docguard-cli 0.11.0__tar.gz → 0.11.1__tar.gz

{docguard_cli-0.11.0/extensions/spec-kit-docguard → docguard_cli-0.11.1/.agent}/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.9.9
+  version: 0.11.1
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.9.9 -->
+<!-- docguard:version: 0.11.1 -->
 
 # DocGuard Fix Skill
 

{docguard_cli-0.11.0/extensions/spec-kit-docguard → docguard_cli-0.11.1/.agent}/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.9.9
+  version: 0.11.1
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.9.9 -->
+<!-- docguard:version: 0.11.1 -->
 
 # DocGuard Guard Skill
 

{docguard_cli-0.11.0/extensions/spec-kit-docguard → docguard_cli-0.11.1/.agent}/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.9.9
+  version: 0.11.1
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.9.9 -->
+<!-- docguard:version: 0.11.1 -->
 
 # DocGuard Review Skill
 

{docguard_cli-0.11.0 → docguard_cli-0.11.1}/.agent/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.9.9
+  version: 0.11.1
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.9.9 -->
+<!-- docguard:version: 0.11.1 -->
 
 # DocGuard Score Skill
 

{docguard_cli-0.11.0 → docguard_cli-0.11.1}/.agent/skills/docguard-sync/SKILL.md

@@ -4,7 +4,7 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.10.0
+  version: 0.11.1
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
 

{docguard_cli-0.11.0 → docguard_cli-0.11.1}/AGENTS.md

@@ -96,6 +96,7 @@ extensions/spec-kit-docguard/
 
 ## Rules
 
+- **PR-first workflow — no direct-to-main commits.** Create a branch (`git checkout -b <type>/<slug>`), push, `gh pr create`, let CI run, self-review, squash-merge. Tag releases only after merge on `main`. The only acceptable direct-to-main: typo fixes in comments or README badge URLs.
 - Never commit without updating CHANGELOG.md
 - If code deviates from docs, add `// DRIFT: reason`
 - Security rules in SECURITY.md are mandatory

{docguard_cli-0.11.0 → docguard_cli-0.11.1}/CHANGELOG.md

@@ -7,6 +7,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.11.1] - 2026-05-25
+
+Patch release addressing false positives surfaced by the v0.11.0 audit of the `wu-whatsappinbox` enterprise monorepo, generalized into a multi-tool IaC detector, plus several DocGuard self-audit improvements. Spec: `specs/003-v011-false-positives/`.
+
+### Fixed
+- **Docs-Sync no longer misclassifies frontend API clients as backend routes.** Dropped the ambiguous bare `'api'` from the route-directory convention list. `src/api/client.ts` (frontend axios) and similar are no longer scanned as Express/Next.js routes (FP-1). For Next.js App Router (`src/app/api`, `app/api`), only files matching the strict `route.{ts,tsx,js,jsx,mjs}` filename convention are counted — helper files in the same tree are skipped (FR-001, FR-002).
+- **Test files are no longer flagged as undocumented services or routes.** The docs-sync route and service loops now skip paths under `__tests__/` and filenames matching `*.{test,spec}.{ts,tsx,js,jsx,mjs,py,java,go}` (FP-2, FR-003, FR-004). Eliminates ~7 spurious warnings per monorepo with co-located tests.
+- **Build outputs no longer flagged as undocumented source.** Added `cdk.out`, `out`, `.nuxt`, `.claude` to the docs-coverage `IGNORE_DIRS` set (FP-3, FR-005).
+- **`config.ignore` is now honored by Docs-Coverage's source-directory scan** (FP-3, FR-006 / IR-5). Closes a long-standing inconsistency where other validators respected the user's ignore but the source-dir scan did not. Patterns like `**/cdk.out/**` now match the directory itself as well as files inside it.
+- **Worktree copies no longer double-counted.** `globMatch` in `cli/shared-ignore.mjs` now rejects paths under `.claude/worktrees/`, `.git/worktrees/`, and `.jj/` at any depth — same treatment as `node_modules` (FP-4, FR-007). Affects every Claude-Code project using parallel-agent worktrees.
+- **Check 1 (config files) no longer flags build-cache dotdirs as undocumented configs.** Now skips directories — `.nuxt`, `.claude`, etc. are excluded by `IGNORE_DIRS` for the source-dir scan instead.
+- **Check 1 (config files) now honors `config.ignore` too.** Originally fixed only for the source-directory scan; a follow-up audit reproduced the same FP-3 class with `.local` in `ignore` still being flagged. Both Docs-Coverage scans now call `shouldIgnore(entry, config) || shouldIgnore(entry + '/', config)`. Closes FR-015 (audit-confirmed gap).
+- **Test-Spec validator parses multi-path Journey rows correctly.** Previously a Journey cell like `` `path/a.test.ts`, `path/b.test.ts` `` was stripped of all backticks then `existsSync()`d as one string — a 100% false-positive rate on multi-path rows. Now: split on commas outside backticks, strip backticks per segment, evaluate each independently. Row passes if ANY referenced file has evidence. Glob entries (`foo_*.test.ts`) are expanded; `(N suites)` / `(N tests)` annotations are accepted as the author's explicit coverage claim. Closes FP-6 and FR-016.
+- **TODO-Tracking validator no longer false-positives on its own keyword list.** Previously the regex matched `TEMP(?!late|orar)` inside its own source. Two-part fix: (1) match restricted to text following a comment marker (`//`, `#`, `/*`, `<!--`, block `*`), (2) the validator skips its own source file (`cli/validators/todo-tracking.mjs`) since the docstring legitimately names the keywords.
+- **TODO-Tracking validator no longer false-positives on test fixture strings.** Test files commonly contain `// TODO:` inside template literals (`writeFileSync(..., '// TODO:')`) that single-line heuristics can't distinguish from real comments. Test files are now skipped by default; opt back in with `config.todoTracking.includeTestFiles = true`.
+- **Traceability validator's own fixtures no longer leak as orphan refs.** `tests/traceability.test.mjs` previously contained literal `REQ-001`/`REQ-002`/`REQ-003` strings that the validator scanned and reported as orphaned test references. Fixtures now build the IDs from parts so the validator's pattern doesn't match.
+
+### Added
+- **Multi-tool IaC detector + consolidated documentation reminder.** New `cli/scanners/iac.mjs` identifies projects shipping any of: **AWS CDK** (`cdk.json`), **Terraform** (`*.tf` files), **Pulumi** (`Pulumi.yaml`), **AWS SAM** (`template.yaml` with `AWS::Serverless::`), and **Serverless Framework** (`serverless.yml`). When an IaC project's ARCHITECTURE.md has no Infrastructure heading, DocGuard emits ONE actionable warning per detected tool naming the marker file location and the expected source layout — instead of multiple generic per-directory warnings (FR-009, FR-010, FR-011). The generic per-dir warnings inside IaC packages (`bin/`, `lib/`, `modules/`, `stacks/`, `constructs/`, `handlers/`, etc.) are suppressed in favor of these consolidated messages. The legacy `cli/scanners/cdk.mjs` is preserved as a thin re-export for backward compatibility.
+- **`## Infrastructure (IaC)` section in `templates/ARCHITECTURE.md.template`.** New projects initialized via `docguard init` start with placeholder tables for AWS CDK, Terraform, and Pulumi/SAM/Serverless layouts plus a Deployment Pipeline subsection (FR-012). Explicitly skippable for non-IaC projects via a header comment.
+- **`DEFAULT_IGNORE_DIRS`** exported from `cli/shared-ignore.mjs` — canonical shared ignore set covering build outputs (`dist`, `build`, `out`, `cdk.out`, `target`, `.gradle`), VCS internals (`.git`, `.jj`, `.hg`, `.svn`), package caches (`node_modules`, `vendor`, `.venv`, `__pycache__`), and framework synth outputs (`.next`, `.nuxt`, `.turbo`, `.vercel`, `.cache`, `.svelte-kit`) (FR-008). Added `target` (Rust/Java), `.gradle`, and `.svelte-kit` per the updated wu-whatsappinbox audit. Available for any future validator to import; existing per-validator `IGNORE_DIRS` sets are left in place (deferred migration).
+
+### Changed
+- **DocGuard package version bumped to 0.11.1** across `package.json` and all `extensions/spec-kit-docguard/` files (extension.yml + 5 SKILL.md files were referencing stale `v0.9.9`/`v0.10.0`).
+- **`docs-canonical/ARCHITECTURE.md`** updated to add `cli/writers/` and `cli/shared-*.mjs` to the Component Map and Layer Boundaries — closes a real doc gap surfaced by dogfooding (the writers/ directory has shipped for several releases without being documented).
+- **`specs/003-v011-false-positives/plan.md`** restructured to match the spec-kit `plan-template.md` shape (added Summary, Technical Context, Constitution Check, Project Structure sections). `tasks.md` rewritten with the spec-kit phased T### convention.
+
+### Internal
+- New test files: `tests/cdk-detection.test.mjs` (CDK + multi-tool IaC detector tests + `globMatch` worktree rejection + `DEFAULT_IGNORE_DIRS` shape). Existing test suites extended with regression cases for FP-1..FP-5, TODO-tracking false-positive guards, and IaC-tool detection across Terraform/Pulumi/SAM/Serverless. New tests are annotated with `// @req FR-NNN` / `// @req SC-NNN` comments for traceability. **Total: 329 tests passing (was 306, +23 new).**
+- **DocGuard self-audit improvements**: ran `docguard guard` on the repo as part of this release. Warnings dropped from **57 → 15** across the session by fixing real drift (stale extension versions, missing `cli/writers/` mention, traceability gaps) and reducing self-referential false positives (TODO validator scanning its own keyword list).
+- **Round 2 fixes after a second audit report**: FP-3 part B (`checkConfigFiles` honoring `config.ignore`), FP-6 (Test-Spec multi-path Journey row parsing with glob and `(N suites)` annotation support), additional `DEFAULT_IGNORE_DIRS` entries for Rust/Java/SvelteKit. **Total tests passing: 336** (was 306).
+- No new NPM dependencies. Zero schema or config-file changes.
+
+### Out of scope (deferred to v0.12)
+- Feature requests IR-1..IR-4, IR-6..IR-8 (per-validator severity, `--diff-only`, draft-staleness warning, `sync --section`, `.docguardignore` template at init, extended Next.js detection, `routesGlob`/`servicesGlob` overrides). IR-5 (honor ignore in source-dir scan) shipped as part of this release alongside FP-3.
+- Migrating all 17 modules that define their own `IGNORE_DIRS` constant to import `DEFAULT_IGNORE_DIRS` — mechanical, large diff, tracked separately.
+- Multi-line string-literal detection in TODO-Tracking — current heuristic still false-positives on `// TODO:` inside multi-line template literals. Workaround: keep test files out of TODO scanning (now default) or use `config.todoIgnore` globs.
+
+Credit: feedback from running v0.11.0 on the `wu-whatsappinbox` enterprise monorepo (audit score 98/100, 40 warnings).
+
 ## [0.11.0] - 2026-05-22
 
 This release reshapes DocGuard from a documentation linter into an **AI-readable, always-current project memory builder** — for any language project, not just JS/web. The four-mode lifecycle (`generate → guard → sync → fix`) is now coherent end-to-end.

{docguard_cli-0.11.0 → docguard_cli-0.11.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: docguard-cli
-Version: 0.11.0
+Version: 0.11.1
 Summary: The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation. Zero dependencies.
 Project-URL: Homepage, https://github.com/raccioly/docguard
 Project-URL: Documentation, https://github.com/raccioly/docguard#readme

docguard_cli-0.11.1/cli/scanners/cdk.mjs

@@ -0,0 +1,10 @@
+/**
+ * CDK Detector — Re-export shim.
+ *
+ * The CDK-specific detector has been generalized into a multi-tool IaC
+ * detector at cli/scanners/iac.mjs covering CDK, Terraform, Pulumi, SAM,
+ * and Serverless Framework. This module re-exports the CDK-only API for
+ * backward compatibility. New code should import from iac.mjs directly.
+ */
+
+export { detectCDK, hasInfrastructureHeading } from './iac.mjs';

docguard_cli-0.11.1/cli/scanners/iac.mjs

@@ -0,0 +1,235 @@
+/**
+ * IaC Detector — Identifies Infrastructure-as-Code projects.
+ *
+ * IaC code is real production source that defines cloud infrastructure.
+ * It MUST be documented in ARCHITECTURE.md, not silently ignored. This
+ * detector identifies which IaC tool the project uses so docs-coverage
+ * can emit ONE consolidated actionable warning naming the actual layout
+ * (instead of multiple generic per-directory warnings).
+ *
+ * Supported tools:
+ *   - AWS CDK         → cdk.json marker file
+ *   - Terraform       → *.tf files in any non-ignored directory
+ *   - Pulumi          → Pulumi.yaml marker file
+ *   - AWS SAM         → template.yaml/yml with "AWS::Serverless::"
+ *   - Serverless Fmw  → serverless.yml/serverless.yaml/serverless.ts
+ *
+ * Zero NPM dependencies — pure Node.js built-ins only.
+ */
+
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { DEFAULT_IGNORE_DIRS } from '../shared-ignore.mjs';
+
+const MAX_DEPTH = 6;
+
+/**
+ * Per-tool conventions: marker file/pattern + the directories that hold the
+ * actual IaC source. Used to construct the consolidated warning text.
+ */
+const TOOL_PROFILES = {
+  cdk: {
+    label: 'AWS CDK',
+    markerFile: 'cdk.json',
+    sourceDirs: ['bin/ (app entrypoint)', 'lib/stacks/', 'lib/constructs/'],
+    headingPattern: /^#+\s+(infrastructure|cdk|iac)\b/im,
+  },
+  terraform: {
+    label: 'Terraform',
+    markerFile: null, // any *.tf file
+    sourceDirs: ['*.tf (root module)', 'modules/ (reusable modules)', 'environments/ (per-env tfvars)'],
+    headingPattern: /^#+\s+(infrastructure|terraform|iac)\b/im,
+  },
+  pulumi: {
+    label: 'Pulumi',
+    markerFile: 'Pulumi.yaml',
+    sourceDirs: ['index.ts (main program)', 'stacks/', 'config/'],
+    headingPattern: /^#+\s+(infrastructure|pulumi|iac)\b/im,
+  },
+  sam: {
+    label: 'AWS SAM',
+    markerFile: 'template.yaml', // also template.yml — checked below
+    sourceDirs: ['template.yaml (SAM manifest)', 'src/ (Lambda handlers)', 'events/'],
+    headingPattern: /^#+\s+(infrastructure|sam|serverless|iac)\b/im,
+  },
+  serverless: {
+    label: 'Serverless Framework',
+    markerFile: 'serverless.yml', // also .yaml, .ts — checked below
+    sourceDirs: ['serverless.yml (manifest)', 'handlers/', 'src/'],
+    headingPattern: /^#+\s+(infrastructure|serverless|iac)\b/im,
+  },
+};
+
+/**
+ * Detect every IaC tool used in the project. Walks the tree from projectDir
+ * looking for marker files, respecting DEFAULT_IGNORE_DIRS.
+ *
+ * @param {string} projectDir - Absolute path to project root
+ * @returns {{
+ *   isIaC: boolean,
+ *   tools: Array<{
+ *     tool: string,             // 'cdk' | 'terraform' | 'pulumi' | 'sam' | 'serverless'
+ *     label: string,            // 'AWS CDK' etc.
+ *     markerPaths: string[],    // relative paths to detected marker files
+ *     packageDirs: string[],    // relative dirs containing the markers
+ *     sourceDirs: string[],     // expected source layout per tool convention
+ *   }>
+ * }}
+ */
+export function detectIaC(projectDir) {
+  const findings = {
+    cdk: { markerPaths: [], packageDirs: [] },
+    terraform: { markerPaths: [], packageDirs: [] },
+    pulumi: { markerPaths: [], packageDirs: [] },
+    sam: { markerPaths: [], packageDirs: [] },
+    serverless: { markerPaths: [], packageDirs: [] },
+  };
+
+  const recordFinding = (tool, fullPath) => {
+    const relPath = relative(projectDir, fullPath);
+    findings[tool].markerPaths.push(relPath);
+    const pkgDir = relative(projectDir, dirnameOf(fullPath)) || '.';
+    if (!findings[tool].packageDirs.includes(pkgDir)) {
+      findings[tool].packageDirs.push(pkgDir);
+    }
+  };
+
+  const walk = (dir, depth) => {
+    if (depth > MAX_DEPTH) return;
+    let entries;
+    try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
+
+    for (const e of entries) {
+      if (!e.isFile()) continue;
+      const full = join(dir, e.name);
+
+      // CDK
+      if (e.name === 'cdk.json') recordFinding('cdk', full);
+
+      // Terraform — any .tf file (we record one per directory, not per file)
+      if (e.name.endsWith('.tf')) {
+        const pkgDir = relative(projectDir, dir) || '.';
+        if (!findings.terraform.packageDirs.includes(pkgDir)) {
+          findings.terraform.markerPaths.push(relative(projectDir, full));
+          findings.terraform.packageDirs.push(pkgDir);
+        }
+      }
+
+      // Pulumi
+      if (e.name === 'Pulumi.yaml' || e.name === 'Pulumi.yml') {
+        recordFinding('pulumi', full);
+      }
+
+      // SAM — template.yaml/yml WITH AWS::Serverless::
+      if (e.name === 'template.yaml' || e.name === 'template.yml') {
+        if (fileContains(full, 'AWS::Serverless::')) recordFinding('sam', full);
+      }
+
+      // Serverless Framework
+      if (
+        e.name === 'serverless.yml' ||
+        e.name === 'serverless.yaml' ||
+        e.name === 'serverless.ts' ||
+        e.name === 'serverless.js'
+      ) {
+        recordFinding('serverless', full);
+      }
+    }
+
+    for (const e of entries) {
+      if (!e.isDirectory()) continue;
+      if (DEFAULT_IGNORE_DIRS.has(e.name)) continue;
+      if (e.name.startsWith('.')) continue;
+      walk(join(dir, e.name), depth + 1);
+    }
+  };
+
+  if (existsSync(projectDir)) {
+    try {
+      if (statSync(projectDir).isDirectory()) walk(projectDir, 0);
+    } catch { /* skip */ }
+  }
+
+  const tools = [];
+  for (const [tool, data] of Object.entries(findings)) {
+    if (data.markerPaths.length > 0) {
+      tools.push({
+        tool,
+        label: TOOL_PROFILES[tool].label,
+        markerPaths: data.markerPaths,
+        packageDirs: data.packageDirs,
+        sourceDirs: TOOL_PROFILES[tool].sourceDirs,
+      });
+    }
+  }
+
+  return { isIaC: tools.length > 0, tools };
+}
+
+/**
+ * Check whether ARCHITECTURE.md content includes an Infrastructure/CDK/IaC/
+ * Terraform/Pulumi/SAM heading at any level. Case-insensitive.
+ *
+ * @param {string} archContent - Full ARCHITECTURE.md content
+ * @returns {boolean}
+ */
+export function hasInfrastructureHeading(archContent) {
+  if (!archContent) return false;
+  return /^#+\s+(infrastructure|cdk|iac|terraform|pulumi|sam|serverless)\b/im.test(archContent);
+}
+
+/**
+ * Build the consolidated warning text for a detected IaC tool.
+ * One warning per tool — names the marker location and required content.
+ */
+export function buildIaCWarning(toolFinding) {
+  const primary = toolFinding.markerPaths[0];
+  const pkgDir = toolFinding.packageDirs[0];
+  const where = pkgDir === '.' ? '' : pkgDir + '/';
+  const sourceList = toolFinding.sourceDirs
+    .map(s => s.startsWith('*.') ? `${where}${s}` : `${where}${s}`)
+    .join(', ');
+  return `${toolFinding.label} detected at ${primary} — add an "Infrastructure" section to ` +
+    `ARCHITECTURE.md covering ${sourceList}`;
+}
+
+// ── Helpers ─────────────────────────────────────────────────────────────────
+
+function dirnameOf(p) {
+  const i = p.lastIndexOf('/');
+  if (i < 0) {
+    const j = p.lastIndexOf('\\');
+    return j < 0 ? p : p.slice(0, j);
+  }
+  return p.slice(0, i);
+}
+
+function fileContains(filePath, needle) {
+  try {
+    const content = readFileSync(filePath, 'utf-8');
+    return content.includes(needle);
+  } catch {
+    return false;
+  }
+}
+
+// ── Backwards-compatibility shim ────────────────────────────────────────────
+
+/**
+ * Legacy CDK-only API kept for callers that don't need multi-tool detection.
+ * Delegates to detectIaC and projects the CDK slice into the old shape.
+ *
+ * @deprecated Use detectIaC for new code.
+ */
+export function detectCDK(projectDir) {
+  const result = detectIaC(projectDir);
+  const cdk = result.tools.find(t => t.tool === 'cdk');
+  if (!cdk) {
+    return { isCDK: false, cdkJsonPaths: [], cdkPackageDirs: [] };
+  }
+  return {
+    isCDK: true,
+    cdkJsonPaths: cdk.markerPaths,
+    cdkPackageDirs: cdk.packageDirs,
+  };
+}

{docguard_cli-0.11.0 → docguard_cli-0.11.1}/cli/shared-ignore.mjs

@@ -15,6 +15,31 @@
  * Zero NPM dependencies — pure Node.js built-ins only.
  */
 
+/**
+ * Canonical set of directory names that should never be scanned, regardless
+ * of validator. Build outputs, VCS internals, package caches, framework synth
+ * outputs. Validators MAY extend this with their own additions but SHOULD
+ * start from this base so behavior is consistent across the tool.
+ */
+export const DEFAULT_IGNORE_DIRS = new Set([
+  // Package managers
+  'node_modules', 'vendor', '.venv', '__pycache__',
+  // VCS
+  '.git', '.jj', '.hg', '.svn',
+  // Build outputs — JS/TS, Rust/Java, generic
+  'dist', 'build', 'out', 'coverage', 'target', '.gradle',
+  // Framework synth/cache
+  '.next', '.nuxt', '.turbo', '.vercel', '.cache', '.svelte-kit', 'cdk.out',
+  // OS
+  '.DS_Store',
+]);
+
+// Regex for paths that must always be rejected at any depth, regardless of
+// the glob pattern matching them. These are duplicate file trees (worktrees)
+// or runtime caches that should NEVER be treated as primary source.
+const ALWAYS_REJECT_PATH_RE =
+  /(?:^|[/\\])(?:node_modules|\.claude[/\\]worktrees|\.git[/\\]worktrees|\.jj)(?:[/\\]|$)/;
+
 /**
  * Convert a glob pattern to a RegExp.
  * Supports: * (any chars except /), ** (any path segments), . (literal dot).
@@ -111,8 +136,10 @@ function globToMatchRegex(pattern) {
 export function globMatch(relPath, patterns) {
   if (!relPath || !patterns || patterns.length === 0) return false;
 
-  // Always reject paths containing node_modules at any depth
-  if (/(?:^|[/\\])node_modules(?:[/\\]|$)/.test(relPath)) return false;
+  // Always reject paths inside node_modules / worktree copies / .jj at any
+  // depth. A user's testPatterns like "**/*.test.ts" would otherwise match
+  // duplicate trees under .claude/worktrees and inflate test counts.
+  if (ALWAYS_REJECT_PATH_RE.test(relPath)) return false;
 
   const regexes = patterns.map(p => globToMatchRegex(p));
   return regexes.some(r => r.test(relPath));

{docguard_cli-0.11.0 → docguard_cli-0.11.1}/cli/shared-source.mjs

@@ -18,8 +18,9 @@ import { resolve, join, dirname, relative, extname } from 'node:path';
 import { shouldIgnore } from './shared-ignore.mjs';
 
 const IGNORE_DIRS = new Set([
-  'node_modules', '.git', '.next', 'dist', 'build',
+  'node_modules', '.git', '.next', '.nuxt', 'dist', 'build', 'out',
   'coverage', '.cache', '__pycache__', '.venv', 'vendor', '.turbo',
+  'cdk.out',
 ]);
 
 const CODE_EXTENSIONS = new Set([

{docguard_cli-0.11.0 → docguard_cli-0.11.1}/cli/validators/docs-coverage.mjs

@@ -16,10 +16,14 @@
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { resolve, join, relative, basename, extname } from 'node:path';
 import { resolveSourceRoots } from '../shared-source.mjs';
+import { shouldIgnore } from '../shared-ignore.mjs';
+import { detectIaC, hasInfrastructureHeading, buildIaCWarning } from '../scanners/iac.mjs';
 
 const IGNORE_DIRS = new Set([
-  'node_modules', '.git', '.next', 'dist', 'build', 'coverage',
-  '.cache', '__pycache__', '.venv', 'vendor', '.turbo', '.vercel',
+  'node_modules', '.git', '.next', '.nuxt', 'dist', 'build', 'out',
+  'coverage', '.cache', '__pycache__', '.venv', 'vendor',
+  '.turbo', '.vercel', '.svelte-kit', 'cdk.out', '.claude',
+  'target', '.gradle',
 ]);
 
 // Dotfiles that are universally common and don't need documentation
@@ -50,8 +54,12 @@ export function validateDocsCoverage(projectDir, config) {
     return { errors: [], warnings, passed: 0, total: 0 };
   }
 
+  // IaC detection runs once and informs both Check 3 (suppression) and
+  // Check 6 (consolidated warning). One scan, two consumers.
+  const iac = detectIaC(projectDir);
+
   // ── Check 1: Project-specific config/dotfiles referenced in docs ──
-  const configChecks = checkConfigFiles(projectDir, allDocContent);
+  const configChecks = checkConfigFiles(projectDir, allDocContent, config);
   total += configChecks.total;
   passed += configChecks.passed;
   warnings.push(...configChecks.warnings);
@@ -63,7 +71,7 @@ export function validateDocsCoverage(projectDir, config) {
   warnings.push(...binChecks.warnings);
 
   // ── Check 3: Source directory structure matches ARCHITECTURE.md ──
-  const dirChecks = checkSourceDirs(projectDir, allDocContent, config);
+  const dirChecks = checkSourceDirs(projectDir, allDocContent, config, iac);
   total += dirChecks.total;
   passed += dirChecks.passed;
   warnings.push(...dirChecks.warnings);
@@ -80,6 +88,12 @@ export function validateDocsCoverage(projectDir, config) {
   passed += readmeChecks.passed;
   warnings.push(...readmeChecks.warnings);
 
+  // ── Check 6: IaC-aware Infrastructure documentation ──
+  const iacChecks = checkIaCDocumentation(projectDir, iac);
+  total += iacChecks.total;
+  passed += iacChecks.passed;
+  warnings.push(...iacChecks.warnings);
+
   return { errors: [], warnings, passed, total };
 }
 
@@ -88,8 +102,10 @@ export function validateDocsCoverage(projectDir, config) {
 /**
  * Check 1: Project-specific config/dotfiles are mentioned in docs.
  * Skips universally common files (.gitignore, .eslintrc, etc.).
+ * Honors config.ignore (FR-015 — applies user-configured ignore patterns
+ * consistently across all docs-coverage checks).
  */
-function checkConfigFiles(projectDir, allDocContent) {
+function checkConfigFiles(projectDir, allDocContent, config = {}) {
   const warnings = [];
   let passed = 0;
   let total = 0;
@@ -111,6 +127,17 @@ function checkConfigFiles(projectDir, allDocContent) {
     if (COMMON_DOTFILES.has(entry)) continue;
     if (entry === 'tsconfig.json' || entry === 'package-lock.json') continue;
 
+    // Skip directories — this check is for configuration FILES, not dirs.
+    // Build-cache dotdirs (.nuxt, .next, .turbo, etc.) are handled by IGNORE_DIRS.
+    try {
+      if (statSync(join(projectDir, entry)).isDirectory()) continue;
+    } catch { continue; }
+
+    // Honor user-configured ignore patterns (FR-015 / IR-5).
+    // Same dual-form check as checkSourceDirs: relative path and trailing-slash
+    // form so dotfile-style patterns and dir-style patterns both apply.
+    if (shouldIgnore(entry, config) || shouldIgnore(entry + '/', config)) continue;
+
     total++;
     if (lowerDocContent.includes(entry.toLowerCase())) {
       passed++;
@@ -160,8 +187,13 @@ function checkPackageBins(projectDir, allDocContent) {
 
 /**
  * Check 3: Source directories are referenced in ARCHITECTURE.md.
+ *
+ * Honors config.ignore (FR-006). When IaC is detected and the Infrastructure
+ * heading is missing, per-directory warnings inside the IaC package roots
+ * are suppressed — Check 6 emits one consolidated warning per IaC tool
+ * instead (FR-011).
  */
-function checkSourceDirs(projectDir, allDocContent, config = {}) {
+function checkSourceDirs(projectDir, allDocContent, config = {}, iac = { isIaC: false, tools: [] }) {
   const warnings = [];
   let passed = 0;
   let total = 0;
@@ -173,6 +205,15 @@ function checkSourceDirs(projectDir, allDocContent, config = {}) {
   try { archContent = readFileSync(archPath, 'utf-8'); } catch { return { warnings, passed, total }; }
 
   const lowerArchContent = archContent.toLowerCase();
+  const infraDocumented = hasInfrastructureHeading(archContent);
+
+  // Only suppress per-dir warnings when IaC exists AND no Infrastructure
+  // heading is present — Check 6 will fire the consolidated message instead.
+  const suppressIaCDirs = iac.isIaC && !infraDocumented;
+
+  // Flatten every IaC tool's package dirs into a single Set for fast lookup.
+  const iacPackageDirs = [];
+  for (const tool of iac.tools) iacPackageDirs.push(...tool.packageDirs);
 
   // Monorepo-aware: honor config.sourceRoot + workspaces instead of a hardcoded list.
   for (const rootDir of resolveSourceRoots(projectDir, config)) {
@@ -189,6 +230,22 @@ function checkSourceDirs(projectDir, allDocContent, config = {}) {
 
       if (IGNORE_DIRS.has(entry) || entry.startsWith('.') || entry === '__tests__' || entry === '__test__') continue;
 
+      const relPath = relative(projectDir, fullPath);
+
+      // Honor user-configured ignore patterns (FR-006 / IR-5).
+      // Patterns like `**/cdk.out/**` are written to match files INSIDE the
+      // directory; appending '/' lets us match the directory itself too.
+      if (shouldIgnore(relPath, config) || shouldIgnore(relPath + '/', config)) continue;
+
+      // Suppress per-dir warnings for IaC-relevant subdirs inside an IaC
+      // package — the consolidated Check 6 warning covers them. Includes CDK
+      // (bin/, lib/, stacks/, constructs/), Terraform (modules/, environments/),
+      // Pulumi (stacks/), SAM (events/, src/), Serverless (handlers/, src/).
+      if (suppressIaCDirs && isInsideIaCPackage(relPath, iacPackageDirs)
+          && IAC_SUBDIR_NAMES.has(entry)) {
+        continue;
+      }
+
       total++;
       const searchName = entry.toLowerCase();
       if (lowerArchContent.includes(searchName) || lowerArchContent.includes(root + '/' + entry)) {
@@ -204,6 +261,68 @@ function checkSourceDirs(projectDir, allDocContent, config = {}) {
   return { warnings, passed, total };
 }
 
+/**
+ * Subdirectory names recognized as IaC-relevant across all supported tools.
+ * When IaC is detected and the Infrastructure heading is missing, these dirs
+ * inside the IaC package are suppressed from Check 3 to avoid double-warning.
+ */
+const IAC_SUBDIR_NAMES = new Set([
+  // CDK
+  'bin', 'lib', 'stacks', 'constructs',
+  // Terraform
+  'modules', 'environments',
+  // SAM / Serverless / Pulumi
+  'handlers', 'events', 'src',
+]);
+
+/**
+ * True if `relPath` is inside any of the IaC package directories.
+ * Both inputs are project-relative POSIX paths.
+ */
+function isInsideIaCPackage(relPath, packageDirs) {
+  if (!packageDirs || packageDirs.length === 0) return false;
+  const normalized = relPath.split('\\').join('/');
+  return packageDirs.some(pkgDir => {
+    const p = pkgDir === '.' ? '' : pkgDir.split('\\').join('/');
+    if (p === '') return true;
+    return normalized === p || normalized.startsWith(p + '/');
+  });
+}
+
+/**
+ * Check 6: IaC projects should document their Infrastructure layer.
+ *
+ * Emits ONE consolidated warning per detected IaC tool when ARCHITECTURE.md
+ * has no Infrastructure heading. Suppresses the generic per-directory
+ * warnings that would otherwise fire for bin/, lib/, modules/, handlers/, etc.
+ */
+function checkIaCDocumentation(projectDir, iac) {
+  const warnings = [];
+  if (!iac || !iac.isIaC) return { warnings, passed: 0, total: 0 };
+
+  const archPath = resolve(projectDir, 'docs-canonical/ARCHITECTURE.md');
+  if (!existsSync(archPath)) {
+    // No ARCHITECTURE.md at all — structure validator will catch that.
+    // Don't double-warn here.
+    return { warnings, passed: 0, total: 0 };
+  }
+
+  let archContent;
+  try { archContent = readFileSync(archPath, 'utf-8'); } catch { return { warnings, passed: 0, total: 0 }; }
+
+  if (hasInfrastructureHeading(archContent)) {
+    // One pass per tool — counted as total per IaC tool present.
+    return { warnings, passed: iac.tools.length, total: iac.tools.length };
+  }
+
+  // One actionable warning per detected IaC tool. Most projects use one tool,
+  // but a multi-tool monorepo gets one targeted message each.
+  for (const tool of iac.tools) {
+    warnings.push(buildIaCWarning(tool));
+  }
+  return { warnings, passed: 0, total: iac.tools.length };
+}
+
 /**
  * Check 4: Config files that code actually READS are documented.
  *