restoreStorageSpies` (on by default) for the storage spy happy-dom will not let `mockRestore()` remove
+- 📏 Lint rules and one-line test-run hygiene — fifty-one rules in `vitest-auto-spy/eslint-plugin` (eight `--fix`, nineteen suggestions, four of them for a suite mid-migration off jasmine), `setupAutoSpy()` — with `preset: 'strict'` for every guard at its strictest grade, and under `isolate: false` `strayListeners` / `restoreGlobals` for the listeners and raw global assignments a file leaves the next one, `restoreStorageSpies` (on by default) for the storage spy happy-dom will not let `mockRestore()` remove
 - 🩺 [Editor diagnostics](#editor-diagnostics--webstorm--vs-code) — the same anti-patterns underlined while you type: native ESLint inspections in **WebStorm** and the other JetBrains IDEs, the ESLint extension in **VS Code**, no extra plugin either way
 - 🔎 [`npx vitest-auto-spy doctor`](#the-cli--doctor-perf-codemod-init-and-ng-test) — suite-level defects **that never fail a run**: a `tsconfig` `include` matching no file, a production module importing a spec, a `@jest-environment` pragma the runner never reads, config left behind for a runner that is gone. Read-only, no config, exits 1 in CI
 - ⏱️ [`npx vitest-auto-spy perf`](#perf--where-the-cpu-time-actually-goes) — where a suite's CPU time actually goes, phase by phase, and which spec files to act on: the ones that reach no DOM and could run under `node`, the ones that import a barrel. Runs Vitest once with a reporter this package ships, reads `TestModule.diagnostic()`, names files, states the rule behind each finding
@@ -4019,6 +4019,7 @@ export can never be.
 | `no-dead-schemas`                 |   `error`   | —                 | `schemas` on a testing module that declares nothing — a charm protecting nobody, and one that starts working the day `declarations` arrive                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
 | `no-import-time-spread`           |   `error`   | suggest           | `export const x = [...Imported]` at module scope → a `TypeError`, or a silently empty object, while the bundle loads                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | `no-unregistered-inject-spy`      |   `error`   | —                 | `injectSpy(X)` for a token this file never registered → the real instance, whose spy helpers exist only for the compiler                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `no-real-component-provider`      |   `error`   | —                 | `fixture.debugElement.injector.get(X)` for a component-level provider nothing in the file replaced → the real store under a component spec; `overrideComponentProvider(Cmp, X)`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | `prefer-render-shallow`           |   `warn`    | suggest           | `TestBed.createComponent` in a file that never reads the template → `renderShallow(X)`; 0.24× the per-test cycle at 100 children                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | `prefer-to-have-signal-value`     |   `warn`    | `--fix`           | `expect(signal()).toBe(…)` → `expect(signal).toHaveSignalValue(…)`; the matcher names the signal in the failure and refuses a non-signal. `toStrictEqual` keeps `{ strict: true }`, `toBeNull()` / `toBeUndefined()` become `toHaveSignalValue(null)` / `(undefined)`. **Type-aware** — the callee must be callable and carry Angular's signal brand — and silent without `parserOptions.project`; safe to autofix since 5.46.0 fixed the `Set`/`Map` comparison. A `toBe` against an object-typed signal is an identity check and is left alone                                                                                                                                                                                                                                                                                                                  |
 | `prefer-set-inputs`               |   `warn`    | suggest           | a run of `fixture.componentRef.setInput('title', v)` on one fixture → `await setInputs(fixture, { title: v })`, which resolves every name against the compiled definition before it writes one — an undeclared name is an `NG0303` on the console and no change at all — and types the value. The suggestion collapses the run, drops a `detectChanges()` under it and makes the callback `async`; it is offered rather than applied, because `stable()` ticks and a zone.js suite can answer that with `NG0101`                                                                                                                                                                                                                                                                                                                                                  |
@@ -4054,7 +4055,7 @@ Every message ends with a link to the matching [recipe](#how-to-mock): a rule th
 "don't" moves the problem rather than solving it. Rules travel with the API they recommend, so they
 are versioned together and stop being re-written in every project that installs the package.
 
-**Eight of the fifty fix on their own, nineteen offer suggestions**, and the split is not about how hard
+**Eight of the fifty-one fix on their own, nineteen offer suggestions**, and the split is not about how hard
 the rewrite is. `no-mocked-for-spy` touches a _declaration_: get it wrong and the file stops
 compiling, which is the loudest, cheapest failure there is — so `--fix` rewrites the type, adds
 `import type { Spy } from 'vitest-auto-spy'` and drops the `Mocked` import once nothing else uses
@@ -4131,6 +4132,16 @@ a spread, an unknown provider factory, `createWithAutoSpies`, `renderShallow` or
 `TestBed.overrideProvider` silences the file. A token handed a plain `useValue` is left to
 `prefer-provide-auto-spy` — two rules on one line only teach people to disable both.
 
+`no-real-component-provider` catches `fixture.debugElement.injector.get(X)` — or
+`fixture.componentRef.injector.get(X)` — for a token nothing in the file replaced with a double.
+`injectSpy` cannot reach a provider the component declares itself, so a spec that wants that store
+reads it through the fixture, and when nothing swapped it the fixture hands back the production
+class: the component spec drives the real store through HTTP and repeats the store's own spec. The
+message names the repair, [`overrideComponentProvider(Cmp, X)`](#a-provider-the-component-declares-for-itself). Tokens
+from `@angular/*`, classes the file renders, reads wrapped in `asSpy(…)` and files that call
+`createWithAutoSpies` are left alone, and `{ ignoreTokens }` keeps an intended integration test real.
+On three consumers, 1078 spec files, it reports 5, every one of them real.
+
 `no-ts-expect-error-on-double` reports `@ts-expect-error` / `@ts-ignore` above a double's
 configuration whatever reason follows the directive. On one 1759-file suite it reports 34, every one
 with a reason: four on overloaded clients ([the recipe](#how-to-mock-an-overloaded-method)), twenty-six
@@ -4225,7 +4236,7 @@ package's own — it needs its ESLint integration switched on.
 ### WebStorm and the other JetBrains IDEs
 
 No plugin to install: WebStorm, IntelliJ IDEA Ultimate, PhpStorm, PyCharm Professional and RubyMine
-all run ESLint natively, so the fifty rules appear inline, in the **Problems** tool window, and
+all run ESLint natively, so the fifty-one rules appear inline, in the **Problems** tool window, and
 under **Code → Inspect Code** for the whole project.
 
 ```js
@@ -4242,7 +4253,7 @@ has supported flat config since 2023.3); scope the block to spec files yourself;
 the fixes and suggestions live.
 
 A native JetBrains plugin is **not** planned — it would duplicate an integration the IDE already has
-and then keep a second copy of fifty rules, in Kotlin, in step with the TypeScript ones.
+and then keep a second copy of fifty-one rules, in Kotlin, in step with the TypeScript ones.
 
 ### VS Code, Cursor, Windsurf, VSCodium
 

package/agent-docs/angular.md

@@ -92,7 +92,7 @@ provideAutoSpyForToken(PRODUCTS, undefined, { returns: { getProducts: of([]), ge
 ```
 
 A seeded `overrides` value is stored verbatim and is **no longer a spy**, so seed data there and
-name methods in `returns` when they must stay assertable. On `provideAutoSpy` a plain function
+name methods in `returns` when they must stay assertable (the two compared in §5, [`configuration.md`](./configuration.md)). On `provideAutoSpy` a plain function
 seeded on a method is the exception: it becomes that method's spy, running the function until the
 test configures it, so `toHaveBeenCalled` works on it; a `vi.fn()` is kept as it is
 (`provideAutoSpyForToken` still stores every seed verbatim). The reason to prefer this over a second

package/agent-docs/configuration.md

@@ -31,6 +31,8 @@ createSpyFromClass(MyService, {
 | `lazySpies` | Unset: `true` (accessor placeholders) below 8 methods, `'proxy'` (a `Proxy`, lighter once touched) from 8, counting the methods the double spies (after `onlyMethodsToSpyOn` / `methodsToSpyOn`). Explicit `true` / `false` / `'proxy'` apply at any width. Calls, `Object.keys`, spread and snapshots behave the same in every mode. |
 | `strict` | Throw on a method nobody configured, instead of answering `undefined` (below). |
 | `onUnstubbedCall` | The general form of `strict`; its return value becomes the call's return value. |
+| `returns` | What a spied **method** answers. The member stays a spy (`toHaveBeenCalled` works); a default that `calledWith` / `mockReturnValue` / `resolveWith` replace. A key that is not a spied method is reported. |
+| `overrides` | Replaces **any member** with the value as written — a field, a signal, an `Observable` property. The member is no longer a spy, except a plain function seeded on a method (class factories only), which becomes its spy. Named in both, `overrides` wins. |
 | `selfReturning` | The named methods answer the double itself — a default like `returns`; a name in both answers `returns`. |
 
 **`instanceMethodsToSpyOn` is not an edge case — it is a top-5 option** (103 of ~370 spec files in

package/agent-docs/eslint.md

@@ -73,6 +73,7 @@ export default [
 | `no-dead-schemas` | `error` | — | `schemas` on a testing module with no `declarations` — the schema applies to nothing; the file decides, so a `declarations` in another `configureTestingModule` call silences it |
 | `no-import-time-spread` | `error` | suggest | `export const x = [...Imported]` at module scope → a `TypeError`, or a silently empty object, while the bundle loads |
 | `no-unregistered-inject-spy` | `error` | — | `injectSpy(X)` for a token this file never registered → the real instance, whose spy helpers exist only for the compiler |
+| `no-real-component-provider` | `error` | — | `fixture.debugElement.injector.get(X)` for a component-level provider nothing in the file replaced → the real store under a component spec; `overrideComponentProvider(Cmp, X)`; `{ ignoreTokens }` for an intended integration test |
 | `prefer-render-shallow` | `warn` | suggest | `TestBed.createComponent` in a file that never reads the template → `renderShallow(X)`; 0.24× the per-test cycle at 100 children |
 | `prefer-set-inputs` | `warn` | suggest | a run of `fixture.componentRef.setInput('title', v)` on one fixture → `await setInputs(fixture, { title: v })` — the name is resolved against the compiled definition before the first write (an undeclared one is an `NG0303` and no change) and the value is typed. The run collapses into one call and a `detectChanges()` under it goes; offered, not applied, because `stable()` ticks and a zone.js suite answers that with `NG0101` |
 | `prefer-to-have-signal-value` | `warn` | `--fix` | `expect(component.total()).toBe(3)` / `toEqual(…)` → `expect(component.total).toHaveSignalValue(3)`, `toStrictEqual` → `{ strict: true }`, `toBeNull()` / `toBeUndefined()` → `toHaveSignalValue(null)` / `(undefined)`; the matcher names the signal in the failure and refuses a value that is not one. **Type-aware**: the signal is recognised by Angular's brand on its type, so methods, functions and getters are never reported, and without `parserOptions.project` it reports nothing. A `toBe` against an object-typed signal (`expect(list.items()).toBe(items)`) is an identity check the deep matcher would lose, so it is reported only when the expected value is a primitive literal or the signal's type is primitive |
@@ -104,9 +105,9 @@ export default [
 | `no-save-arguments-by-value` | `error` | — | `spy.calls.saveArgumentsByValue()` — a no-op here, so the spec silently asserts on post-mutation state |
 | `prefer-native-spy-api` | `error` | `--fix` / suggest | `.and` / `.calls` where the spy's own API says the same thing — turn it on for the last mile off the jasmine shim |
 
-Fifty rules, **every one an `error` since 4.0.0 except `prefer-render-shallow`,
+Fifty-one rules, **every one an `error` since 4.0.0 except `prefer-render-shallow`,
 `no-stub-class-double`, `no-structural-double`, `prefer-create-mock`, `no-instance-lifecycle-spy`,
-`prefer-set-inputs`, `no-unasserted-argument`, `prefer-spy-on-own-method` and `prefer-to-have-signal-value`**; eight fix on their own, nineteen offer suggestions. Forty-six are syntactic; `no-private-member-access`, `no-mistyped-use-value`,
+`prefer-set-inputs`, `no-unasserted-argument`, `prefer-spy-on-own-method` and `prefer-to-have-signal-value`**; eight fix on their own, nineteen offer suggestions. Forty-seven are syntactic; `no-private-member-access`, `no-mistyped-use-value`,
 `no-unknown-use-value-key` and `prefer-to-have-signal-value` read types, and all four report nothing at all without `parserOptions.project` / `projectService`
 rather than guessing. `no-compile-components` waits the same way for a fact no file holds — which
 builder the project has — and reports nothing until `{ builder: 'inline-resources' }` states it. The config used to be a graded mix of `error` / `warn` / `off`, which decided for the

package/dist/cli.js

@@ -607,11 +607,12 @@ var wrap = (open) => (text) => `${ESC}[${open}m${text}${ESC}[0m`;
 var TERMINAL = { red: wrap("31"), yellow: wrap("33"), cyan: wrap("36"), bold: wrap("1"), dim: wrap("2") };
 var same = (text) => text;
 var MONOCHROME = { red: same, yellow: same, cyan: same, bold: same, dim: same };
+var COLOR_LOGS = ["GITLAB_CI", "GITHUB_ACTIONS"];
 function colorWanted(env, isTTY = process.stdout.isTTY === true) {
   if (env["NO_COLOR"] !== void 0 || env["FORCE_COLOR"] === "0" || env["TERM"] === "dumb") {
     return false;
   }
-  return env["FORCE_COLOR"] !== void 0 || isTTY;
+  return env["FORCE_COLOR"] !== void 0 || COLOR_LOGS.some((name) => env[name] !== void 0) || isTTY;
 }
 function painterFor(colors) {
   return colors ?? colorWanted(process.env) ? TERMINAL : MONOCHROME;
@@ -658,7 +659,15 @@ function wrapLine(text, width, indent, firstIndent) {
 
 // src/cli/report.ts
 var SEVERITY_ORDER = { error: 0, warning: 1, info: 2 };
-var SEVERITY_LABEL = { error: "error", warning: "warn ", info: "info " };
+var SEVERITY_LABEL = { error: "error", warning: "warn", info: "info" };
+var SEVERITY_PAINT = {
+  error: (paint, text) => paint.red(text),
+  warning: (paint, text) => paint.yellow(text),
+  info: (_paint, text) => text
+};
+function severityLabel(severity, paint) {
+  return padEnd(SEVERITY_PAINT[severity](paint, SEVERITY_LABEL[severity]), 5);
+}
 var BODY = "       ";
 var ITEM = `${BODY}  `;
 var ITEM_BODY = `${ITEM}  `;
@@ -679,23 +688,23 @@ function fixLines(finding2, width) {
   const docs = docsFor(finding2.check);
   return [...wrapText(finding2.fix, width, `${BODY}  `, `${BODY}\u2192 `), ...docs === void 0 ? [] : [`${BODY}Docs: ${docs}`]];
 }
-function formatOne(finding2, width) {
+function formatOne(finding2, width, paint) {
   const where2 = finding2.file === void 0 ? "" : ` ${finding2.file}`;
   return [
-    `${SEVERITY_LABEL[finding2.severity]}  ${finding2.check}${where2}`,
+    `${severityLabel(finding2.severity, paint)}  ${finding2.check}${where2}`,
     ...wrapText(finding2.message, width, BODY),
     ...(finding2.details ?? []).map((line) => `${BODY}${line}`),
     ...fixLines(finding2, width)
   ].join("\n");
 }
-function formatGroup({ first, members: group3 }, width) {
+function formatGroup({ first, members: group3 }, width, paint) {
   const sameMessage = group3.every((finding2) => finding2.message === first.message);
   const places = group3.flatMap((finding2) => [
     `${ITEM}${String(finding2.file)}`,
     ...sameMessage ? [] : wrapText(finding2.message, width, ITEM_BODY)
   ]);
   return [
-    `${SEVERITY_LABEL[first.severity]}  ${first.check} \u2014 ${placesOf(group3)}`,
+    `${severityLabel(first.severity, paint)}  ${first.check} \u2014 ${placesOf(group3)}`,
     ...sameMessage ? wrapText(first.message, width, BODY) : [],
     ...places,
     ...fixLines(first, width)
@@ -723,8 +732,8 @@ function groupFindings(findings) {
 function filterBySeverity(findings, minSeverity = "info") {
   return findings.filter((finding2) => SEVERITY_ORDER[finding2.severity] <= SEVERITY_ORDER[minSeverity]);
 }
-function formatFindings(findings, minSeverity = "info", width = outputWidth()) {
-  return groupFindings(filterBySeverity(findings, minSeverity)).map((group3) => group3.members.length === 1 ? formatOne(group3.first, width) : formatGroup(group3, width)).join("\n\n");
+function formatFindings(findings, minSeverity = "info", width = outputWidth(), paint = MONOCHROME) {
+  return groupFindings(filterBySeverity(findings, minSeverity)).map((group3) => group3.members.length === 1 ? formatOne(group3.first, width, paint) : formatGroup(group3, width, paint)).join("\n\n");
 }
 function tallyOf(findings) {
   return {
@@ -3865,7 +3874,7 @@ function checkForeignPragma(graph) {
 }
 
 // src/cli/checks/export-map.generated.ts
-var EXPORT_MAP_VERSION = "5.47.0";
+var EXPORT_MAP_VERSION = "5.49.0";
 var ENTRY_SPECIFIERS = "vitest-auto-spy vitest-auto-spy/bun vitest-auto-spy/bun-angular vitest-auto-spy/node vitest-auto-spy/rstest vitest-auto-spy/rxjs vitest-auto-spy/console vitest-auto-spy/dom-stubs vitest-auto-spy/diagnostics vitest-auto-spy/jasmine vitest-auto-spy/jasmine-compat vitest-auto-spy/observer-spy vitest-auto-spy/angular vitest-auto-spy/angular/diagnostics vitest-auto-spy/angular/doubles vitest-auto-spy/angular/matchers vitest-auto-spy/angular-http vitest-auto-spy/angular-router vitest-auto-spy/signal-forms vitest-auto-spy/nestjs vitest-auto-spy/react vitest-auto-spy/vue vitest-auto-spy/svelte vitest-auto-spy/setup vitest-auto-spy/zone vitest-auto-spy/eslint-plugin vitest-auto-spy/perf-reporter";
 var EXPORTED_BY = {
   AccessorImplementations: "0 1 2 3 4 12 20 21 22",
@@ -8236,7 +8245,8 @@ function formatVerdict(rows, paint) {
     ],
     paint
   );
-  return [`perf gate verdict \u2014 ${rows.length} judged, ${failing} ${failing === 1 ? "fails" : "fail"} the run`, ...table];
+  const title = `perf gate verdict \u2014 ${rows.length} judged, ${failing} ${failing === 1 ? "fails" : "fail"} the run`;
+  return [failing > 0 ? paint.red(title) : title, ...table];
 }
 
 // src/cli/report-markdown.ts
@@ -8464,7 +8474,7 @@ ${nothingToDo(analysis)}`);
   reportOnly(analysis.findings, io, minSeverity);
 }
 function reportOnly(findings, io, minSeverity) {
-  const report2 = formatFindings(findings, minSeverity);
+  const report2 = formatFindings(findings, minSeverity, outputWidth(), painterFor(void 0));
   if (report2 !== "") {
     io.out(`
 ${report2}`);
@@ -9085,7 +9095,7 @@ function doctorCommand(cwd, argv, io) {
   io.out(`vitest-auto-spy doctor \u2014 ${cwd}`);
   io.out(`${profile.files.length} files scanned, ${specFiles} of them spec files \u2014 runner: ${profile.runner}, entry: ${profile.entry}
 `);
-  const report2 = findings.length === 0 ? "No problems found." : formatFindings(findings, minSeverity);
+  const report2 = findings.length === 0 ? "No problems found." : formatFindings(findings, minSeverity, outputWidth(), painterFor(void 0));
   if (report2 !== "") {
     io.out(`${report2}
 `);

package/dist/eslint-plugin.cjs

@@ -4629,6 +4629,120 @@ var preferProvideAutoSpy = defineRule({
   }
 });
 
+// src/lib/eslint/real-component-provider.ts
+var REPLACING_CALLS = /* @__PURE__ */ new Set([
+  "createSpyFromClass",
+  "overrideAutoSpy",
+  "overrideComponent",
+  "overrideComponentProvider",
+  "overrideProvider",
+  "provideAutoSpy"
+]);
+var OPAQUE_HELPERS2 = /* @__PURE__ */ new Set(["createWithAutoSpies"]);
+var OWN_INJECTOR_HOLDERS = /* @__PURE__ */ new Set(["componentRef", "debugElement"]);
+var FRAMEWORK_SCOPE = "@angular/";
+var REAL_COMPONENT_PROVIDER_SCHEMA = [
+  {
+    type: "object",
+    properties: { ignoreTokens: { type: "array", items: { type: "string" }, uniqueItems: true } },
+    additionalProperties: false
+  }
+];
+function calleeName2(node) {
+  return isIdentifier(node.callee) ? node.callee.name : memberName(node.callee);
+}
+var RENDERED_KEYS = /* @__PURE__ */ new Set(["declarations", "hostDirectives", "imports"]);
+function isRenderedList(node) {
+  const name = propertyName(node.parent);
+  return name !== void 0 && RENDERED_KEYS.has(name) && Reflect.get(node.parent, "value") === node;
+}
+function isReplacingArgument(node) {
+  const call = node.parent;
+  if (!isCallExpression(call) || !call.arguments.includes(node)) {
+    return false;
+  }
+  const name = calleeName2(call);
+  return name !== void 0 && REPLACING_CALLS.has(name);
+}
+function ownInjectorToken(node) {
+  const [token] = node.arguments;
+  if (!isMemberExpression(node.callee) || memberName(node.callee) !== "get" || !token || !isIdentifier(token)) {
+    return void 0;
+  }
+  const injector = node.callee.object;
+  if (!isMemberExpression(injector) || memberName(injector) !== "injector") {
+    return void 0;
+  }
+  const holder = memberName(injector.object);
+  return holder !== void 0 && OWN_INJECTOR_HOLDERS.has(holder) ? token : void 0;
+}
+function isClaimedSpy(node) {
+  return isCallExpression(node.parent) && calleeName2(node.parent) === "asSpy";
+}
+function ignoredTokens(options) {
+  const configured = Reflect.get(Object(options[0]), "ignoreTokens");
+  return new Set(Array.isArray(configured) ? configured.filter((entry) => typeof entry === "string") : []);
+}
+function isFrameworkImport(node) {
+  return node.type === "ImportDeclaration" && String(Reflect.get(Reflect.get(node, "source"), "value")).startsWith(FRAMEWORK_SCOPE);
+}
+function readCall2(node, scan) {
+  const name = calleeName2(node);
+  if (name !== void 0 && OPAQUE_HELPERS2.has(name)) {
+    scan.opaque = true;
+  }
+  if (name === "createComponent") {
+    node.arguments.filter(isIdentifier).forEach((argument) => scan.rendered.add(argument.name));
+  }
+  const token = ownInjectorToken(node);
+  if (token && !isClaimedSpy(node)) {
+    scan.reads.push(token);
+  }
+}
+var noRealComponentProvider = defineRule({
+  name: "no-real-component-provider",
+  description: "Do not read a component's own provider from the fixture unless the file replaced it with a spy",
+  schema: REAL_COMPONENT_PROVIDER_SCHEMA,
+  messages: {
+    noRealComponentProvider: "Nothing in this file replaces `{{token}}`, so the fixture hands back the real instance the component provides, and the spec tests it through the component. Install the spy where the component looks: `const {{variable}} = overrideComponentProvider(Component, {{token}});`, before the fixture is created. If the real one is meant, list `{{token}}` in `{ ignoreTokens }`."
+  },
+  create: (context) => {
+    const scan = { reads: [], replaced: /* @__PURE__ */ new Set(), rendered: /* @__PURE__ */ new Set(), framework: /* @__PURE__ */ new Set(), opaque: false };
+    const ignored = ignoredTokens(context.options);
+    return {
+      Property: (node) => {
+        if (propertyName(node) === "provide" && isIdentifier(node.value)) {
+          scan.replaced.add(node.value.name);
+        }
+      },
+      Identifier: (node) => {
+        if (hasAncestor(node, isReplacingArgument)) {
+          scan.replaced.add(node.name);
+        }
+        if (hasAncestor(node, isRenderedList)) {
+          scan.rendered.add(node.name);
+        }
+        if (hasAncestor(node, isFrameworkImport)) {
+          scan.framework.add(node.name);
+        }
+      },
+      CallExpression: (node) => {
+        readCall2(node, scan);
+      },
+      "Program:exit": () => {
+        if (scan.opaque) {
+          return;
+        }
+        const skipped = [scan.replaced, scan.rendered, scan.framework, ignored];
+        scan.reads.filter(({ name }) => !skipped.some((names) => names.has(name))).forEach((token) => {
+          const variable = `${token.name.charAt(0).toLowerCase()}${token.name.slice(1)}`;
+          context.report({ node: token, messageId: "noRealComponentProvider", data: { token: token.name, variable } });
+        });
+      }
+    };
+  }
+});
+
 // src/lib/eslint/reflect-access.ts
 var HELPER3 = "mockValueProp";
 var REFLECT = /* @__PURE__ */ new Set(["Reflect"]);
@@ -5552,7 +5666,7 @@ function readCast(context, node) {
     context.report({ node, messageId: "castResponse", data: { cast: excerpt(context, node, 50) } });
   }
 }
-function readCall2(context, node) {
+function readCall3(context, node) {
   const helper = isIdentifier(node.callee) ? node.callee.name : void 0;
   const argument = node.typeArguments?.params[0];
   if (helper === void 0 || !TYPE_ARGUMENT_DOUBLES.has(helper) || argument === void 0) {
@@ -5574,7 +5688,7 @@ var preferStubResponse = defineRule({
   },
   create: (context) => ({
     CallExpression: (node) => {
-      readCall2(context, node);
+      readCall3(context, node);
     },
     [CAST_SELECTORS.join(", ")]: (node) => {
       readCast(context, node);
@@ -5810,6 +5924,7 @@ var rules = {
   "no-dead-schemas": noDeadSchemas,
   "no-import-time-spread": noImportTimeSpread,
   "no-unregistered-inject-spy": noUnregisteredInjectSpy,
+  "no-real-component-provider": noRealComponentProvider,
   "prefer-render-shallow": preferRenderShallow,
   "prefer-to-have-signal-value": preferToHaveSignalValue,
   "prefer-observer-stub": preferObserverStub,
@@ -5862,6 +5977,7 @@ var recommendedRules = {
   [`${PLUGIN_NAME}/no-dead-schemas`]: "error",
   [`${PLUGIN_NAME}/no-import-time-spread`]: "error",
   [`${PLUGIN_NAME}/no-unregistered-inject-spy`]: "error",
+  [`${PLUGIN_NAME}/no-real-component-provider`]: "error",
   [`${PLUGIN_NAME}/prefer-render-shallow`]: "warn",
   [`${PLUGIN_NAME}/prefer-to-have-signal-value`]: "warn",
   [`${PLUGIN_NAME}/no-stub-class-double`]: "warn",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vitest-auto-spy",
-  "version": "5.48.0",
+  "version": "5.50.0",
   "description": "Auto-generate fully-typed test spies from a class — across Vitest, Bun, node:test and Rstest, with Angular/NestJS/React/Vue/Svelte recipes. Drop-in replacement for jest-auto-spies and jasmine-auto-spies.",
   "keywords": [
     "auto-mock",

package/skills/vitest-auto-spy/SKILL.md

@@ -410,7 +410,9 @@ it('loads', async () => {
   To control an `effect()`, set the signals it reads and assert what it produced.
 - **`injectSpy(X)` only reaches the global TestBed.** For a component-level provider use
   `asSpy(fixture.debugElement.injector.get(X))` to read it, or `overrideComponentProvider(Cmp, X)` to
-  replace it — `provideAutoSpy` loses to a provider the component declares, silently.
+  replace it — `provideAutoSpy` loses to a provider the component declares, silently. Reading it
+  bare, with nothing in the file replacing it, hands back the real store and makes the component spec
+  re-test it; `no-real-component-provider` reports that.
 - **Declare `Spy<T>`, never Vitest's `Mocked<T>`** — `Mocked<T>` keeps the private members, so the
   assignment fails with a list of private field names that says nothing about the declaration being
   the problem.
@@ -487,7 +489,7 @@ npx vitest-auto-spy codemod --verify  # after a migration: anything the transfor
 Most of this library's guarantees are type-level, so a green run that does not type-check is not
 done. Report failures with their output rather than describing them as passing.
 
-**After any `eslint --fix` over specs, run `npx tsc --noEmit`.** The fifty rules in
+**After any `eslint --fix` over specs, run `npx tsc --noEmit`.** The fifty-one rules in
 `vitest-auto-spy/eslint-plugin` are lint, not typecheck: `no-mocked-for-spy` rewrites a declaration
 to `Spy<T>` and cannot see what the name is assigned two lines below, so a clean lint pass is not
 evidence that the types still hold. Where it cannot prove the rename it downgrades to a suggestion —